Your composer.lock knows what a carmaker only guesses
This title could be clearer and more informative.Try out Clickbait Shieldfor free (5 uses left this month).
A Chinese automaker (SAIC) accidentally listed an Android botnet (Teardroid) in its open source attribution for the MG4, revealing that the SBOM was generated by scanning binaries rather than declared dependencies. This exposes a fundamental flaw: scanning produces guesses, while declared dependency management produces facts. In the PHP ecosystem, composer.lock already provides an accurate, hash-verified dependency list that can be exported as a standards-compliant CycloneDX SBOM via the cyclonedx-php-composer plugin. PHPUnit's PHAR distribution demonstrates best practice by embedding its own SBOM, manifest, and composer.lock directly in the artifact, complemented by PGP signatures. The key lesson: dependencies should be declared and managed through a single mechanism (Composer), not vendored manually or reconstructed after the fact.
