Support SPDX 3

[rossburton]

SPDX v3 is out now, and is much better than v2.

[anthonyharrison]

I am aware. I have played with it earlier this year, but the tooling was still immature. SPDX3 is very different to SPDX2. It is on the roadmap but I am not seeing any demand for SBOMs conforming to this version at the moment.

I still see lots of SPDX 2.2 files, so many tools still haven't made the step upto SPDX 2.3 despite being released over 2 years ago.

[rossburton]

Datapoint: I want to manipulate/parse/display/process SBOMs from yoctoproject.org and that writes SPDXv3 by default.

[anthonyharrison]

@rossburton I believe the yocto project already supports SPDX v3 as it is the early adopter for SPDX3.

The supporting libraries for generating or parsing SPDX 3 were still under development and weren't stable when I looked at them a few months back. Having checked back today, they are still under development but currently fail to parse valid files.

[anthonyharrison]

@rossburton Initial SPDX3 support is now provided. Let me know how you get on.

Note to enable SPDX3, you will need to set an environment variable LIB4SBOM_SPDX3=True

It doesn't cover all attributes etc but seems to produce valid SPDX3 documents when validating using the online SPDX3 validator.

Similairly parsing is an initial release.

If you use the latest version of lib4sbom, some of my othertools such as sbom2doc should now work with SPDX2 and SPDX3 (as well as multipole versios of CycloneDX)

[anthonyharrison]

Closing with release v0.10.3