SBOMs and software security – on Chinchilla Squeaks