Adding checksum of package as optional param

[hendrikebbers]

Hi,
I ask myself why the PURL does not provide a way to add the checksum of the package that is defined by the url to the url. By doing so it would be possible to not only specify a package / dependency concretely by using PURL but even allow to check an optional download of the package for correctness.

[mjherzog]

@hendrikebbers PURL already covers checksums in the qualifiers component:

'checksum' is a qualifier for one or more checksums stored as a comma-separated list. Each item in the value is in form of 'lowercase_algorithm:hex_encoded_lowercase_value' such as 'sha1:ad9503c3e994a4f611a4892f2e67ac82df727086'.

The ECMA-427 standard does not specify component values - e.g. the key-value pairs, but you will see examples in https://github.com/package-url/purl-spec/blob/main/tests/spec/specification-test.json