bug: spdx checksum empty array; allow syft to generate SHA1 for spdx-tag-value documents (#1404)

test/cli/test-fixtures/image-java-spdx-tools/Dockerfile

@@ -0,0 +1,7 @@
+FROM cgr.dev/chainguard/jdk
+
+RUN wget https://github.com/spdx/tools-java/releases/download/v1.1.3/tools-java-1.1.3.zip && \
+	unzip tools-java-1.1.3.zip && \
+	rm tools-java-1.1.3.zip
+
+ENTRYPOINT ["java", "-jar", "tools-java-1.1.3-jar-with-dependencies.jar"]

test/cli/test-fixtures/image-java-spdx-tools/Makefile

@@ -0,0 +1,8 @@
+all: build validate
+
+.PHONY: build
+build:
+	docker build -t spdx-java-tools:latest .
+
+validate:
+	docker run --rm -v ${FILE}:/home/build/${BASE} spdx-java-tools:latest Verify ${BASE}