Hey everyone, I’ve been trying to generate an SBOM for our Claw agent deployments following the docs, but I keep hitting a wall with transitive dependencies. I’m using the `syft` command they recommend, targeting the container image we build for our agents.

The issue is that it seems to only capture the direct OS packages (like the base image packages from Alpine) and the main Go binary, but it’s missing a ton of the Go modules we pull in indirectly. I’m especially worried about the runtime monitoring libraries and the eBPF-related dependencies—those are critical for us to track.

Here’s what I’m running:
`syft our-registry/claw-agent:v1.2.3 -o spdx-json > sbom.json`

The output is missing things like `github.com/cilium/ebpf` and `github.com/elastic/go-libaudit`, which I know are in the final binary from the build logs. I’m guessing this is because we’re scanning the final image, not the build stage? Should I be generating the SBOM during the multi-stage build instead, maybe right after the `go mod vendor` step?

Also, how are you all handling signing these SBOMs afterwards? I’ve been looking at Sigstore’s `cosign` for signing the image, but do I sign the SBOM as a separate artifact, or attach it somehow? I want to make sure the entire stack, from the base image up to our code, is verifiable before we roll out agents to new hosts.

Any tips from the team who’ve already set this up in production? 😅 I really don’t want to ship something without a complete software bill of materials, especially with the runtime security focus we have.