An SBOM is a tool output, not a fact about your software

Two papers appeared on arXiv in September that describe, from opposite ends, a pipeline control I...