Package Manager Lockfiles as Software Bill of Materials (SBOMs)

Summary

The article argues that package manager lockfiles (like Gemfile.lock, package-lock.json, etc.) are essentially Software Bill of Materials (SBOMs) in different formats. It explores the idea that instead of maintaining separate lockfile formats, package managers could directly use standardized SBOM formats like CycloneDX or SPDX. The piece discusses how lockfiles already record the same information as SBOMs - which packages were installed, at what versions, with checksums, and from where - and suggests that regulatory pressures like the EU's Cyber Resilience Act may drive adoption of standardized SBOM formats in open source projects.