Comments (4)
verifiedUsing
is also part of ExternalMap
, and there it does not (necessarily) apply to a sequence of bytes?
from spdx-3-model.
- "verifiedUsing" always applies to content (sequence of bytes), never to metadata (element properties)
This is true today, but subject to the proposal from the canonicalization subgroup.
- only Artifact element types have content. (Annotation, Relationship, Collection, Actor, and Identity do not.)
This is not necessarily true, for example, if we were to add a PublicKey subclass of IntegrityMethod then the content of an Annotation could be digitally signed and the PublicKey used to verify it. Future subclasses of Element in other profiles may have content that can be verified. We didn't want to restrict this capability to only Artifacts.
- gitoid is a hash algorithm and can be added to verifiedUsing algorithm list (hashes can be used as content unique ids, but not as artifact ids)
Yes, I believe that's true. Can you check with Jeff and if he agrees, propose what the enum value should be?
- multiple artifacts that have the identical content / hash can be linked using a COPY relationship
Correct. The addition of thecontentIdentifier
as discussed last Friday will also help identify identical content even in the absence of a relationship.
- verifiedUsing is not a content unique identifier because different signatures apply to the same content. But it does apply only to content (including hardware), not to metadata.
Correct.
@maxhbr in today's implementation the verifiedUsing
in ExternalMap
would be a sequence of bytes, however, when canonicalization is in place it may be a canonical hash instead.
from spdx-3-model.
If I understand @iamwillbar's comment correctly, verifiedUsing
will not be moved to Artifact, so this issue can be closed, right?
The only remaining todo I can glean from this discussion is whether gitoid should be a supported HashsumAlgorithm. Is this still under consideration?
from spdx-3-model.
Agree with @armintaenzertng , and closing this issue for now. If there are still open discussions points, please open a new issue more focused.
from spdx-3-model.
Related Issues (20)
- In page https://spdx.github.io/spdx-spec/v3.0/model/Licensing/Licensing/ the lists are not displayed correctly. HOT 3
- Doc: Possible outdated references to gh-pages and auto-generated in README.md HOT 2
- Delete gh-pages for the spdx-3-model
- License list version is still not SemVer HOT 5
- Does the specVersion include a PATCH version?
- ProfileIdentifierType list HOT 1
- What does "IRI ``" mean? HOT 6
- Have Markdown lint runs after commit HOT 1
- 3.1: Dataset: Add a "language" field
- rootElement: SBOM or BOM? HOT 1
- Where are the SPDX Matching Guidelines? HOT 8
- Where is the "Legacy Text Template format section"? HOT 3
- Vocabulary entries should be single-line
- AI: Not clear what 'energyQuantity' means HOT 5
- AI: 'energyConsumption', 'finetuningEnergyConsumption', 'inferenceEnergyConsumption' would vary so is it correct to record them? HOT 1
- AI: hyperparameter, metric, metricDecisionThreshold - can be multiple. Property talks about only one. HOT 11
- AI: 'modelExplainability' summary and description should be modified HOT 4
- AI: 'trainingEnergyConsumption' is duplicate of 'energyConsumption' HOT 1
- AI: Need comprehensive strategy for addressing security related parameters for AI systems HOT 1
- Core: Need class 'Dictionary' for listing multiple key-value pairs HOT 8
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from spdx-3-model.