spdx/spdx-3-model

Require fixed specVersion

Closed this issue · 3 comments

ilans commented

The Lite profile requires specVersion to be a fixed string, "3.0.1".

But I remember Gary saying that all CreationInfo instances in an SPDX document must share the same specVersion, not just in relation to the Lite profile.

I don't see this indicated anywhere.

goneall commented

The Lite profile requires specVersion to be a fixed string, "3.0.1".

But I remember Gary saying that all CreationInfo instances in an SPDX document must share the same specVersion, not just in relation to the Lite profile.

I don't see this indicated anywhere.

I may have miss-spoke about CreationInfo in SPDX documents - they can have different versions if they were copied from a different source.

My only concern with the Lite profile is we'll have to update the fixed string on every release.

Perhaps this is something we can fix in the 3.1 release.

goneall commented

@yoshi-i - Any thoughts on the fixed version?

goneall commented

@ilans - I just looked at the lite profile page and I didn't see a reference to the spec-version.

Can you point me to where this is specified?