SPDX 2->3 conversion of ExternalPackageReferences

[armintaenzertng]

This is part of #74:

Edit: updated after I understood that ExternalPackageReference will be split into two new properties. Some references will convert to ExternalIdentifier, others to ExternalReference. See the migration documentation for a conversion guideline.

There remain two problems when the category is OTHER:

• In this case, type can be String-valued. Should this then be converted to SPDX3 ExternalIdentifierType.other or ExternalReferenceType.other?
• Also in this case, locator can be an arbitrary String (without spaces) in SPDX2, but the SPDX3 ExternalReference.locator must be a URI. ExternalIdentifier.identifier would be a String, but can we be sure that the SPDX2 reference of category OTHER is actually an identifier?

[armintaenzertng]

The following SPDX 2 external package ref types don't seem to have an SPDX 3 counterpart:

• url
• maven-central
• npm
• nuget
• bower

How would they be sorted into identifier vs reference?

[goneall]

I would suggest - reference.

[kestewart]

This needs to be handled, but not considered a blocker for 3.0-rc

[goneall]

Kate and I discussed this. We probably should handle these in RC2 since it will impact the vocabulary.

[goneall]

@maxhbr - with @armintaenzertng being out, would you mind adding a pull request to add the missing external reference types?

[armintaenzertng]

I opened #484 to address the issue of missing ExternalRefTypes.

However, the initial question of this issue still stands, namely what to do with the OTHER category of SPDX2.
I'd think it would probably be safer to convert these to references instead of identifiers, but as pointed out above, SPDX3 references expect a URI while the OTHER locator is an arbitrary string.

[goneall]

However, the initial question of this issue still stands, namely what to do with the OTHER category of SPDX2.
I'd think it would probably be safer to convert these to references instead of identifiers, but as pointed out above, SPDX3 identifiers expect a URI while the OTHER locator is an arbitrary string.

I'm thinking we should change the type of ExternalRefTypes to be xsd:string. I'm not sure why we restricted it to a URI if it is a reference.

[goneall]

This was resolved with PR #487