There's a couple of reasons why this is helpful: 1. Since the path is relative to the root of the package a relative path in an image is equivalent to an absolute path. 2. We don't want paths to refer to things outside of the package (particularly for package managers that don't have as strict of a boundary as images do), e.g. no "/home/william/my-secret-stuff". 3. If you have the same set of files embedded in multiple packages you can reuse the file elements, this is useful for example if you want to represent a directory of files within an archive and then to represent that same directory of files when it's extracted to a different location.
Makes sense re: RFC-3986, thanks for calling that out (I had it in my mind that this was a plain string, not a URI). William ________________________________ From: [email protected] <[email protected]> on behalf of Keith Zantow via lists.spdx.org <[email protected]> Sent: Tuesday, September 5, 2023 8:56 AM To: spdx-tech <[email protected]> Subject: [EXTERNAL] Re: [spdx-tech] Question about FileName syntaxe You don't often get email from [email protected]. Learn why this is important<https://aka.ms/LearnAboutSenderIdentification> I'm curious what the motivation is for paths being relative. If I scan an image, for example, I would expect to see absolute paths to the files within the image filesystem, rather than those being translated to relative paths. Cheers, -Keith On Tue, Sep 5, 2023 at 11:48 AM Vargenau, Marc-Etienne (Nokia - FR/Paris-Saclay) <[email protected]<mailto:[email protected]>> wrote: Hi William, I think https://www.ietf.org/rfc/rfc3986.txt only allows “/”, not “\”. Marc-Etienne -- Marc-Etienne Vargenau [email protected]<mailto:[email protected]> Nokia, 12, rue Jean-Bart, 91300 Massy, FRANCE Mobile: +33 6 24 49 78 68<tel:+33624497868> Senior Specialist Open Source Planned absence: none De : William Bartholomew (CELA) <[email protected]<mailto:[email protected]>> Date : mardi, 5 septembre 2023 à 17:43 À : Marc-Etienne Vargenau (Nokia) <[email protected]<mailto:[email protected]>>, 'spdx-tech' <[email protected]<mailto:[email protected]>>, Richard Brooks <[email protected]<mailto:[email protected]>> Objet : Re: [EXTERNAL] Re: [spdx-tech] Question about FileName syntaxe I would recommend against requiring the "./" prefix, but still require that the path be relative (and clarifying that is relative to the location of the package that the file is contained in). We may also want to clarify whether you can use Windows-style path separators ("\") or only Linux-style ones ("/"), and we should say that a relative path can't backtrack (i.e. no ".."). William ________________________________ From: [email protected]<mailto:[email protected]> <[email protected]<mailto:[email protected]>> on behalf of Dick Brooks via lists.spdx.org<http://lists.spdx.org/> <[email protected]<mailto:[email protected]>> Sent: Tuesday, September 5, 2023 4:12 AM To: 'Vargenau, Marc-Etienne (Nokia - FR/Paris-Saclay)' <[email protected]<mailto:[email protected]>>; 'spdx-tech' <[email protected]<mailto:[email protected]>> Subject: [EXTERNAL] Re: [spdx-tech] Question about FileName syntaxe Many of the implementations that participated in the DocFest did not include the “relative path” (/) syntax. The online validation tool will pass an SBOM that does not contain the relative path filename syntax. Thanks, Dick Brooks [cid:[email protected]] [cid:[email protected]] Active Member of the CISA Critical Manufacturing Sector, Sector Coordinating Council – A Public-Private Partnership Never trust software, always verify and report!<https://reliableenergyanalytics.com/products> ™ http://www.reliableenergyanalytics.com<http://www.reliableenergyanalytics.com/> Email: [email protected]<mailto:[email protected]> Tel: +1 978-696-1788 From: [email protected]<mailto:[email protected]> <[email protected]<mailto:[email protected]>> On Behalf Of Vargenau, Marc-Etienne (Nokia - FR/Paris-Saclay) Sent: Tuesday, September 5, 2023 6:44 AM To: spdx-tech <[email protected]<mailto:[email protected]>> Subject: [spdx-tech] Question about FileName syntaxe Hello, This is related to https://github.com/spdx/Spdx-Java-Library/issues/195 FileName is defined in the spec as “a relative filename”. So, we should reject as invalid a FileName starting with “/”. The spec then says “In general, every filename is preceded with a ./” Is this mandatory? In other words, should we reject: FileName: package/foo.c What is your opinion? Best regards, Marc-Etienne Vargenau -- Marc-Etienne Vargenau [email protected]<mailto:[email protected]> Nokia, 12, rue Jean-Bart, 91300 Massy, FRANCE Mobile: +33 6 24 49 78 68<tel:+33624497868> Senior Specialist Open Source Planned absence: none -=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#5336): https://lists.spdx.org/g/Spdx-tech/message/5336 Mute This Topic: https://lists.spdx.org/mt/101166533/21656 Group Owner: [email protected] Unsubscribe: https://lists.spdx.org/g/Spdx-tech/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
