sbom.go - hopefully working, but I have my doubts