The idea behind a BOM Meta endpoint is to provide format, hash, and external signature information.

The BOM Meta retrieval would work similar to the existing BOM retrieval, but would return metadata rather than the BOM itself.

bom-meta-url = system-url "/" bom-identifier
bom-identifier    = segment
                        ; an identifier that uniquely identifies a BOM
                        ; NOTE: MUST be appropriately URI encoded
                        ; segment as defined in RFC3986

As an example, here's a snippet response for what I'm thinking about being returned:

{
  "spec": {
    "format": "CycloneDX",
    "version": "1.4",
    "mime-type": "application/vnd.cyclonedx+json",
  },
  "published": "2022-03-07T15:50+00Z",
  "checksum": [
    { "alg": "SHA-256", "value": "CF80CD8..." },
    { "alg": "SHA-512", "value": "CF80CD8..." },
    { "alg": "SHA3-256", "value": "CF80CD8..." },
    { "alg": "SHA3-512", "value": "CF80CD8..." },
    { "alg": "BLAKE3", "value": "CF80CD8..." }
  ],
  "signature": [
  
  ]
}

I think alg should be an enum with only those supported algorithms.

As for signatures, it would be ideal if we could support external signature files, signature services (e.g sigstore), and external inline.