Re: [media-types] Community review for proposed 'spdx' media type

[Rose Judge <[e-mail]>]

   >>>  You seem to have misunderstood the purpose of required and optional
    >>> parameters. They are not about the contents of the file. They are
    >>> parameters attached to the media type designation as the file is
    >>> transferred, stored and processed.

Thanks for pointing this out, Henrik. I will revise our answer for this question. I took better look at the Text Media Types Info and  New Rules for Default “charset” Parameter Values for “text/*” Media Types sections and it seems like it boils down to the following, in which case the spdx media type would qualify as a type where the charset information is transported inside the payload. In this case, do I just leave the Required/Optional parameter fields with N/A?

====
In order to improve interoperability with deployed agents, "text/*"
   media type registrations SHOULD either
 
   a.  specify that the "charset" parameter is not used for the defined
       subtype, because the charset information is transported inside
       the payload (such as in "text/xml"), or
 
   b.  require explicit unconditional inclusion of the "charset"
       parameter, eliminating the need for a default value.
 
   In accordance with option (a) above, registrations for "text/*" media
   types that can transport charset information inside the corresponding
   payloads (such as "text/html" and "text/xml") SHOULD NOT specify the
   use of a "charset" parameter, nor any default value, in order to
   avoid conflicting interpretations should the "charset" parameter
   value and the value specified in the payload disagree.
====

Thanks,
Rose

    

On 4/4/20, 11:56 AM, "Henrik Andersson" <[e-mail]> wrote:

