[v2.3 Specification Clarification] Embedding SBOM revision number

[trekcampy]

We are comply with spdx v2.3 SBOM. We would like to specify SBOM revision number in form of a sequentially increment number starting with 1, something similar to top level "version" integer field in CycloneDX. What is the best way to represent revision.

Thanks

[goneall]

Since the document namespace must be unique, you need to generate a new unique document namespace each time you make a modification to anything contained in the document. This implies that the document namespace can be used as the "version" since it must be unique.

One convention that would allow you to include a serial number is to have a document namespace naming convention where you append a unique name for the SBOM with a number - e.g. "https://mycompany.com/spdx/sbom-name/1"

[trekcampy]

Thanks for the suggestion @goneall. That should work for over application.

In some case SBOM document name is suffixed with a unique UUID

https://spdx.github.io/spdx-spec/v2.3/document-creation-information/#65-spdx-document-namespace-field

Is there a value in having UUID after adding number

e.g. "https://mycompany.com/spdx/sbom-name-XXXX-XXXX-XX/1"

Some of our legacy products have UUID and we are debating if should keep it.

[goneall]

Is there a value in having UUID after adding number

The only requirement is that each SPDX document namespace is globally unique.

Using a UUID is a recommended practice since it is hard to control other parties generating a document namespace with the same name.

On the surface, the version number looks like it could work - however, if more than one party is generating SPDX documents, they may choose the same version number.