So we need a generic artifact repository (containers are just one type) that also maintains an SBOM (with a machine readable format, eg SPDX) for the artifact c

So we need a generic artifact repository (containers are just one type) that also maintains an SBOM (with a machine readable format, eg SPDX) for the artifact content. Is anyone going to fund that? We have a way to do that with git (and signed commits) that covers source code. Is there something that someone can build out of P2P/IFPS/? that would allow that to happen, including some form of search/identification?