Unique SPDXID comply with NTIA Minimume Elements requirements

[surendrapathak]

sbomqs uses the presence of CPE/PURL to check for 'Other unique identifiers' requirements. However, after discussing it with Kate Stewart here, it is clear that SPDXID alone can satisfy that criterion for the SDPX.

Let us change sbomqs towards the original intent.

[riteshnoronha]

Other Unique Identifiers details from NTIA minimum elements

Definition

Other identifiers that are used to identify a component, or
serve as a look-up key for relevant database

More details

Other unique identifiers support automated efforts to map data across data uses and ecosystems
and can reinforce certainty in instances of uncertainty. Examples of commonly used unique
identifiers are Common Platform Enumeration (CPE), Software Identification (SWID) tags, and Package Uniform Resource
Locators (PURL). These other identifiers may not be available for every piece of software, but should be used if they exist.

The above points indicate that presence of any of these identifiers would be enough. I then decided to re-read https://www.ntia.gov/files/ntia/publications/sbom_formats_survey-version-2021.pdf

That indicates for the other unique identifiers we should only be checking SPDXID + namespace for SPDX and serial number for CycloneDX

Wondering if this should be a waterfall check of ids, or just the presence check of serialnumber & spdx+namespace

Lets discuss this more, before changing it.