In GNU Guix declaring the license(s) of a package is mandatory so it kinda automates the process of creating SBoM.