Add a packagePurpose parameter to SPDX Package

[goneall]

When discussing the security vulnerability use cases, it would be valuable to know if an SPDX Package represents source files used to compile a package, a binary distribution of a package, or a container.

This would also allow for higher fidelity translations between CycloneDX and SPDX SBOM types.

Propose the cardinality be 0..* since more than one type may apply (e.g. the packageFile contains the binary executables plus all the source files used to create it). Making it optional would allow compatibility with the current SPDX release.

Proposed initial set of cardinality values:

• sourcedistro - A source distribution of a package where all the source files necessary to compile or run an application or library is present
• application (compatible with CycloneDX)
• framework (compatible with CycloneDX)
• library (compatible with CycloneDX)
• container (compatible with CycloneDX)
• operating-system (compatible with CycloneDX)
• device (compatible with CycloneDX)
• firmware (compatible with CycloneDX)
• binarydistro - A single file binary distribution. May map to CycloneDX File.
• distributedfile - A single file which may have its own version and originator (e.g. a properties file or a script). May map to CycloneDX File.

[goneall]

Note: This is related to issue #171 Resolving #171 may not be necessary if this issue is resolved.

[nishakm]

cc: @rnjudge @puerco

[iamwillbar]

In SPDX 3.0 we called that property packagePurpose and its data type is an enum called SoftwarePurpose (which overlaps with that list). We also added snippetPurpose and filePurpose properties to Snippet and File.

[nishakm]

@iamwillbar is there a list of SoftwarePurpose we can use?