IMO we should start an Office of Digital Infrastructure if we want things like software BOM and software oversight. If the government wants secure code they should write the code in a controlled environment. They can run it similarly to an open source project (take pull requests from the general public) but it should be clear that the responsibility lays 100% at their feet.

I don’t think most open source projects really inspect their dependencies that well. Lots of these projects are community/hobby things, they should be treated as such.