Per the discussion at https://discuss.python.org/t/pip-installation-reports/12316, there seems to be an interest in generating detailed reports on the artifacts installed into an environment, with per-artifact data including:

• index URL used
• artifact URL used
• artifact hash
• etc

We already have some related functionality here with our SBOM support, and given the availability of such metadata, I think that this should generally be considered in-scope as a feature for pip-audit