Merge branch 'main' into update-NoneElement-IRI

Signed-off-by: Arthit Suriyawongkul <arthit@gmail.com>

.github/workflows/validate-pr.yml

@@ -11,8 +11,8 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
-      - uses: actions/setup-python@f677139bbe7f9c59b41e40162b753c062f5d49a3 # v5.2.0
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5.3.0
         with:
             python-version: "3.12"
       - name: get spec-parser

CHANGELOG.md

@@ -1,33 +1,66 @@
 # Change Log
 
-## 3.0.1 (under development - last update 2024-08-14)
+## 3.0.1 (2024-12-10)
 
 ### Changes since 3.0
 
 - **Removed:** `Software/contentType` property - [#789](https://github.com/spdx/spdx-3-model/pull/789)
   - The `Software/File` class is meant to use the `Core/contentType` property.
-- **Fixed:** Typo in `hasPrerequisite` entry - [#817](https://github.com/spdx/spdx-3-model/pull/817)
-  - Corrected the misspelling of `hasPrerequsite` to `hasPrerequisite` in
-    `Core/RelationshipType`.
-- **Fixed:** Licensing relationship type names - [#779](https://github.com/spdx/spdx-3-model/pull/779)
-  - Corrected `concludedLicense` to `hasConcludedLicense` and
-    `declaredLicense` to `hasDeclaredLicense` in the "Profile conformance"
-    section of AI, Dataset, Licensing, and Lite Profiles.
-- **Fixed:** Typo in `import` property - [#847](https://github.com/spdx/spdx-3-model/pull/847)
+- **Fixed:** Cardinalities in `Security/VexAffectedVulnAssessmentRelationship` class -
+  [#908](https://github.com/spdx/spdx-3-model/pull/908)
+  - Corrected `actionStatement` cardinality from `0..1` to `1..1` to match its textual description.
+  - Corrected `actionStatementTime` cardinality from `0..*` to `0..1` to match its textual description.
+- **Fixed:** Typo in `Core/import` property - [#847](https://github.com/spdx/spdx-3-model/pull/847)
   - Corrected `imports` to `import` in Core Profile.
 - **Fixed:** Typo in `Build/parameter` property - [#836](https://github.com/spdx/spdx-3-model/pull/836)
   - Corrected `parameters` to `parameter` in Build Profile.
-- **Fixed:** Typo in `hasInput` and `hasOutput` relationship type names - [#854](https://github.com/spdx/spdx-3-model/pull/854)
+- **Fixed:** Typo in `hasInput` and `hasOutput` entries - [#854](https://github.com/spdx/spdx-3-model/pull/854)
   - Corrected `hasInputs` to `hasInput` and `hasOutputs` to `hasOutput` in
     `Core/RelationshipType`.
+- **Fixed:** Typo in `hasPrerequisite` entry- [#817](https://github.com/spdx/spdx-3-model/pull/817)
+  - Corrected the misspelling of `hasPrerequsite` to `hasPrerequisite` in
+    `Core/RelationshipType`.
+- **Fixed:** Licensing relationship type names in Profile conformance - [#779](https://github.com/spdx/spdx-3-model/pull/779)
+  - Corrected `concludedLicense` to `hasConcludedLicense` and
+    `declaredLicense` to `hasDeclaredLicense` in the "Profile conformance"
+    section of AI, Dataset, Licensing, and Lite Profiles.
+- **Fixed:** `Security/actionStatement` property - [#908](https://github.com/spdx/spdx-3-model/pull/908)
+  - Corrected its cardinality from `0..1` to `1..1`.
+- **Fixed:** `Security/actionStatementTime` property - [#908](https://github.com/spdx/spdx-3-model/pull/908)
+  - Corrected its cardinality from `0..*` to `0..1`.
 - **Added:** `adler32` entry to `Core/HashAlgorithm` - [#826](https://github.com/spdx/spdx-3-model/pull/826)
-  - The Adler-32 checksum, previously available in SPDX 2.3, has been
-    reintroduced.
+  - Reintroduced the Adler-32 checksum, previously available in SPDX 2.3.
+- **Added:** `Core/SpdxOrganization` individual - [#880](https://github.com/spdx/spdx-3-model/pull/880)
+  - An `SpdxOrganization` individual, a `Organization` representing the SPDX
+    Project, is added. It is by definition the creator of all Element type individuals
+    defined by the SPDX Project.
+- **Added:** `Core/IndividualElement` class - [#937](https://github.com/spdx/spdx-3-model/pull/937)
+  - A concrete subclass of Element used by Individuals in the Core profile.
 - **Clarified:** `AI/autonomyType` property - [#741](https://github.com/spdx/spdx-3-model/pull/741)
   - Specified the meaning of `yes`, `no`, and `noAssertion` values in the
     `AI/autonomyType` property description.
+- **Clarified:** `Build/buildType` property - [#875](https://github.com/spdx/spdx-3-model/pull/875)
+  - Its intent is added: "The buildType is used to interpret the meaning of
+    other build parameters by defining the 'type' of build...".
+- **Clarified:** `hasDataFile` entry in `Core/RelationshipType` - [#815](https://github.com/spdx/spdx-3-model/pull/815)
+  - Its description is enhanced with examples and counter-examples.
+- **Clarified:** `Core/packageVerificationCodeExcludedFile` property - [#913](https://github.com/spdx/spdx-3-model/pull/913)
+  - Its description is now stating that every filename is preceded with a `./`.
 - **Improved:** JSON-LD examples.
   - All JSON-LD examples in the "Syntax" section of class descriptions are now
-    validated.
+    validated - [#794](https://github.com/spdx/spdx-3-model/pull/794)
   - Added JSON-LD examples for `AI/EnergyConsumption` and
-    `AI/EnergyConsumptionDescription`.
+    `AI/EnergyConsumptionDescription` - [#780](https://github.com/spdx/spdx-3-model/pull/780)
+- **Updated:** Model diagrams.
+  - Used updated names and specified XSD datatypes - [#852](https://github.com/spdx/spdx-3-model/pull/852)
+  - Removed all named individuals - [#884](https://github.com/spdx/spdx-3-model/pull/884)
+  - Adjusted layout to also fit printed format and removed all vocabulary
+    entries - [#935](https://github.com/spdx/spdx-3-model/pull/935)
+  - Add `Core/IndividualElement` class
+    to the Core diagram - [#941](https://github.com/spdx/spdx-3-model/pull/941)
+- Fixed general typos and formatting issues.
+
+## 3.0 (2024-04-15)
+
+For changes since the 3.0 release candidates, please visit:
+<https://github.com/spdx/spdx-3-model/releases>.

