github.com/google/osv-scalibr@v0.4.1/extractor/filesystem/sbom/spdx (about) metadata purl spdx.go spdx_test.go testdata