The last thing we talked about was picking out some papers, attempting to generate SBOMs for their code repos (https://github.com/anchore/syft is good for that) and investigating what that would look like as citation data, as well as what things are in the SBOM that were not cited in the paper.
[ ] Pick out a random paper from JOSS
[ ] Attempt to get an SBOM for it
[ ] Figure out what that looks like as citation data