Takes a software bill of materials and outputs provenance, and activity data from trustypkg.dev - View it on GitHub