Add SPDX 3 Predicate#508
Conversation
bd1a907 to
07f0c7d
Compare
Adds a new predicate for SPDX version 3, and updates the SPDX 2 predicate to distinguish it. Signed-off-by: Joshua Watt <JPEWhacker@gmail.com>
07f0c7d to
3ce6a28
Compare
|
Per feedback from the SPDX community, they would prefer SPDX 3 to be a separate predicate |
| # Predicate type: SPDX | ||
|
|
||
| Type URI: https://spdx.dev/Document | ||
| Type URI: https://spdx.dev/Document/v2.3 |
There was a problem hiding this comment.
This is interesting, the current spec document states that the typeURI is just https://spdx.dev/Document, but the examples uses /v2.3. I'm wondering if this document should recognize both as they always were here, even when v2.3 does not conform with the major only versioning rule .
| Type URI: https://spdx.dev/Document/v2.3 | |
| Type URI: https://spdx.dev/Document | |
| Type URI: https://spdx.dev/Document/v2.3 |
There was a problem hiding this comment.
Ya, that annoyed me also :) It was unclear which one was correct. FWIW, I'd be fine with the proposed change
There was a problem hiding this comment.
OK, I approved the suggestion from the UI, but it b0rked the DCO check. I've pushed a commit to your branch manually to fix it. I hope you don't mind (feel free to squash them if you want).
I've slapped the approval pending on the final word from the other maintainers.
There was a problem hiding this comment.
OK, I approved the suggestion from the UI, but it b0rked the DCO check. I've pushed a commit to your branch manually to fix it. I hope you don't mind (feel free to squash them if you want).
I've slapped the approval pending on the final word from the other maintainers.
Doesn't bother me. Thanks!
This commit adds a small change to add the old https://spdx.dev/Document uri in addition to the 2.3 versioned variant. Signed-off-by: Adolfo García Veytia (Puerco) <puerco@carabiner.dev>
Per in-toto#547, in-toto#508 moved `spec/predicates/spdx.md` to `spdx2.md` (and later added `spdx3.md`), which broke every external link to the original file — including the one in the SLSA spec (slsa-framework/slsa#1577). Restore `spdx.md` as a stable redirect page that points at both version-specific specs and explains the move. This keeps long-lived external references working without requiring downstream specs to chase the rename. Closes in-toto#547
Updates the SPDX predicate to handle version 3.0