Could lockfiles just be SBOMs? | Not Hacker News!