Vulnerability scanner whose every result is a reproducible, signed claim. Pins the lockfile, the OSV feed, the version comparators, and the exclusions to four digests inside a signed in-toto predic...