[media-types] Community review for proposed 'application/spdx+json' media type

[Rose Judge <[e-mail]>]

Hello,



Please see below for application of a proposed new media type.



Name: Rose Judge

Email: [e-mail]



Media type name: application

Media subtype name: spdx+json



Required parameters: N/A



Optional parameters: N/A



Encoding considerations: binary

This media type inherits the encoding considerations for JSON per RFC 8259 (https://datatracker.ietf.org/doc/html/rfc8259#section-8.1)



Security considerations:

This media type inherits the security considerations for JSON per RFC 8259 section 12. (https://tools.ietf.org/html/rfc8259#section-12)


The ExternalRef tag provides linkage to the NVD via CPE. Data can be stored in spdx files that may contain printf-style format characters that could cause a program to display unintended information.



Interoperability considerations:

The application/spdx+json media type can be distributed free of external systems or processors. Internet text-processing applications will likely consume these documents.


Additionally, this media type inherits the interoperability considerations for JSON per RFC 8259.



Published specification:

Current versions of the specification are available at https://spdx.github.io/spdx-spec/. Historical versions can be found at https://spdx.org/specifications.


The current SPDX JSON schema version is available at https://github.com/spdx/spdx-spec/blob/master/schemas/spdx-schema.json



Applications which use this media:

This media is intended to represent a software bill of materials (SBOM) and will be used by tools that produce or consume SBOMs as part of their software build pipeline.



Fragment identifier considerations:

N/A



Restrictions on usage:

The application/spdx+json media type should only be associated with validated SPDX documents that follow the SPDX specification.



Provisional registration? (standards tree only):

N/A



Additional information:

1. Deprecated alias names for this type: N/A

2. Magic number(s): N/A

3. File extension(s): .spdx.json

4. Macintosh file type code: N/A

5. Object Identifiers: N/A



General Comments:

Software Package Data Exchange® (SPDX®) is an open standard for communicating software bill of material (SBOM) information including components, licenses, copyrights, and security references. SPDX is internationally recognized as an ISO/IEC JTC 1 standard (ISO/IEC 5962:2021 - https://www.iso.org/standard/81870.html).



Person to contact for further information:



1. Name: Rose Judge

2. Email: [e-mail]



Intended usage: Common

Intended to be used to enable companies and organizations to share human-readable and machine-processable software package metadata to facilitate secure and compliant software supply chain processes. An SPDX JSON media type will be associated with a particular software package or set of packages and will contain information about it in the SPDX JSON format.


Author/Change controller: [e-mail]