RDF was invented by Big WWW to make harder to understand, more complex formats

anyways what is the point of including vulnerability information in the SBOM? Outside of “Hey automated vuln scanners. we are not affected by this vuln”. this is basically immediately out of date when there is an actual vulnerability, and if you continue shipping the software at this point you are shipping known insecure code

i guess this is comparable to errata lists in hardware but

spinning up a new revision for some hardware is quite expensive

releasing a new software version is free

in general the SBOM formats seem to be a lot more than just providing a dependency tree with like unique package IDs and the role and license each dependency has

“Hey automated vuln scanners. we are not affected by this vuln”

from what i heard about vuln scanners this info could be entirely ignored too