Skip to content

Commit

Permalink
Merge pull request #1047 from zvr/fix-conformance
Browse files Browse the repository at this point in the history
Fixes in Conformance chapter
  • Loading branch information
goneall authored Aug 11, 2024
2 parents 9dc48a3 + 1f89ebe commit 952a432
Showing 1 changed file with 41 additions and 68 deletions.
109 changes: 41 additions & 68 deletions docs/conformance.md
Original file line number Diff line number Diff line change
Expand Up @@ -3,13 +3,15 @@
## Alternate notation for some conformance requirements <a name="5.1"></a>

This standard contains more than a few cardinality assertions, each of which
indicates absolute, optional, or conditional requirements.
indicates the minimum and maximum number of times a property may appear.
These are represented by using "minCount" and "maxCount" respectively.
The absolute minimum number of occurrences is zero (0),
while for an unbounded maximum number of occurrences a star (\*) is being used.

Here are some examples:

- Cardinality: Mandatory, one.
- Cardinality: Optional, one or many.
- Cardinality: Mandatory, one if {condition} is true or {feature} omitted, zero
(shall be omitted) if {condition} is false.
- minCount: 1
- maxCount: *
- Cardinality: 0..1
- Cardinality: 0..*
- Cardinality: 1..1
Expand All @@ -26,16 +28,16 @@ Profile is the term for a compliance point within the SPDX community across The
Linux Foundation and OMG. The System Package Data Exchange (SPDX) specification
defines the following six compliance points, defined as “Profiles”:

- Core and Software Profiles (Clauses 6 & 7)
- Security Profile (Clause 8)
- Licencing Profile (Clause 9)
- Dataset Profile (Clause 10)
- AI Profile (Clause 11)
- Build Profile (Clause 12)
- Lite Profile (Clause 13)
- Extension Profile (Clause 14)
- Core and Software Profiles
- Security Profile
- Licencing Profile
- Dataset Profile
- AI Profile
- Build Profile
- Lite Profile
- Extension Profile

The Core and Software Profiles are mandatory. All others are optional.
The Core Profile is mandatory. All others are optional.

## Core Profile compliance point <a name="5.3"></a>

Expand Down Expand Up @@ -106,6 +108,11 @@ serialization formats, including the classes and fields that comprise the SPDX
License Expression syntax and that relate to the
[SPDX License List](https://spdx.org/licenses/).

There are two associated profiles, the SimpleLicensing Profile
and the ExpandedLicensing profiles.
Both allow expression of the same information,
albeit in different ways.

Conformance to the Licencing Profile compliance point does not entail support
for the Software, Security, Dataset, AI, Build, Lite, or Extension profiles of
the SPDX.
Expand Down Expand Up @@ -243,57 +250,23 @@ beyond the standard SPDX produced by tools supporting SPDX and is used between
cooperating parties that understand the form of the extension and can produce
and consume its non-standard content.

## Standard data format requirements <a name="5.12"></a>

The data format specification and recommendations are subject to the
following constraints:

- Shall be in a human readable form.
- Shall be in a syntax that a software tool can read and write.
- Shall be suitable to be checked for syntactic correctness automatically,
independent of how it was generated (human or tool).
- The SPDX document character set shall support UTF-8 encoding.
- Multiple serialization formats may be used to represent the information being
exchanged. Current supported formats include:

- *YAML 1.2*
see:
[YAML Ain’t Markup Language (YAML™) version 1.2](https://yaml.org/spec/1.2/)
- *JavaScript Object Notation* (JSON)
see:
[ECMA-404](https://ecma-international.org/publications-and-standards/standards/ecma-404/)
- The JSON Schema for SPDX can be found in the
[SPDX specification GitHub pages](https://spdx.github.io/spdx-spec/v3.0.1/rdf/schema.json)
- **Resource Description Framework** (RDF, also referred to as RDF/XML)
see:
[RDF 1.1 XML Syntax](https://www.w3.org/TR/rdf-syntax-grammar/)
- *tag:value* flat text file as described in this specification
- *.xls* spreadsheets

- In addition to the supported formats, the following format is in development
with a plan to complete the specification in the next release:

- *Extensible Markup Language* (XML)
see:
[Extensible Markup Language (XML) 1.0 (Fifth Edition)](https://www.w3.org/TR/2008/REC-xml-20081126/)

- Interoperability between all the supported file formats shall be preserved.
SPDX defines how to validate a document in each supported format, and how to
translate a valid document without loss to each other supported format.

- Tags and format properties are case sensitive.

- Should be easy to recognize in a file system without opening the file.
A suggested naming convention is:

| Format | Extension |
| ----------- | ------------ |
| tag:value | \*.spdx |
| RDF | \*.spdx.rdf |
| JSON | \*.spdx.json |
| XML | \*.spdx.xml |
| YAML | \*.spdx.yaml or \*.spdx.yml |

- The convention in this specification is for the RDF examples to use
`rdf:about="..."` to represent that a proper Uniform Resource Indicator (URI)
should be present.
## Trademark Compliance

To be designated an SPDX document, a file shall comply with the requirements of the SPDX Trademark
License, as stated in the [the SPDX Trademark Page](https://spdx.dev/trademark).

The official copyright notice that shall be used with any verbatim reproduction and/or distribution of
this SPDX Specification 3.0.1 is:

"Official SPDX® Specification 3.0.1 Copyright © 2010--2024 Linux Foundation and its Contributors.
Licensed under the Community Specification License 1.0. All other rights are expressly reserved."

The official copyright notice that shall be used with any non-verbatim reproduction and/or distribution
of this SPDX Specification 3.0.1, including without limitation any partial use or combining this SPDX
Specification with another work, is:

"This is not an official SPDX Specification. Portions herein have been reproduced from SPDX®
Specification 3.0.1 found at spdx.dev. These portions are Copyright © 2010--2024 Linux Foundation and
its Contributors, and are licensed under the Community Specification License 1.0 by the
Linux Foundation and its Contributors. All other rights are expressly reserved by Linux Foundation and
its Contributors."

0 comments on commit 952a432

Please sign in to comment.