[PROPOSAL] Standardized cdx namespace property for source file

[candrews]

The cdx namespace should include a property to hold the path of the file that produced the dependency.

Vendors have started included such a property in their namespaces; the lack of standardization around the storage of this information is creating a significant interoperability problem.

For example, GitLab uses gitlab:dependency_scanning:input_file:path.

If this property is standardized, other SBOM producing tools will be more likely to include this information, and SBOM consumers will more likely use it.

[candrews]

Seems related to CycloneDX/specification#31

[coderpatros]

Hi @candrews, this is something we are planning to address in the core spec in v1.5.