The swid package provides a golang API for manipulating Software Identification (SWID) Tags as described by ISO/IEC 19770-2:2015, NISTIR-8060, as well as by their "concise" counterpart CoSWID.
Before doing a PR (and routinely during the dev/test cycle) run
make presubmit
and check its output to make sure your code coverage figures are in line with the target and that there are no newly introduced lint problems.