Address inherent identifier challenges raised in CISA Whitepaper

[alilleybrinker]

CISA (the Cybersecurity and Infrastructure Security Agency of the United States) recently published a whitepaper on software identification that includes discussion of inherent identifiers and OmniBOR specifically.

They raise two concrete issues about inherent identifiers:

• It can be unclear what file(s) should be the input to an inherent identifier scheme to produce a specific identifier. Put another way: it's unclear how to decide what is the proper thing to identify.
• Most of the properties that describe a piece of software aren't inherent, like version number, product name, etc.

There's an RFI out for responses to the whitepaper, which closes on December 17th. The OmniBOR project would like to put together a response to the RFI addressing these issues as it relates to OmniBOR.