Contributing.md

@@ -10,7 +10,8 @@ and during our [regular meetings][meetings].
 
 All the details are in: <https://spdx.dev/participate/tech/>
 
-This repository consists of Markdown files describing the model classes,
+This repository consists of files written in
+[a specific Markdown format][format] describing the model classes,
 datatypes, properties, and vocabularies which will be used to automatically
 create documentation, ontologies, and validation artifacts.
 These are organized by profile.
@@ -54,6 +55,11 @@ updating individual profiles.
 
 This method of development was agreed upon by the SPDX Tech team on 2023-01-17.
 
+## Translation
+
+Translations of model descriptions are welcome.
+Please see [translation.md][translation] for details.
+
 ## Profile Maintainers
 
 In accordance with the development model described above,
@@ -76,6 +82,8 @@ Each profile in active development phase also has their own
 | Security | [Thomas Steenbergen][gh-thomas], [Adolfo García Veytia][gh-adolfo], and [Rose Judge][gh-rose] |
 | Software | [Alexios Zavras][gh-alexios] and [Gary O'Neall][gh-gary] |
 
+[format]: ./docs/format.md
+[translation]: ./docs/translation.md
 [spdx-tech-list]: https://lists.spdx.org/mailman/listinfo/spdx-tech
 [meetings]: https://github.com/spdx/meetings/
 [issues]: https://github.com/spdx/spdx-3-model/issues/

README.md

@@ -17,10 +17,14 @@ standard.
 
 ## Branches and Formats
 
-The editable files inside `model/` directory are written in a constrained
-subset of Markdown, with specific headings for specific types of information,
+The editable files inside `model/` directory are written in a
+[constrained subset of Markdown][format],
+with specific headings for specific types of information,
 and are stored in the `main` branch.
 
+Textual description of these model files
+[can be translated][translation] into other natural languages.
+
 The editable files are automatically processed by
 [spec-parser](https://github.com/spdx/spec-parser/)
 and the following are generated:
@@ -34,7 +38,7 @@ and the following are generated:
   - [Turtle format](https://en.wikipedia.org/wiki/Turtle_(syntax)):
     [spdx-model.ttl](https://spdx.org/rdf/3.0.1/spdx-model.ttl)
   - [JSON-LD format](https://json-ld.org/):
-    [spdx-model.jsonld](https://spdx.github.io/spdx-spec/v3.0.1/rdf/spdx-model.jsonld) 
+    [spdx-model.jsonld](https://spdx.github.io/spdx-spec/v3.0.1/rdf/spdx-model.jsonld)
 
 People who wish to read the current version of the information
 should be viewing the generated files, while anyone wanting to edit
@@ -47,7 +51,8 @@ For the specification content other than the model, they are in the
 
 The SPDX model is described using profiles related to the software application.
 The profiles are organized as sub-directories under the ‘model’ directory.
-The model diagram is available in [model.drawio](./model.drawio) file.
+
+The model diagram is available in [model.drawio][model-diagram] file.
 
 Note:
 
@@ -120,7 +125,11 @@ snippets, and artifacts of the software application.
 
 See [CHANGELOG.md](CHANGELOG.md) for changes between versions.
 
-## Contribute!
+## Glossary
+
+See [glossary][glossary] for definitions and explanations of terms used throughout the specification.
+
+## Contribute
 
 For information about how to contribute to a specific profile,
 please see [Contributing.md](Contributing.md).
@@ -133,5 +142,9 @@ and during our [regular meetings][meetings].
 
 All the details are in: <https://spdx.dev/participate/tech/>
 
+[format]: ./docs/format.md
+[translation]: ./docs/translation.md
+[model-diagram]: ./docs/model.drawio
+[glossary]: ./docs/glossary.md
 [meetings]: https://github.com/spdx/meetings/
 [spdx-tech-list]: https://lists.spdx.org/mailman/listinfo/spdx-tech