Idea... repurpose my failed-to-start tool to skip-trace missing pypi maintainers to skip-trace the entire contributor graph of a project. A SBOM, but for attempting to link the contributor name to the real world people.
I see SBOMs track a string with a author/supplier name, but if that string doesn't link to a real world entity, you don't have a supplier you have a string.
Here, have another "hello world! I'm a supplier."