Consider using https://github.com/doubleopen-project/spdx-rs?

[tofay]

spdx-rs claims support for serialization/deserialization of SPDX documents in formats corresponding to the json schema (JSON/yaml), and tag/value.

@alilleybrinker should we use that in cargo-spdx?

[alilleybrinker]

Huh, I'd looked at this when I started, but the start of the README made me think it only supported reading, not writing, SPDX documents. Looks like it does both! It's certainly worth trying out 😄