Is this going to build help push PEP 725 or a are you planning a completely different approach (e.g. separate metadata or somehow inspecting wheel contents)?
I see PURLs appearing in the readme already, but no mention about that PEP. IMO it would be much more beneficial to tackle this problem at the source (packaging metadata that’s used for building; generate SBOM from that), rather than create a separate set of sbom-related metadata that needs to be kept in sync.