Have to be careful that the graph, while showing provenance, also has to capture every source as it was. Otherwise, like a Docker image tag--which floats--can't be solely relied on.