santiagotorres / spdx-linking-mockups Goto Github PK

The trouble with using content addressable documents is that the external document reference cannot use the same checksum to reference itself. The moment the content changes, the checksum changes. As a result, there needs to be some other way to reference the documents from the top level document. Can we use a DocumentChecksum key for this use-case?

1. The config should be separate from the SBoM
2. It would be nice to also include the individual packages as separate SBoMs

(would probably need to write tooling for this)

Layout: https://github.com/SantiagoTorres/spdx-linking-mockups/tree/master/nginx/image

• imageTypes for each JSON blob
• positioning of the JSON blobs