Subject: [media-types] Community review for proposed 'spdx' media type

From: Rose Judge <[email-masked]>
Date: Thu, 2 Apr 2020 22:20:34 +0000

Hello,

Please see below for application of proposed new media type:

Name: Rose Judge
Email: [email-masked]<mailto:[email-masked]>

Media type name: text
Media subtype name: spdx

Required parameters:
Based on 2.2 spec the following fields and tags are mandatory in the specification document.

Document Creation Information Tags:
SPDXVersion, DataLicense, SPDXID, DocumentName, DocumentNamespace, Creator, Created

Package Information Tags:
PackageName, SPDXID, PackageDownloadLocation, FileName, PackageVerificationCode**, PackageLicenseConcluded, PackageLicenseInfoFromFiles**, PackageLicenseDeclared, PackageCopyrightText,

File Information Tags:
FileName, SPDXID, FileChecksum, LicenseConcluded, LicenseInfoInFile, FileCopyrightText,

Snippet Information Tags:
SPDXRef, DocumentRef, SnippetByteRange, SnippetLicenseConcluded, SnippetCopyrightText,

Annotation Information Tags:
Annotator

** Mandatory, one or many if FilesAnalyzed is true or omitted, zero (must be omitted) if FilesAnalyzed is false.

Optional parameters:
Based on 2.2 spec the following fields and tags are optional in the specification document.

Optional Document Creation Information Tags:
ExternalDocumentRef, LicenseListVersion, CreatorComment, DocumentComment

Optional Package Information Tags:
PackageVersion, PackageFileName, PackageSupplier, PackageOriginator, FilesAnalyzed, PackageChecksum, PackageHomePage, PackageSourceInfo, PackageLicenseComments, PackageSummary, PackageDescription, PackageComment, ExternalRef, ExternalRefComment (conditional for each ExternalRef)

Optional File Information Tags:
FileType, LicenseComments, ArtifactOfProjectName, ArtifactOfProjectHomePage, ArtifactOfProjectURI, FileComment, FileNotice, FileContributor

Optional Snippet Information Tags:
SnippetLineRange, LicenseInfoInSnippet, SnippetLicenseComments, SnippetComment, SnippetName

Optional Other Licensing Information Detected Tags:
LicenseComment, LicenseID [Conditional (mandatory, one) if license is not on SPDX License List], ExtractedText [Conditional (Mandatory, one) if there is a License Identifier assigned.], LicenseName [Conditional (mandatory, one) if license is not on SPDX License List.], LicenseCrossReference [Conditional (optional, one or more) if license is not on SPDX License List.]

Optional Relationships between SPDX Elements:
Relationship, RelationshipComment

Optional Annotation Information Tags:
Annotator [Conditional (Mandatory, one), if there is an Annotation], AnnotationDate [Conditional (Mandatory, one), if there is an Annotation], AnnotationType [Conditional (Mandatory, one), if there is an Annotation], SPDXREF [Conditional (Mandatory, one), if there is an Annotation], AnnotationComment [Conditional (Mandatory, one), if there is an Annotation]

Encoding considerations: 8bit
The spdx media type must support UTF-8 encoding.

Security considerations:
The ExternalRef tag provides linkage to the NVD via CPE. Data can be stored in spdx files that may contain printf-style format characters that could cause a program to display unintended information.

Interoperability considerations:
The spdx media type can be distributed free of external systems or processors and is represented in a human-readable format. There are also internet text-processing applications that may consume these documents.

Published specification:
Current versions of the specification is available at https://spdx.github.io/spdx-spec/. Historical versions can be found at https://spdx.org/specifications.

Applications which use this media:
Exchange of Metadata for software.

Fragment identifier considerations:
N/A

Restrictions on usage:
spdx media types should only be associated with validated SPDX documents that follow the SPDX specification.

Provisional registration? (standards tree only):
N/A

Additional information:

1. Deprecated alias names for this type: N/A
2. Magic number(s): N/A
3. File extension(s): .spdx
4. Macintosh file type code: N/A
5. Object Identifiers: N/A

General Comments:
Software Package Data Exchange® (SPDX®) is an open standard for communicating software bill of material information (including components, licenses, copyrights, and security references).

Person to contact for further information:

1. Name: Rose Judge
2. Email: [email-masked]<mailto:[email-masked]>

Intended usage: Common
Intended to be used to enable companies and organizations to share human-readable and machine-processable software package metadata to facilitate software supply chain processes. An SPDX media type will be associated with a particular software package or set of packages and will contain information about it in the SPDX format.

