IIUC chainguard is this, but only for python, java, and docker images so far. https://www.chainguard.dev/libraries