Require fixed specVersion

[ilans]

The Lite profile requires specVersion to be a fixed string, "3.0.1".

But I remember Gary saying that all CreationInfo instances in an SPDX document must share the same specVersion, not just in relation to the Lite profile.

I don't see this indicated anywhere.

[goneall]

The Lite profile requires specVersion to be a fixed string, "3.0.1".

But I remember Gary saying that all CreationInfo instances in an SPDX document must share the same specVersion, not just in relation to the Lite profile.

I don't see this indicated anywhere.

I may have miss-spoke about CreationInfo in SPDX documents - they can have different versions if they were copied from a different source.

My only concern with the Lite profile is we'll have to update the fixed string on every release.

Perhaps this is something we can fix in the 3.1 release.

[goneall]

@yoshi-i - Any thoughts on the fixed version?

[goneall]

@ilans - I just looked at the lite profile page and I didn't see a reference to the spec-version.

Can you point me to where this is specified?

[ilans]

@goneall
It's in the annexes, here: https://spdx.github.io/spdx-spec/v3.0.1/annexes/spdx-lite/#corecreationinfo

[goneall]

@goneall It's in the annexes, here: https://spdx.github.io/spdx-spec/v3.0.1/annexes/spdx-lite/#corecreationinfo

Thanks @ilans - It looks like any patch version will work for now. For 3.1, we'll need to update the spec.

@yoshi-i - should we change the lite spec to allow 3.. since they should all be forward compatible?

[ilans]

@goneall I'm not sure I understand the purpose of this property. The version is part of the SPDX URL for all classes, properties and constraints. So:

• What extra information are we preserving that's not already there? Should it be allowed to set this property to a different version?
• Can two elements from different versions be linked together without breaking target class constraints?

If we want to allow linking between elements in the same minor version, we could use sh:pattern on the class URL:

@prefix rdf: <http://www.w3.org/1999/02/22-rdf-syntax-ns#> .
@prefix owl: <http://www.w3.org/2002/07/owl#> .
@prefix sh: <http://www.w3.org/ns/shacl#> .
@prefix spdx310: <https://spdx.org/rdf/3.1.0/terms/> .
@prefix spdx311: <https://spdx.org/rdf/3.1.1/terms/> .
@prefix ex: <http://example.org/1/> .

### ontology ###
spdx310:A a owl:Class .
spdx310:B a owl:Class .
spdx311:B a owl:Class .
spdx310:hasB a owl:ObjectProperty .

### shape ###
ex:S a sh:NodeShape ;
    sh:targetClass spdx310:A ;
    sh:property [
        sh:path spdx310:hasB ;
        ### instead of sh:class, we use sh:pattern on the target node ###
        sh:qualifiedValueShape [
            sh:path rdf:type ;
            sh:pattern "^https://spdx.org/rdf/3.1.\\\\d/terms/B$" ;
        ] ;
        sh:qualifiedMinCount 1 ;
    ] .

### test ###
ex:b1 a spdx310:B .
ex:b2 a spdx311:B .
ex:a-b1 a spdx310:A ;
    spdx310:hasB ex:b1 .
ex:a-b2 a spdx310:A ;
    spdx310:hasB ex:b2 .

[goneall]

@ilans - This is a constraint introduced by the lite profile team led from Japan.

@yoshi-i could provide more context to the constraint.

We have monthly meetings with Japan, our next meeting is this upcoming Monday if you're able to join - I just sent an invite.

[ilans]

@goneall My comments regarding spdxVersion aren't specific to the lite profile.
Thanks for sending the invite. It'll be 2am my time, so I can't commit. If I'm awake (usually am), I'll join.