Auto generate an SBOM?
Metadata
Current evaluation
No evaluation has been recorded for this issue yet.
Issue body
There is a potential threat from pip packages vendored at `pack` time.
Would it make sense, to ease the scanning effort, to auto-generate an SBOM?
On the other hand, `*.charm` could be manually modified between pack and upload, so perhaps it's a charmhub concern?
Evaluation history
No evaluation history available.