Google, IBM and others launch an open source API for keeping tabs on software supply chains

You probably still want to know who actually built a given container and what’s running in it.