Comment by whacker

> That also means that unless you build a project on two identical hosts then it is unlikely you will get the same SBOMs.

I don't understand why the author thinks this is such an insurmountable issue.

Reproducible builds are possible with a little care: large parts of Debian are built reproducible. There are tools from https://reproducible-builds.org/

Bazel and similar build systems support reproducible builds, and thus identical SBOMs.