Hi @santosomar,
thank you for getting us started on that important topic.

I feel there are a few things that need to clarified:

1. Who assigns / How is the supplierID assgined?
2. When you say supplier: Do you think of the source where you got that from or the developer(s) (project)? (E.g. I might get an open source software A from a service provider B that guarantees software updates / vulnerability fixes for 5 years. Who do I put into supplier? A or B?
3. When you define a productId: Is that a globally valid productId or is it document-local? Who assigns that?