Open source projects could sell SBOM fragments