From a conversation with @luhring ; today we have a Package.ID which is a random UUID which is helpful for uniquely identifying a package within a single report. We should explore the possibility of selecting "vital" elements from a package and its metadata that uniquely identifies the package and create an ID that is stable across multiple runs, as long as the key information that makes up the identity of the package is common across both documents.

Fields that should be considered when making a fingerprint:

• type (rpm, npm, etc)
• name
• version
• all evidence locations (file path + layer ID)