Your organization develops software involved in many open source projects and is concerned about software supply chain threats. You need to deliver provenance f...