Repository navigation
Conversation
- Remove redundant canonicalization rules - Explicit key ordering by referring to JCS (UTF-16 code units as sort key) Signed-off-by: Arthit Suriyawongkul <arthit@gmail.com>
Collaborator
Author
|
@@henrylyons please kindly review. |
Signed-off-by: Arthit Suriyawongkul <arthit@gmail.com>
goneall
approved these changes
Sep 25, 2026
Member
|
I want to check whether this proposed canonical serialization is consistent with the one we already have, or whether we are introducing a breaking change. Does anyone know? I have not yet run tests for a variety of SPDX data. If it's equivalent, of course we should refer to it, rather than try to define it ourselves. |
zvr
requested changes
Sep 28, 2026
Comment on lines
+86
to
+88
| Any serialization format applied to this specification | ||
| shall enforce strict normalization rules for data ordering, formatting, | ||
| and encoding to guarantee a consistent output. |
Member
There was a problem hiding this comment.
No, why? Do you expect "string normalization" for any serialization?
| shall enforce strict normalization rules for data ordering, formatting, | ||
| and encoding to guarantee a consistent output. | ||
|
|
||
| For the JSON format, the canonical serialization shall conform to |
Member
There was a problem hiding this comment.
No, it's not "for the JSON format". It's the canonical serialization of SPDX data.
Comment on lines
+99
to
+120
| ### Key characteristics of JCS (Informative) | ||
|
|
||
| For convenience, the following summarizes essential characteristics inherited | ||
| from JCS (RFC 8785) and its underlying I-JSON | ||
| ([RFC 7493](https://datatracker.ietf.org/doc/rfc7493)) baseline. | ||
| Implementations should consult RFC 8785 for exact normative algorithms: | ||
|
|
||
| - No extraneous whitespace: | ||
| Line breaks, spaces, and tabs do not occur outside of strings. | ||
| - Key uniqueness: | ||
| Duplicate key names within a single object are strictly prohibited. | ||
| - Key ordering: | ||
| The name/value pairs within an object are sorted lexicographically based | ||
| on the exact UTF-16 code units of the key names. | ||
| - Number formatting: | ||
| Integers and numeric values are represented in base 10 without leading zeros, | ||
| trailing decimal zeros, or unnecessary exponential notation. | ||
| - String escaping: | ||
| Strings are represented in UTF-8. | ||
| Quotation marks (`"`, U+0022), reverse soliduses (`\`, U+005C), | ||
| and control characters (U+0000 through U+001F, which includes line breaks | ||
| and tabs) are always escaped. |
Member
There was a problem hiding this comment.
All this has no place in the SPDX spec. We either reproduce the exact rules, or we refer to an external document defining them.
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
(Replacing #1448)
Adopts JSON Canonicalization Scheme (JCS) (RFC 8785), which is also used by the JSON signature scheme (JSS), for SPDX JSON canonicalization, as proposed in #1362 (from 24 Feb 2026 Tech call discussion) and provided context and details by spdx/spdx-3-model#1065 (comment).
JCS adoption will
JCS aligns and covers most of the SPDX existing canonicalization rules, except for the object key name restriction.
So we can simplify the spec by saying that it uses JCS plus additional object key name restriction (shown below):
(This is a slight modification from the rules from 3.0, where the range is tighten from U+0021-U+007F, to U+0021-U+007E -- to remove U+007F which is a
DELcontrol character. / It is possible that the inclusion ofDELcontrol character is not intended in the first place, since the range is specifically avoid other control characters (U+0000-U+001F). So this can be considered as a fix, not a breaking change)The adoption of JCS will allow more convenience for developers, as they can just use existing JCS libraries, which are widely available for different programming languages. With only one additional processing step of object key names.
--
The "Key characteristics of JCS (Informative)" section is optional, provided only for readers' convenience. It can be entirely removed.
To fix #1362 and to fix #1419