Open-source SBOM missing from a government bid is a compliance gap — not a press slogan

Cyber Desk · Insight. Series: Digital disputes, as Indian courts actually see them.

Open-source SBOM missing from a government bid is a compliance gap — not a press slogan.

An agency finds GPL code inside a deliverable sold as closed. The question is not whether the vendor can blog about “open-source culture.” It is whether the bid required a software bill of materials, what components were declared, and what licences actually travelled with the code. SBOM hygiene is evidence for supply-chain and licence risk. A missing bill of materials is a gap in the tender story — it is not cured by a press line about innovation.

No SBOM in the bid.

Not a compliant story.