Punch List: Extension about spdx-3-model HOT 1 CLOSED

• Translations between serialization formats not guaranteed for extensions.
• SPDX has no understanding of nor provide any guarantees around extensions. SPDX will not validate them.
• Tools should ignore extensions unless specifically designed to support a particular extension.
• We need to point out that tools putting everything in extensions when there are existing structures that represent the data in a standard way will not be able to interop or claim support for appropriate profiles.
• Are we comfortable with the restriction of one extension per type? Yes.
• Extensions don't require being in a profile.
• Extension is part of an element so data license applies to the extension.
• Update model to show that there is a key to the map that is a string and it is unique.
• We should recommend in the text that version is incorporated into the type URI to allow extensions to evolve.

{
  "extensions": {
    "https://npmjs.com/spdx/extensions/publishing_info": {
      "published_user_id" 1234,
      "was_2fa_used": true
    },
    "https://cyclonedx.org/spdx/extensions/roundtrip_1_4": {
    }
}

{
  "extensions": [
    {"type": "https://microsoft.com"}
  ]
}

from spdx-3-model.