Support all allowed SPDX output formats

[stefan6419846]

Short Description

Scancode Toolkit should support all allowed SPDX output formats.

Possible Labels

• new feature
• sbom

Select Category

• Enhancement
• Add License/Copyright
• Scan Feature
• Packaging
• Documentation
• Expand Support
• Other

Describe the Update

At the moment, the default SPDX output options are limited to Tag/Value and RDF, while version 2.2.2 allows at least JSON, XML and YAML as well: https://spdx.github.io/spdx-spec/v2.2.2/conformance/#44-standard-data-format-requirements (It mentions Excel spreadsheets as well, but I do not really have a use case for it.)

How This Feature will help you/your organization

SPDX uses a standardized file format supported by many application. I consider JSON and YAML more readable than Tag/Value or RDF.

Possible Solution/Implementation Details

Add output support for JSON, XML and YAML.

[mjherzog]

The SPDX output options should also specify the SPDX version - I am not sure whether the current output is for SPDX 2.2 or 2.3.

[mjherzog]

See also #3698

[stefan6419846]

According to the code, the current version is SPDX 2.2:

scancode-toolkit/src/formattedcode/output_spdx.py

Line 185 in 6e42937

spdx_version = (2, 2),

scancode-toolkit/src/formattedcode/output_spdx.py

Line 215 in 6e42937

spdx_version=f"SPDX-{spdx_version[0]}.{spdx_version[1]}",

It seems like I can change the parameter to whatever I want with the only effect being that the header field is different, while apparently ignoring all specific aspects of the corresponding version.