Update PackageVerificationCode.md

[kestewart]

Add in Algorithm, and rework algorithm example to use example fields.

Signed-off-by: Kate Stewart kstewart@linuxfoundation.org

[kestewart]

This addresses #646

[maxhbr]

I thought that the algorithm was fixed to SHA1 and is not parametric? Is there a reason to change this compared to v2? I thought that package verification code is also basically deprecated and discourage from being used. Making it more capable feels weird.

[goneall]

@maxhbr you raise a good point. I'm OK either way as this is just for legacy purposes.

It may be easier to migrate if we don't have the property and just define it as SHA1 since we don't have an algorithm property in 2.3.

@kestewart - thoughts?

[kestewart]

It had been talked about using SHA256 as this will be more common than SHA1. At this point, prefer to leave it flexible with "algorithm", and can restrict it if necessary going forward.

[maxhbr]

we describe the PackageVerificationCode with

This verification method is provided for compatibility with SPDX 2.X.

Use of this verification code method is discouraged except for scenarios where the gitoid property on Artifact can not be used.

In my opinion, this makes complicated code that seldomly gets implemented correctly more complex.

[maxhbr]

The code looks fine, but I think this should not be merged.

Also the V2->V3 migration guide would need to be adopted for this change.

[goneall]

LGTM - consistent with discussions on tech call