Should dependency track level 1 just be "Has an SBOM with build dependencies..."

[TomHennen]

It would be pretty clear what's needed and aligned with what other folks are doing.

It would be aligned with other tracks where we make specific requirements on the types of attestations that are needed at each level.

Are there any downsides?

[TomHennen]

A possible downside (discussed at dinner last night) is that people generally think of SBOMs as being a specific file, but AIUI they can also be a list of the same information you keep elsewhere.

For L1 it should probably be OK for people to meet the requirement by having the deps listed in a database somewhere. Would it be clear that was OK if we said an 'SBOM' was required? Maybe not. Might be better to just leave it as is.

CC @adriandiglio @meder @tombedfordgit @arewm for thoughts