SBOM for 2 different versions of (say) Dropwizard

[msymons]

As an enhancement, it would be useful to be publish SBOM examples for 2 versions of the same OSS project.

It does not really matter which project is chosen. Dropwizard would suit me because I use it!

The use cases are to allow for testing of tools that consume BOMs and which need to process changes in the BOM for a specific project:

• Comparison of two BOMs. ie, has the component inventory changed (versions, count of components, etc)
• Impact of change on auditing/triage.
• Notifications
• etc