writers[rdf]: Add external package reference

[quaresmajose]

'ExternalPackageRef' is optional but we need to write it when it exist

[pombredanne]

@quaresmajose Thanks! Do you mind to add a test for this?

[quaresmajose]

@pombredanne: currently there is none test for for the writers[rdf] in the repo, the writers[tag] writes the CPE as expected. The ExternalPackageRef was introduced in https://github.com/spdx/tools-python/commit/eb0d2a4e681dab2d76f79441e2d9d36dde608b9c

[NikolaVeber]

Any news on this? As far as I understand SPDX, external references are used to identify packages (like maven) for checking vulnerability databases. In my usecase, it's a make-or-break feature, given that I got it right with the intention behind the external references.

[quaresmajose]

If I remember correctly this field can be used to store the CPE that can be used to do CVE security scans.

[meretp]

There is an open issue concerning this functionality for the jsonyamlxml writer. (#249)

[nicoweidner]

@quaresmajose Is it ok if I take over this PR? Looking back at comments, I think the functionality for jsonyamlxml and potentially unit tests are still missing.

[quaresmajose]

@nicoweidner sure feel free to change or take it according to your needs.

[nicoweidner]

@quaresmajose Thanks! I created a new PR https://github.com/spdx/tools-python/pull/266 which is already rebased on main, will add additional commits there