DSSE is great for this, if you need more schema use in-toto