https://nattytech.com/google-releases-open-source-library-for-software-composition-analysis/