Description of a product with its components or servics 2 divergent standards CycloneDX 1.5 JSON SPDX 2.3 https://cyclonedx.org/docs/1.5/json/ https://spdx.github.io/spdx-spec/v2.3/