[media-types] Re: [IANA #1450117] application/spdx3+js on registration request

Hi Amanda,

This is mostly fine, but some questions/nits below:

On 15/04/2026 01:50, Amanda Baber via RT wrote:
> Hi Alexey,
>
> Would it be possible to review this request from the Linux Foundation by April 28th? It looks like you reviewed application/spdx+json and text/spdx 4-6 years ago.
>
> The submitter added the following notes:
>
> ===
>
> This is similar to the two existing SPDX media types
> and aligned with SPDX principles to be vendor-neutral.
>
> Btw, we are aware of the possibility of using a "version" parameter to
> extend the existing "application/spdx+json" to accommodate multiple
> SPDX versions.
>
> At the same time, we see quite a big differences between the JSON
> formats of SPDX 3 and prior SPDX versions.
Ok. It looks like SPDX 3 and SPDX 2 are not compatible (i.e. they use 
different data models), so in this case a different media type is fine.
> We are also aware of the implications of putting a version number
> inside the media type string itself (spdx3+json) and question if this
> means we will have to register another media type in the future when
> SPDX version 4 is released.

It would depend on whether or not SPDX 4 is backward compatible with 
SPDX 3. If it is, then application/spdx3+json can be used for SPDX 4. If 
not, then a new media type might be needed.

The "Interoperability Considerations" section is specifically designed 
for discussing interoperability issues.

> If IANA can further share its best practices and advice with us, it
> would be greatly appreciated.
>
> We track the application/spdx3+json media type registration here:
> https://github.com/spdx/spdx-spec/issues/1359
>
> Thank you again for your help, we are much appreciated.
>
> ===
>
> thanks,
> Amanda
>
> =====
>
> Name: Arthit Suriyawongkul
>
> Email: [email protected]
>
> Media type name: application
>
> Media subtype name: spdx3+json
>
> Required parameters: N/A
>
> Optional parameters: version
>
> The version parameter refers to the SPDX specification version
> in use.
>
> version = 1*DIGIT "." 1*DIGIT ["." 1*DIGIT]
It is unclear to me why version is needed, unless there is a desire to 
possibly reuse the same media type for SPDX 3, 4, 5, etc.
> Encoding considerations: binary
>
> This media type has all of the same encoding considerations of
> application/json as described in [RFC8259] Section 8.1.
>
> Security considerations: The format supports the ExternalRef and ExternalIdentifier classes,
> which provide links to external databases such as the National
> Vulnerability Database (NVD) and various security advisories.
> Users should be aware that following these links involves interacting
> with external systems.
>
> SPDX 3 documents do not allow embedding executable content.
>
> Additionally, this media inherits the interoperability security
> considerations of application/json as described in [RFC8259] Section 12.
>
> Interoperability considerations: The application/spdx3+json media type
> can be distributed free of external systems or processors.
> Internet text-processing applications will likely consume these
> documents.
Here I would add a sentence that this media type is not compatible with 
SPDX 2, which uses a different media type.
> The application/spdx3+json media type is a strict subset of
> JSON-LD 1.1 (https://www.w3.org/TR/json-ld11/).
>
> Additionally, this media type inherits the interoperability
> considerations of application/json as described in [RFC8259].
>
> Published specification: Current versions of the specification are
> available at https://spdx.github.io/spdx-spec/. Historical
> versions can be found at https://spdx.org/specifications.
If historical version can't use this media type, it is better to delete 
the last sentence?
> The current SPDX 3 JSON schema version is available at
> https://spdx.org/schema/3.0/spdx-json-schema.json.
>
> The current SPDX 3 JSON serialization details is available
> at https://spdx.github.io/spdx-spec/v3.0/serializations/.
>
> Applications which use this media: This media is intended to
> represent a bill of materials (BOM), including but not
> limited to a software bill of materials (SBOM),
> and will be used by tools that produce or consume BOMs
> as part of their supply chain.
>
> Fragment identifier considerations: N/A
>
> Restrictions on usage: N/A
>
> Provisional registration? (standards tree only): No
>
> Additional information:
>
> 1. Deprecated alias names for this type: N/A
> 2. Magic number(s): N/A
> 3. File extension(s): .spdx3.json
> 4. Macintosh file type code: N/A
> 5. Object Identifiers: N/A
>
> Person to contact for further information:
>
> 1. Name: Arthit Suriyawongkul
> 2. Email: [email protected]
>
> Intended usage: COMMON
>
> SPDX is an open standard. It is intended to be used to enable
> companies and organizations to share human-readable and
> machine-processable software package metadata to facilitate secure
> and compliant software supply chain processes. An SPDX 3 JSON media
> type will be associated with a particular software package or set
> of packages and will contain information about it in the SPDX 3
> JSON format.
>
> Author/Change controller: Kate Stewart <[email protected]> - The Linux Foundation

I just want to double check that Kate Stewart is the right person to be 
mentioned here.

She is not the author, she is the change controller, right?


Best Regards,

Alexey


_______________________________________________
media-types mailing list -- [email protected]
To unsubscribe send an email to [email protected]