@mtsfoni This is just a very early and uncleaned version of what I had in mind in terms consistency tests for the different serializations. Some checks are passing; most are failing, due to various reasons (haven't yet studied the results). Some might be actual errors, for some the input might just differ, ...

With all the current changes, there are 4 issues for the json protobuf tests:

• valid-attestation (signature, timestamps)
• valid-license-expression (hashes, bom-ref for license expression not supported)
• valid-metadata-lifecycle (issue serializing lifecycle)
• valid-metadata-tool (issue with serialization of components and services for tools)

With all the current changes there is only 1 issue for the xml json tests:

• valid-bom (different content)