Open Source projects could sell SBoM fragments