If we tracked the results of the build process independently of the
RPM
itself, we could track much more complicated relationships between
packages (for example, the kernel borrowing bits of the output from the
last glibc build to make its initrd).
Koji's database has that information, sort of. It can tell you exactly
which other packages were installed in the buildroot, so that is the
superset of what-all bits could have been rolled into the output.