i’m pretty annoyed that stuff like these requirements just makes it into law without getting small companies or startups to have a say in whether they want this or not.
Half the things we are struggling with are due to upstream hardware vendors throwing a hot mess over the fence. Linux&friends being GPL doesn't help us as much as we hoped, because many important and low-level pieces are quite opaque, closed, under-documented, etc.
Anything to force the vendors to be more transparent is good for us. We already automate our builds, keep extensive notes on what works and what doesn't, etc. Our own SBOM is additive on top of the vendor's stack, so all we're really concerned with is the pieces we wrote ourselves. I don't see it as a burden any more than ensuring proper test coverage, or maintaining a lockfile of dependencies.
So yes, please make this a law.
you point out the problem we face today: people in open source typically work at big tech and regularly push ideas that end up costing small hw companies a lot of money. for example rust in the kernel. or over complicated frameworks for the sake of security while lots of hardware does not need security. or features that are important for servers and make those default while most hardware is not a server. and so on.
if open source was primarily managed by small company contributors it would look very different.