Hi all,
have you ever considered using JSON schema?
It has some nice features such as conditional dependencies, and you can
use also an if-then-else syntax, that could be useful to model
FilesAnalyzed etc.
See some examples here: https://stackoverflow.com/a/38781027
BTW, IANAE so please don't blast me if this suggestion does not make any
sense from a technical standpoint :)
Regards,
Alberto
Il 2020-12-07 17:24 Alexios Zavras ha scritto:
Hi all,
In tomorrow's SPDX Tech call, we said we would discuss how to "model" the SPDX information - especially looking towards the next version of the specification.
To save us all some time in introductory discussion, I wrote down some thoughts about the problem and solutions: https://docs.google.com/document/d/13PojpaFPdoKZ9Gyh_DEY-Rp7lldyMbSiGE3vCRQhR9M/edit?usp=sharing [1]
Please read, comment, and edit/update!
Looking forward to our call tomorrow to discuss all this.
I paste a current snapshot:
Modeling SPDX
What is the problem?
There are multiple sources for what is defined to be "SPDX". Right now, there are:
* The specification text
* The object model
* The reference Java code
* Code for Python and Go libraries
All of these are not always consistent...
What do we want?
The ideal outcome would be a "single source of truth". This could subsequently be used to automagically generate all the required versions.
What will be modeled?
Based on the current specification, examples of information that should be modeled may include:
* FileName is a field in the file information section
* FileName in Tag-Value is Property spdx:fileName in class spdx:File in RDF
* FileName value is a string
* FilesAnalyzed is a boolean value
* Created has format YYYY-MM-DDThh:mm:ssZ
* FileName is a mandatory field and can only appear once
* PackageVerificationCode has to appear once if FilesAnalyzed is true but must
not appear if FilesAnalyzed is false
* ExternalRef has format "category type locator" where category is one of
SECURITY, PACKAGE-MANAGER, PERSISTENT-ID, OTHER and type is one of ...
What are the alternatives?
We're looking for something to "model" SPDX.
Wikipedia: A data model is an abstract model that organizes elements of data and standardizes how they relate to one another and to the properties of real-world entities. Related but not equivalent concepts:information model, object model.
Unsurprisingly, there are lots of existing modeling frameworks already.
English text
Pure text or not. It should be noted that the current specification is a mix of English text, some structure (sections for Cardinality, Format, etc.), some computer-like notation (e.g. pseudo-grammar-like constructs), some example code, some tables, and probably some more…
OWL
The Web Ontology Language 2 (OWL) is a knowledge representation language for
authoring ontologies. Ontologies are a formal way to describe taxonomies and
classification networks, essentially defining the structure of knowledge for
various domains: the nouns representing classes of objects and the verbs
representing relations between the objects.
UML
Unified Modeling Language (UML) is a standardized general-purpose modeling language in the field of software engineering. It is a graphical language for visualizing, specifying, constructing, and documenting the artifacts of a software-intensive system. UML offers a mix of functional models, data models, and database models. UML has been approved as an ISO standard.
Class definition code
One can also start from actual computer code written in an object-oriented way, that implements classes and objects.
Pros and cons
In random order, for now:
* UML is widely used and is an ISO standard
* UML is a graphical language, so not ideal for git-based team collaboration
* UML diagrams can be generated by textual descriptions by PlantUML
* Computer code in any language (Python, Java, …) is not readable by everyone
* OWL is not so well known
* UML can be edited by Open Source tools
* OWL can be edited by Open Source tools
* OWL can express a superset of what UML can express
* Python is better known than UML or OWL
* English is understood by everyone
* English natural language text may not be rigorous enough
* OWL can combine information from different sources/definitions (e.g., URI
type)
-- zvr
Intel Deutschland GmbH
Registered Address: Am Campeon 10-12, 85579 Neubiberg, Germany
Tel: +49 89 99 8853-0, www.intel.de
Managing Directors: Christin Eisenschmid, Gary Kershaw
Chairperson of the Supervisory Board: Nicole Lau
Registered Office: Munich
Commercial Register: Amtsgericht Muenchen HRB 186928
Links:
------
[1]
https://docs.google.com/document/d/13PojpaFPdoKZ9Gyh_DEY-Rp7lldyMbSiGE3vCRQhR9M/edit?usp=sharing
[2] https://lists.spdx.org/g/Spdx-tech/message/3937
[3] https://lists.spdx.org/mt/78781735/1160266
[4] https://lists.spdx.org/g/Spdx-tech/post
[5] https://lists.spdx.org/g/Spdx-tech/editsub/1160266
[6] https://lists.spdx.org/g/Spdx-tech/unsub
-=-=-=-=-=-=-=-=-=-=-=-
Links: You receive all messages sent to this group.
View/Reply Online (#3941): https://lists.spdx.org/g/Spdx-tech/message/3941
Mute This Topic: https://lists.spdx.org/mt/78781735/21656
Group Owner: [email protected]
Unsubscribe: https://lists.spdx.org/g/Spdx-tech/unsub [[email protected]]
-=-=-=-=-=-=-=-=-=-=-=-
