Bom verification failed with unknown reason so far

[henrybear327]

Bug report criteria

• This bug report is not security related, security issues should be disclosed privately via security@etcd.io.
• This is not a support request or question, support requests or questions should be raised in the etcd discussion forums.
• You have read the etcd bug reporting guidelines.
• Existing open issues along with etcd frequently asked questions have been checked and this is not a duplicate.

What happened?

During the dependency update duty, we discovered that the bom verification can sometimes pass on CI but fail on local machines.

One example can be seen is #20703 (comment).

What did you expect to happen?

Bom verification s consistent across execution environments.

How can we reproduce it (as minimally and precisely as possible)?

make verify

Anything else we need to know?

No response

Etcd version (please run commands below)

$ etcd --version
# paste output here

$ etcdctl version
# paste output here

Etcd configuration (command line flags or environment variables)

paste your configuration here

Etcd debug information (please run commands below, feel free to obfuscate the IP address or FQDN in the output)

$ etcdctl member list -w table
# paste output here

$ etcdctl --endpoints=<member list> endpoint status -w table
# paste output here

Relevant log output

[ivanvc]

We reviewed this during our bi-weekly triage meeting.

The current bill of materials tooling we use is unstable. Ideally, we should prioritize #20303 / #18902 higher.