annexes: getting started: Fix SPDX IDs

[JPEWdev]

The SPDX IDs used in the example are fabricated, but not good examples to follow for users trying understand how to write their own documents. Fix this by using the "https://spdx.org/spdxdocs/" prefix and using a UUID at the end

[goneall]

LGTM

BTW if / when we support the namespacing of SPDX ID's we may be able to make these a bit more readable by having the GUID in a common prefix.

[zvr]

In JSON level they are just strings.

Instead of

            "spdxId": "https://spdx.org/spdxdocs/File-8f79956e-4089-4166-9a71-457de77e4846",

you can already easily write

            "spdxId": "mydata:File-8f79956e-4089-4166-9a71-457de77e4846",

by having a @context defining your mydata prefix.

Or am I missing something?

[zvr]

Re: the actual PR, I'd actually prefer if the IDs were not on spdx.org but on another domain. We don't want to give the impression that spdx.org/spdxdocs is something special and should always be used...

[JPEWdev]

On Thu, May 23, 2024 at 5:06 AM Alexios Zavras (zvr) < ***@***.***> wrote: In JSON level they are just strings. Instead of "spdxId": "https://spdx.org/spdxdocs/File-8f79956e-4089-4166-9a71-457de77e4846", you can already easily write "spdxId": "mydata:File-8f79956e-4089-4166-9a71-457de77e4846", by having a @context defining your mydata prefix. Or am I missing something?

That is not implemented in the JSON schema or code bindings yet, so we can't use it.

…

— Reply to this email directly, view it on GitHub <#964 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ABRHTFDPCHKRQXEQAVXLHATZDXEU5AVCNFSM6AAAAABICG55L2VHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDCMRWHAZTKMRVGY> . You are receiving this because you authored the thread.Message ID: ***@***.***>

[JPEWdev]

On Thu, May 23, 2024 at 5:09 AM Alexios Zavras (zvr) ***@***.***> wrote: Re: the actual PR, I'd actually prefer if the IDs were not on spdx.org but on another domain. We don't want to give the impression that spdx.org/spdxdocs is something special and should always be used...

I used that because it is explicitly called out in SPDX 2.3 that you can use that prefix for a document namespace when don't own a domain (https://spdx.github.io/spdx-spec/v2.3/document-creation-information/#652-intent) If we don't use this same prefix, SPDX 3.0 should recommend a similar one to use in the same circumstances.

…

— Reply to this email directly, view it on GitHub, or unsubscribe. You are receiving this because you authored the thread.Message ID: ***@***.***>