I am once again telling vendors, if your software is unsigned, not checksummed, doesn’t have an SBoM or manifest, or that SBoM doesn’t include network destinations and application interactions…

It’s not running in any environment I look after.

You made it. You should know how it works. That is nobody’s job but yours. I’ll validate it later.