Made some progress ... This has a BOM with a dataset package with a contains relationship to a bunch of files and their sha256 checksums

{
  "@context" : "<https://spdx.org/rdf/3.0.1/spdx-context.jsonld>",
  "@graph" : [ {
    "@id" : "_:creationInfo_0",
    "type" : "CreationInfo",
    "specVersion" : "3.0.1",
    "createdBy" : [ "<http://nf-co.re/agent/agent>" ],
    "created" : "2025-09-18T12:59:49Z"
  }, {
    "spdxId" : "<http://nf-co.re/contains/v0>",
    "type" : "Relationship",
    "relationshipType" : "contains",
    "to" : [ "<http://nf-co.re/file/01995dc4-99b0-72c4-bc03-d4e4f27b5006>", "<http://nf-co.re/file/01995dc4-99ae-7125-bdba-d19b57c250c0>", ... ],
    "from" : "<http://nf-co.re/dataset/v0>",
    "creationInfo" : "_:creationInfo_0"
  }, {
    "spdxId" : "<http://nf-co.re/agent/agent>",
    "type" : "Agent",
    "name" : "agent",
    "creationInfo" : "_:creationInfo_0"
  }, {
    "spdxId" : "<http://nf-co.re/bom/v0>",
    "type" : "Bom",
    "rootElement" : [ "<http://nf-co.re/dataset/v0>" ],
    "name" : "v0",
    "element" : [ "<http://nf-co.re/contains/v0>" ],
    "creationInfo" : "_:creationInfo_0"
  }, {
...

  }, {
    "spdxId" : "<http://nf-co.re/file/01995dc4-99b6-7889-a480-81087ff5c715>",
    "type" : "software_File",
    "verifiedUsing" : [ {
      "type" : "Hash",
      "algorithm" : "sha256",
      "hashValue" : "457465497a2c6b07e757753857fe229f67389c56d0775553e29ecd205cd900a7"
    } ],
    "name" : "Homo_sapiens/GENCODE/GRCh38.p14/Sequence/WholeGenomeFasta/GRCh38.p14.genome.fa.sizes",
    "creationInfo" : "_:creationInfo_0",
    "software_fileKind" : "file"
  }, {
    "spdxId" : "<http://nf-co.re/dataset/v0>",
    "type" : "dataset_DatasetPackage",
    "dataset_datasetType" : [ "other" ],
    "dataset_dataCollectionProcess" : "nf-core/references",
    "dataset_confidentialityLevel" : "green",
    "dataset_dataPreprocessing" : [ "nf-core/references" ],
    "name" : "nf-core/references v0",
    "creationInfo" : "_:creationInfo_0"
  } ]
}

Inspired by this example https://github.com/spdx/spdx-examples/tree/master/dataset

To follow up on this, I implemented https://github.com/heuermh/data-package-tools which takes one or more tab-delimited files containing sha256 checksum and file path columns and outputs a data package software bill of materials (SBOM) in JSON-LD format