Replying to @andrewnez@mastodon.social
@andrewnez @gvwilson @fedora is planning to use
https://fedoraproject.org/wiki/Changes/Adopt_PURL_Metadata
which is at the very least SBOM adjacent.
We find that otherwise each packaging ecosyatem has its own way of specifying dependencies, and this makes it harder for security teams to flag issues accurately