CPE as a type

[riteshnoronha]

Currently we implicitly trust the content in a CPE field to be a valid CPE. Its quite possible
the CPE does not follow the CPE specification.

To ensure that in fact these URL match spec, we should introduce cpe as a type, with a Valid method.

[surendrapathak]

This should be a new quality check. The presence of ID does pass the Minimum Element, and the requirements do not exactly specify meeting CPE criteria (see below). Therefore a new quality check makes logical sense.

https://www.ntia.doc.gov/files/ntia/publications/sbom_minimum_elements_report.pdf

Other unique identifiers support automated efforts to map data across data uses and ecosystems and can reinforce certainty in instances of uncertainty. Examples of commonly used unique identifiers are Common Platform Enumeration (CPE),9 Software Identification (SWID) tags,10 and Package Uniform Resource Locators (PURL). 11 These other identifiers may not be available for every piece of software, but should be used if they exist.