module github.com/spkg/bom