Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Allow for undefined or "Other" package verification codes #595

Open
goneall opened this issue Jan 10, 2024 · 2 comments
Open

Allow for undefined or "Other" package verification codes #595

goneall opened this issue Jan 10, 2024 · 2 comments
Milestone

Comments

@goneall
Copy link
Member

goneall commented Jan 10, 2024

On the Security call on 10 Jan 2023 it was suggested that we allow for any definition of verification algorithms and codes for packages - similar to have "Other" in some of our enumeration values.

Since this involves more modeling work that I have time for before RC2, I'm logging this as an issue for future work.

@goneall goneall added this to the 3.0 milestone Jan 10, 2024
@goneall
Copy link
Member Author

goneall commented Jan 10, 2024

If PR #498 is merged, we could create a additional subclass of PackageVerification similar to:

SPDX-License-Identifier: Community-Spec-1.0

# PackageOtherVerification

## Summary

Verification method to be used for a Package which is not one of the existing SPDX defined Package Verification Classes.

## Description

There may be use cases requiring package verification methods beyond what is defined in the SPDX specification.
This class can be used to capture the information on that verification method.

## Metadata

- name: PackageOtherVerification
- SubclassOf: /Software/PackageVerification

## Properties

- definition
  - type: xsd:anyUri
- data
  - type: xsd:string
- mediaType
  - type: xsd:string

@goneall
Copy link
Member Author

goneall commented Apr 3, 2024

Since this is a non-breaking change, I'm moving this to 3.1

@goneall goneall modified the milestones: 3.0, 3.1 Apr 3, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

1 participant