bug: spdx checksum empty array; allow syft to generate SHA1 for spdx-tag-value documents (#1404)

test/cli/test-fixtures/image-java-spdx-tools/Makefile

@@ -0,0 +1,8 @@
+all: build validate
+
+.PHONY: build
+build:
+	docker build -t spdx-java-tools:latest .
+
+validate:
+	docker run --rm -v ${FILE}:/home/build/${BASE} spdx-java-tools:latest Verify ${BASE}