search

spdx / spdx-spec

The SPDX specification in MarkDown and HTML formats.
https://spdx.github.io/spdx-spec/
Other
288 stars 137 forks source link

Expected media type for spdx json/xml documents #577

Open samj1912 opened 3 years ago

samj1912 commented 3 years ago

Hello SPDX team. We are trying to integrate spdx support in buildpacks. One of the things that we had a question about was the appropriate media type for spdx documents. It looks like the IANA media type for spdx is registered as text/spdx. Looking at the entry document this seems to be specifically for the spdx tag format. https://www.iana.org/assignments/media-types/text/spdx What is the expected media type for json/xml spdx documents?

text/spdx+json or text/spdx+xml based on https://en.wikipedia.org/wiki/Media_type#Suffix Or would all of them be text/spdx?

Wondering as we were looking at some other sbom formats on the list

CycloneDX seems to have

application/vnd.cyclonedx+json and application/vnd.cyclonedx+xml respectively. . Swid seems to have application/swid+xml

Any guidance here would be greatly appreciated.

samj1912 commented 3 years ago

cc: @nishakm maybe you can help?

nishakm commented 3 years ago

@rnjudge Applied on behalf of SPDX. We could also apply for something like application/org.spdx+json. It's something we can bring up in the next SPDX tech meeting.

rnjudge commented 3 years ago

@samj1912 Yes, the current IANA SPDX type was intended to represent tag-value format with the intention being to re-visit adding other formats in the future so I suppose the future is upon us :) Definitely worth raising at the next meeting and I would be happy to lead this effort. Thanks for surfacing this.

rnjudge commented 2 years ago

Hi @samj1912 - just wanted to update you that I will open an application to add SPDX JSON/XML IANA media types this week.

rnjudge commented 2 years ago

The application/spdx+json media type is officially approved and recorded with IANA: https://www.iana.org/assignments/media-types/application/spdx+json.

After discussing with a few SPDX folks, it was determined that the XML schema needs further review before officially submitting to IANA. I am having conversations around this now and will try to report back with an estimated time frame for when we can expect this.

nishakm commented 2 years ago

This is excellent news! Thanks @rnjudge for pushing this through! cc: @SteveLasker for OCI mediaTypes

kestewart commented 2 years ago

Rose discussed: Only missing media type is now XML. Need to get follow up for @zvr for review.

bact commented 4 days ago

Media type information page on IANA also has a field about file extension. The tag:value SPDX text file has an extension of ".spdx" in IANA.

For JSON, in SPDX 2.3 spec it suggests ".spdx.json" https://spdx.github.io/spdx-spec/v2.3/conformance/#44-standard-data-format-requirements

For SPDX 3, there's no suggested file extension in the spec

The registration of SPDX JSON/XML document to IANA may need this file extension information as well.