Hi All, Here's the language we discussed yesterday for referencing element in one SPDX document from another:
Producers of SPDX data are expected to 'own' a namespace for their organization. (e.g. 'http://acme.com/spdx') When releasing an SPDX document for external consumption, its basename must be unique within the namespace of the producing organization. (e.g. http://acme.com/spdx/mypackage-1-2.spdx where the organization will not publish another file with basename 'mypackage-1-2.spdx' ) [Note: if the organization subsequently releases an update to their SPDX analysis for same package, the updated document must carry a new, unique basename, e.g. 'mypackage-1-2-rev1.spdx'] [Note: best practice is to use the .spdx suffix on all SPDX documents, regardless of tag-value or RDF format] Additionally, an accompanying file with the SHA-1 hash of the file should sit alongside it, named the same, plus the extension .sha1 (e.g. 'http://acme.com/spdx/mypackage-1-2.spdx.sha1' The contents of the .sha1 file is a single line with the sha1 of the published .spdx file.) Within the SPDX document, each SPDXElement (including subclasses) shall be assigned a unique id (unique within the scope of the document.) [Note: for tag-value format, this means populating the field SPDXRef-[idString] with a unique identifier for each element. In RDF format, the unique id is the resource URI identifier.]
_______________________________________________ Spdx-tech mailing list [email protected] https://lists.spdx.org/mailman/listinfo/spdx-tech
