PACKAGE_MANAGER vs PACKAGE-MANAGER

[ddillard]

I see in #618 that it was decided to use PACKAGE_MANAGER instead of PACKAGE-MANAGER as an external reference category. However, in a commit from July this was undone in the schema so that it now is PACKAGE-MANAGER. There are SBOM generators out there that use both values (I was doing some testing and noticed the difference when reviewing output). I personally don't care which one gets used, though I suspect PACKAGE_MANAGER would require fewer utilities to be updated, but either one needs to be chosen OR both need to be allowed for interoperability.

Note: This affects PERSISTENT_ID as well.

[goneall]

From reading through the history, it looks like I changed PACKAGE_MANAGER to PACKAGE-MANAGER in the examples and in the schema for the 2.3 release. This may have been due to the introduction of other enums with dashes.

This does create a compatibility issue and I agree it should be resolved.

I would propose supporting both underscores and dashes.

This does put a burden on tools, since they would have to support both, but it would probably be less impactful than having different versions of the schema support different syntaxes.

[goneall]

@coderpatros - any concerns with supporting both?

[coderpatros]

@goneall I'm not a fan of supporting both. And I liked the reasoning given in this issue #618 to standardise on underscores. But then the spec documentation uses hyphens. So it can be a bit confusing.

[goneall]

@coderpatros We discussed it in the tech call yesterday and agreed on the approach of supporting both. My apologies for the inconvenience - I missed the inconsistency the first time around which caused the compatibility issues.

[coderpatros]

No worries @goneall, will this apply to all instances going forward? i.e. PERSISTENT-ID. And is there a preferred choice? Should the default be to match the spec documentation?

[goneall]

@coderpatros

No worries

Thanks for your understanding

will this apply to all instances going forward?

Yes

And is there a preferred choice? Should the default be to match the spec documentation?

Good question - I don't have an answer from the SPDX community (we didn't discuss this on the tech call). My personal suggestion is the default should match the spec documentation.

BTW - in the next major release of the spec (3.0), we can resolve this to a single value since the compatibility constraints are a bit relaxed.