I'm not sure we're talking about the same thing. What manifest are you referring to here? The post is detailing a feature offered by GitHub to generate SBOMs f

I'm not sure we're talking about the same thing. What manifest are you referring to here? The post is detailing a feature offered by GitHub to generate SBOMs from source code repositories - these will provide machine-readable inventory based on the files within the repository. You can upload a dependency graph to feed the SBOM as an out-of-band step, but trusting Alice's out-of-band dep graph is only a function of access to the source code as a source of truth. Ultimately that's what all if this comes down to: creating a machine-readable graph from a predicable central place that tells us information we could have ascertained ourselves before anyway (just with considerably more effort).