# SBOM assets (hash before publish)