”The Acquirer Wants the Bill of Materials, by Friday”
An SBOM snapshot is a fixed, versioned artifact you can regenerate on demand. Every component’s licence obligations are mapped down to the snippet, not just which licences are present, and a component whose licence couldn’t be resolved is listed as unresolved rather than silently dropped, so you always know exactly what the deliverable does and doesn’t cover.The Paperwork, Generated
The Attribution Document renders the actualLICENSE and NOTICE text you’re obliged to distribute, for every component in a snapshot’s inventory, not a summary of it. It’s frozen on first render, including when two requests render it at the same time, so re-downloading it later always returns those exact bytes.