Maintainer here! That's exactly the idea. We're working with intoto and others to get metadata that we can actually verify, directly from build systems. Rekor

Maintainer here! That's exactly the idea. We're working with intoto and others to get metadata that we can actually verify, directly from build systems. Rekor is a place to put and find that metadata that's globally visible and can't be tampered with. We're hoping to add support for the ITE-6 in-toto link format soon, which I see as kind of like an SBOM that can be produced directly from your build system.