    Rose Judge wrote:
    >
    > Hello,
    >
    >  
    >
    > Please see below for application of proposed new media type:
    >
    >  
    >
    >  
    >
    > Name: Rose Judge
    >
    > Email: [e-mail] <mailto:[e-mail]>
    >
    >  
    >
    > Media type name: text
    >
    > Media subtype name: spdx
    >
    >  
    >
    > Required parameters:
    >
    > Based on 2.2 spec the following fields and tags are mandatory in the
    > specification document. 
    >
    >  
    >
    > Document Creation Information Tags:
    >
    > SPDXVersion, DataLicense, SPDXID, DocumentName, DocumentNamespace,
    > Creator, Created
    >
    >  
    >
    > Package Information Tags:
    >
    > PackageName, SPDXID, PackageDownloadLocation, FileName,
    > PackageVerificationCode**, PackageLicenseConcluded,
    > PackageLicenseInfoFromFiles**, PackageLicenseDeclared,
    > PackageCopyrightText, 
    >
    >  
    >
    > File Information Tags:
    >
    > FileName, SPDXID, FileChecksum, LicenseConcluded, LicenseInfoInFile,
    > FileCopyrightText, 
    >
    >  
    >
    > Snippet Information Tags:
    >
    > SPDXRef, DocumentRef, SnippetByteRange, SnippetLicenseConcluded,
    > SnippetCopyrightText, 
    >
    >  
    >
    > Annotation Information Tags:
    >
    > Annotator
    >
    >  
    >
    >  
    >
    > ** Mandatory, one or many if FilesAnalyzed is true or omitted, zero
    > (must be omitted) if FilesAnalyzed is false.
    >
    >  
    >
    >  
    >
    > Optional parameters:
    >
    > Based on 2.2 spec the following fields and tags are optional in the
    > specification document. 
    >
    >  
    >
    > Optional Document Creation Information Tags:
    >
    > ExternalDocumentRef, LicenseListVersion, CreatorComment, DocumentComment
    >
    >  
    >
    > Optional Package Information Tags:
    >
    > PackageVersion, PackageFileName, PackageSupplier, PackageOriginator,
    > FilesAnalyzed, PackageChecksum, PackageHomePage, PackageSourceInfo,
    > PackageLicenseComments, PackageSummary, PackageDescription,
    > PackageComment, ExternalRef, ExternalRefComment (conditional for each
    > ExternalRef)
    >
    >  
    >
    > Optional File Information Tags:
    >
    > FileType, LicenseComments, ArtifactOfProjectName,
    > ArtifactOfProjectHomePage, ArtifactOfProjectURI, FileComment,
    > FileNotice, FileContributor
    >
    >  
    >
    > Optional Snippet Information Tags:
    >
    > SnippetLineRange, LicenseInfoInSnippet, SnippetLicenseComments,
    > SnippetComment, SnippetName
    >
    >  
    >
    > Optional Other Licensing Information Detected Tags:
    >
    > LicenseComment, LicenseID [Conditional (mandatory, one) if license is
    > not on SPDX License List], ExtractedText [Conditional (Mandatory, one)
    > if there is a License Identifier assigned.], LicenseName [Conditional
    > (mandatory, one) if license is not on SPDX License List.],
    > LicenseCrossReference [Conditional (optional, one or more) if license
    > is not on SPDX License List.]
    >
    >  
    >
    > Optional Relationships between SPDX Elements:
    >
    > Relationship, RelationshipComment
    >
    >  
    >
    > Optional Annotation Information Tags:
    >
    > Annotator [Conditional (Mandatory, one), if there is an Annotation],
    > AnnotationDate [Conditional (Mandatory, one), if there is an
    > Annotation], AnnotationType [Conditional (Mandatory, one), if there is
    > an Annotation], SPDXREF [Conditional (Mandatory, one), if there is an
    > Annotation], AnnotationComment [Conditional (Mandatory, one), if there
    > is an Annotation]
    >
    >  
    >
    >  
    >
    > Encoding considerations: 8bit
    >
    > The spdx media type must support UTF-8 encoding.
    >
    >  
    >
    > Security considerations:
    >
    > The ExternalRef tag provides linkage to the NVD via CPE. Data can be
    > stored in spdx files that may contain printf-style format characters
    > that could cause a program to display unintended information.
    >
    >  
    >
    > Interoperability considerations:
    >
    > The spdx media type can be distributed free of external systems or
    > processors and is represented in a human-readable format. There are
    > also internet text-processing applications that may consume these
    > documents.
    >
    >  
    >
    > Published specification:
    >
    > Current versions of the specification is available at
    > https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fspdx.github.io%2Fspdx-spec%2F&amp;data=02%7C01%7Crjudge%40vmware.com%7C3c336ac81f574bb2b6d908d7d8c9b4f0%7Cb39138ca3cee4b4aa4d6cd83d9dd62f0%7C0%7C1%7C637216234078280507&amp;sdata=B%2FuxJfOBdG3P4ieFp0gJP9wUqRr8wHGbTwjDSPF0rIM%3D&amp;reserved=0. Historical versions can be found at
    > https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fspdx.org%2Fspecifications&amp;data=02%7C01%7Crjudge%40vmware.com%7C3c336ac81f574bb2b6d908d7d8c9b4f0%7Cb39138ca3cee4b4aa4d6cd83d9dd62f0%7C0%7C1%7C637216234078280507&amp;sdata=lD4LehotNAl1%2Bz7WgeYPMhTF6oogjhKADkRgz3WMTbM%3D&amp;reserved=0.
    >
    >  
    >
    > Applications which use this media:
    >
    > Exchange of Metadata for software.
    >
    >  
    >
    > Fragment identifier considerations:
    >
    > N/A
    >
    >  
    >
    > Restrictions on usage:
    >
    > spdx media types should only be associated with validated SPDX
    > documents that follow the SPDX specification.
    >
    >  
    >
    > Provisional registration? (standards tree only):
    >
    > N/A
    >
    >  
    >
    > Additional information:
    >
    >  
    >
    > 1. Deprecated alias names for this type: N/A
    >
    > 2. Magic number(s): N/A
    >
    > 3. File extension(s): .spdx
    >
    > 4. Macintosh file type code: N/A
    >
    > 5. Object Identifiers: N/A
    >
    >  
    >
    > General Comments:
    >
    > Software Package Data Exchange® (SPDX®) is an open standard for
    > communicating software bill of material information (including
    > components, licenses, copyrights, and security references).
    >
    >  
    >
    > Person to contact for further information:
    >
    >  
    >
    > 1. Name: Rose Judge
    >
    > 2. Email: [e-mail] <mailto:[e-mail]>
    >
    >  
    >
    > Intended usage: Common
    >
    > Intended to be used to enable companies and organizations to share
    > human-readable and machine-processable software package metadata to
    > facilitate software supply chain processes. An SPDX media type will be
    > associated with a particular software package or set of packages and
    > will contain information about it in the SPDX format.
    >
    >  
    >
    > Author/Change controller: [e-mail]
    > <mailto:[e-mail]>
    >
    >  
    >
    >  
    >
    >  
    >
    >
    >
    > _______________________________________________
    > media-types mailing list
    > [e-mail]
    > https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.ietf.org%2Fmailman%2Flistinfo%2Fmedia-types&amp;data=02%7C01%7Crjudge%40vmware.com%7C3c336ac81f574bb2b6d908d7d8c9b4f0%7Cb39138ca3cee4b4aa4d6cd83d9dd62f0%7C0%7C1%7C637216234078280507&amp;sdata=uvKAjG1rc%2Bz%2F2xlcDug2WXHPUemrBGRdIy6GVMxyh7w%3D&amp;reserved=0
    
    You seem to have misunderstood the purpose of required and optional
    parameters. They are not about the contents of the file. They are
    parameters attached to the media type designation as the file is
    transferred, stored and processed.