Add pkg verification code + checksum clarification

[rnjudge]

There had been some confusion around when to use the Package verification code field vs Package checksum. A small group of us got together and tried to provide more clarity around the two fields in a new section, Annex K.3 Verifying SPDX Packages. We also updated the Description and Intent fields for sections 7.9 and 7.10.

Signed-off-by: Jeff Schutt [email protected]
Signed-off-by: Ivana Atanasova [email protected]
Signed-off-by: Nisha Kumar [email protected]
Signed-off-by: Gary ONeall [email protected]
Signed-off-by: Adolfo Veytia [email protected]
Signed-off-by: Rose Judge [email protected]

[rnjudge]

You can view the markdown version of the changes here:

• https://github.com/rnjudge/spdx-spec/blob/clarify-pvc-pcs/chapters/how-to-use.md#k3-verifying-spdx-packages
• https://github.com/rnjudge/spdx-spec/blob/clarify-pvc-pcs/chapters/package-information.md#710-package-checksum-field-
• https://github.com/rnjudge/spdx-spec/blob/clarify-pvc-pcs/chapters/package-information.md#79-package-verification-code-field-

[goneall]

Just a couple minor comments - which admittedly apply to the previous text as much as it applies to the proposed changes.

[goneall]

3 suggested changes to clearly distinguish the Package content from the Package.

[kestewart]

Per discussion in call, no objections to it being merged.