Add swid property to the software SCO

[chisholm]

Fixes #349

[codecov-io]

Codecov Report

Merging #358 into master will increase coverage by 0.03%.
The diff coverage is n/a.

@@            Coverage Diff             @@
##           master     #358      +/-   ##
==========================================
+ Coverage   98.15%   98.18%   +0.03%     
==========================================
  Files         124      124              
  Lines       14176    14229      +53     
==========================================
+ Hits        13914    13971      +57     
+ Misses        262      258       -4     

Impacted Files	Coverage Δ
stix2/test/v21/test_observed_data.py	100.00% <ø> (ø)
stix2/v21/observables.py	96.93% <ø> (ø)
stix2/pattern_visitor.py	72.81% <0.00%> (-1.75%)	⬇️
stix2/utils.py	97.15% <0.00%> (-0.57%)	⬇️
stix2/v21/sdo.py	94.53% <0.00%> (ø)
stix2/test/v21/test_custom.py	100.00% <0.00%> (ø)
stix2/test/v21/test_malware.py	100.00% <0.00%> (ø)
stix2/test/v21/test_indicator.py	100.00% <0.00%> (ø)
stix2/test/v21/test_infrastructure.py	100.00% <0.00%> (ø)
stix2/test/v21/test_malware_analysis.py	100.00% <0.00%> (ø)
... and 4 more

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update c2b7167...2472af3. Read the comment docs.

[clenk]

I think the format of swid tags is more like org.fedoraproject.Fedora-29. Should we update the test example? I don't know the swid tag for MS Word, though.

[rpiazza]

@clenk, @chisholm - looked at examples in https://nvlpubs.nist.gov/nistpubs/ir/2016/NIST.IR.8060.pdf

Here is a good one:
tagId="com.acme.rms-ce-v4-1-5-0".

Maybe change the cpe one to correspond to this?

[chisholm]

I was looking for info about tagIds too when I was developing this. I couldn't get a free spec anywhere, so I was just trying to uncover whatever bits of information I could. I don't remember where I saw it, but I remember reading that they aren't required to be any particular thing. There may be some "should" rules around them though. So a UUID seemed good enough, and not technically wrong. But I'll change the test.

[rpiazza]

Yes - I agree - its not defined very well. It took the text for the STIX spec directly from the document I referred to above.

[clenk]

Thanks @chisholm!