Relax URI requirement on payloadType?

[secure-systems-lab]

Relax URI requirement on payloadType?

[adityasaky]

Something like the Docker/OCI alternative mentioned seems reasonable to me instead of just application/json. One thing, and I may be misunderstanding this, is that OCI seems to exhaustively list their media types. Will enforcement of "more information than just application/json" become an issue with something like the signing-spec which anyone can use, and therefore define a media type for?

If the URI requirement is dropped to a SHOULD, would implementations be expected to also support media type alternatives? Especially if the spec lists them as an alternative?

[MarkLodato]

I'm thinking that we'd say something like:

payloadType is an opaque, case-sensitive string that uniquely and unambiguously identifies how to interpret payload. This includes both the encoding (JSON, CBOR, etc.) as well as the meaning/schema. To prevent collisions, it SHOULD be either:

• (recommended) A case-normalized URI. Example: https://in-toto.io/Statement/v1-json
• A lowercase Media Type (a.k.a. MIME type or Content Type). Example: application/vnd.in-toto.statement.v1+json.
  • IMPORTANT: If Media Type is used, it SHOULD NOT be a generic one that only represents encoding but not schema. For example, application/json is almost always WRONG. Instead, invent a media type specific for your application in the application/vnd namespace.

[mnm678]

I like the option to use media type. This would also allow for future use within OCI without any major changes.

[adityasaky]

I'm thinking that we'd say something like:

Thanks @MarkLodato. This seems reasonable to me.

[MarkLodato]

Thanks! Sent out pull request #26 to implement.