https://www.andrewhoog.com/posts/source-code-vs-binary-analysis-for-sboms/