Re: [media-types] Community review for proposed 'spdx' media type

[Henrik Andersson <[e-mail]>]

Rose Judge wrote:
>
> Hello,
>
>  
>
> Please see below for application of proposed new media type:
>
>  
>
>  
>
> Name: Rose Judge
>
> Email: [e-mail] <mailto:[e-mail]>
>
>  
>
> Media type name: text
>
> Media subtype name: spdx
>
>  
>
> Required parameters:
>
> Based on 2.2 spec the following fields and tags are mandatory in the
> specification document. 
>
>  
>
> Document Creation Information Tags:
>
> SPDXVersion, DataLicense, SPDXID, DocumentName, DocumentNamespace,
> Creator, Created
>
>  
>
> Package Information Tags:
>
> PackageName, SPDXID, PackageDownloadLocation, FileName,
> PackageVerificationCode**, PackageLicenseConcluded,
> PackageLicenseInfoFromFiles**, PackageLicenseDeclared,
> PackageCopyrightText, 
>
>  
>
> File Information Tags:
>
> FileName, SPDXID, FileChecksum, LicenseConcluded, LicenseInfoInFile,
> FileCopyrightText, 
>
>  
>
> Snippet Information Tags:
>
> SPDXRef, DocumentRef, SnippetByteRange, SnippetLicenseConcluded,
> SnippetCopyrightText, 
>
>  
>
> Annotation Information Tags:
>
> Annotator
>
>  
>
>  
>
> ** Mandatory, one or many if FilesAnalyzed is true or omitted, zero
> (must be omitted) if FilesAnalyzed is false.
>
>  
>
>  
>
> Optional parameters:
>
> Based on 2.2 spec the following fields and tags are optional in the
> specification document. 
>
>  
>
> Optional Document Creation Information Tags:
>
> ExternalDocumentRef, LicenseListVersion, CreatorComment, DocumentComment
>
>  
>
> Optional Package Information Tags:
>
> PackageVersion, PackageFileName, PackageSupplier, PackageOriginator,
> FilesAnalyzed, PackageChecksum, PackageHomePage, PackageSourceInfo,
> PackageLicenseComments, PackageSummary, PackageDescription,
> PackageComment, ExternalRef, ExternalRefComment (conditional for each
> ExternalRef)
>
>  
>
> Optional File Information Tags:
>
> FileType, LicenseComments, ArtifactOfProjectName,
> ArtifactOfProjectHomePage, ArtifactOfProjectURI, FileComment,
> FileNotice, FileContributor
>
>  
>
> Optional Snippet Information Tags:
>
> SnippetLineRange, LicenseInfoInSnippet, SnippetLicenseComments,
> SnippetComment, SnippetName
>
>  
>
> Optional Other Licensing Information Detected Tags:
>
> LicenseComment, LicenseID [Conditional (mandatory, one) if license is
> not on SPDX License List], ExtractedText [Conditional (Mandatory, one)
> if there is a License Identifier assigned.], LicenseName [Conditional
> (mandatory, one) if license is not on SPDX License List.],
> LicenseCrossReference [Conditional (optional, one or more) if license
> is not on SPDX License List.]
>
>  
>
> Optional Relationships between SPDX Elements:
>
> Relationship, RelationshipComment
>
>  
>
> Optional Annotation Information Tags:
>
> Annotator [Conditional (Mandatory, one), if there is an Annotation],
> AnnotationDate [Conditional (Mandatory, one), if there is an
> Annotation], AnnotationType [Conditional (Mandatory, one), if there is
> an Annotation], SPDXREF [Conditional (Mandatory, one), if there is an
> Annotation], AnnotationComment [Conditional (Mandatory, one), if there
> is an Annotation]
>
>  
>
>  
>
> Encoding considerations: 8bit
>
> The spdx media type must support UTF-8 encoding.
>
>  
>
> Security considerations:
>
> The ExternalRef tag provides linkage to the NVD via CPE. Data can be
> stored in spdx files that may contain printf-style format characters
> that could cause a program to display unintended information.
>
>  
>
> Interoperability considerations:
>
> The spdx media type can be distributed free of external systems or
> processors and is represented in a human-readable format. There are
> also internet text-processing applications that may consume these
> documents.
>
>  
>
> Published specification:
>
> Current versions of the specification is available at
> https://spdx.github.io/spdx-spec/. Historical versions can be found at
> https://spdx.org/specifications.
>
>  
>
> Applications which use this media:
>
> Exchange of Metadata for software.
>
>  
>
> Fragment identifier considerations:
>
> N/A
>
>  
>
> Restrictions on usage:
>
> spdx media types should only be associated with validated SPDX
> documents that follow the SPDX specification.
>
>  
>
> Provisional registration? (standards tree only):
>
> N/A
>
>  
>
> Additional information:
>
>  
>
> 1. Deprecated alias names for this type: N/A
>
> 2. Magic number(s): N/A
>
> 3. File extension(s): .spdx
>
> 4. Macintosh file type code: N/A
>
> 5. Object Identifiers: N/A
>
>  
>
> General Comments:
>
> Software Package Data Exchange® (SPDX®) is an open standard for
> communicating software bill of material information (including
> components, licenses, copyrights, and security references).
>
>  
>
> Person to contact for further information:
>
>  
>
> 1. Name: Rose Judge
>
> 2. Email: [e-mail] <mailto:[e-mail]>
>
>  
>
> Intended usage: Common
>
> Intended to be used to enable companies and organizations to share
> human-readable and machine-processable software package metadata to
> facilitate software supply chain processes. An SPDX media type will be
> associated with a particular software package or set of packages and
> will contain information about it in the SPDX format.
>
>  
>
> Author/Change controller: [e-mail]
> <mailto:[e-mail]>
>
>  
>
>  
>
>  
>
>
>
> _______________________________________________
> media-types mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/media-types

You seem to have misunderstood the purpose of required and optional
parameters. They are not about the contents of the file. They are
parameters attached to the media type designation as the file is
transferred, stored and processed.