Author/Change controller: [email-masked]<mailto:[email-masked]>

---

From: Henrik Andersson <[email-masked]>
Date: Sat, 4 Apr 2020 20:54:52 +0200

Rose Judge wrote:
> Email: [email-masked] <mailto:[email-masked]>
>
>  
>
> Media type name: text
>
> Media subtype name: spdx
>
>  
>
> Required parameters:
>
> PackageName, SPDXID, PackageDownloadLocation, FileName,
> PackageVerificationCode**, PackageLicenseConcluded,
> PackageLicenseInfoFromFiles**, PackageLicenseDeclared,
> PackageCopyrightText, 
>
>  
>
> File Information Tags:
>
> ** Mandatory, one or many if FilesAnalyzed is true or omitted, zero
> (must be omitted) if FilesAnalyzed is false.
>
>  
>
>  
>
> Optional parameters:
>
> PackageVersion, PackageFileName, PackageSupplier, PackageOriginator,
> FilesAnalyzed, PackageChecksum, PackageHomePage, PackageSourceInfo,
> PackageLicenseComments, PackageSummary, PackageDescription,
> PackageComment, ExternalRef, ExternalRefComment (conditional for each
> ExternalRef)
>
>  
>
> FileType, LicenseComments, ArtifactOfProjectName,
> ArtifactOfProjectHomePage, ArtifactOfProjectURI, FileComment,
> FileNotice, FileContributor
>
>  
>
> LicenseComment, LicenseID [Conditional (mandatory, one) if license is
> not on SPDX License List], ExtractedText [Conditional (Mandatory, one)
> if there is a License Identifier assigned.], LicenseName [Conditional
> (mandatory, one) if license is not on SPDX License List.],
> LicenseCrossReference [Conditional (optional, one or more) if license
> is not on SPDX License List.]
>
>  
>
> Annotator [Conditional (Mandatory, one), if there is an Annotation],
> AnnotationDate [Conditional (Mandatory, one), if there is an
> Annotation], AnnotationType [Conditional (Mandatory, one), if there is
> an Annotation], SPDXREF [Conditional (Mandatory, one), if there is an
> Annotation], AnnotationComment [Conditional (Mandatory, one), if there
> is an Annotation]
>
>  
>
>  
>
> The ExternalRef tag provides linkage to the NVD via CPE. Data can be
> stored in spdx files that may contain printf-style format characters
> that could cause a program to display unintended information.
>
>  
>
> The spdx media type can be distributed free of external systems or
> processors and is represented in a human-readable format. There are
> also internet text-processing applications that may consume these
> documents.
>
>  
>
> Published specification:
>
> Current versions of the specification is available at
> https://spdx.github.io/spdx-spec/. Historical versions can be found at
> https://spdx.org/specifications.
>
>  
>
> spdx media types should only be associated with validated SPDX
> documents that follow the SPDX specification.
>
>  
>
> Software Package Data Exchange® (SPDX®) is an open standard for
> communicating software bill of material information (including
> components, licenses, copyrights, and security references).
>
>  
>
> 2. Email: [email-masked] <mailto:[email-masked]>
>
>  
>
> Intended usage: Common
>
> Intended to be used to enable companies and organizations to share
> human-readable and machine-processable software package metadata to
> facilitate software supply chain processes. An SPDX media type will be
> associated with a particular software package or set of packages and
> will contain information about it in the SPDX format.
>
>  
>
> _______________________________________________
> media-types mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/media-types

You seem to have misunderstood the purpose of required and optional
parameters. They are not about the contents of the file. They are
parameters attached to the media type designation as the file is
transferred, stored and processed.

---

From: Rose Judge <[email-masked]>
Date: Thu, 9 Apr 2020 20:41:22 +0000

>>> transferred, stored and processed.

Thanks for pointing this out, Henrik. I will revise our answer for this question. I took better look at the Text Media Types Info and  New Rules for Default “charset” Parameter Values for “text/*” Media Types sections and it seems like it boils down to the following, in which case the spdx media type would qualify as a type where the charset information is transported inside the payload. In this case, do I just leave the Required/Optional parameter fields with N/A?

====
In order to improve interoperability with deployed agents, "text/*"
   media type registrations SHOULD either
 
   a.  specify that the "charset" parameter is not used for the defined
       subtype, because the charset information is transported inside
       the payload (such as in "text/xml"), or
 
   b.  require explicit unconditional inclusion of the "charset"
       parameter, eliminating the need for a default value.
 
   In accordance with option (a) above, registrations for "text/*" media
   types that can transport charset information inside the corresponding
   payloads (such as "text/html" and "text/xml") SHOULD NOT specify the
   use of a "charset" parameter, nor any default value, in order to
   avoid conflicting interpretations should the "charset" parameter
   value and the value specified in the payload disagree.
====

Thanks,
Rose

On 4/4/20, 11:56 AM, "Henrik Andersson" <[email-masked]> wrote:

    Rose Judge wrote:
    > https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fspdx.github.io%2Fspdx-spec%2F&amp;data=02%7C01%7Crjudge%40vmware.com%7C3c336ac81f574bb2b6d908d7d8c9b4f0%7Cb39138ca3cee4b4aa4d6cd83d9dd62f0%7C0%7C1%7C637216234078280507&amp;sdata=B%2FuxJfOBdG3P4ieFp0gJP9wUqRr8wHGbTwjDSPF0rIM%3D&amp;reserved=0. Historical versions can be found at
    > https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fspdx.org%2Fspecifications&amp;data=02%7C01%7Crjudge%40vmware.com%7C3c336ac81f574bb2b6d908d7d8c9b4f0%7Cb39138ca3cee4b4aa4d6cd83d9dd62f0%7C0%7C1%7C637216234078280507&amp;sdata=lD4LehotNAl1%2Bz7WgeYPMhTF6oogjhKADkRgz3WMTbM%3D&amp;reserved=0.
    >
    >  
    >
    > https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.ietf.org%2Fmailman%2Flistinfo%2Fmedia-types&amp;data=02%7C01%7Crjudge%40vmware.com%7C3c336ac81f574bb2b6d908d7d8c9b4f0%7Cb39138ca3cee4b4aa4d6cd83d9dd62f0%7C0%7C1%7C637216234078280507&amp;sdata=uvKAjG1rc%2Bz%2F2xlcDug2WXHPUemrBGRdIy6GVMxyh7w%3D&amp;reserved=0