Question: intent of schema license definition required properties

[jhoward-lm]

I have a clarification question about the intent of the required properties in the license definitions in the JSON schemas (link). The same question applies to other definitions that utilize the "oneOf": [{"required": ["<property name>"]}] pattern, such as affects.items.properties.versions.items.oneOf.

The license definition says that only one of id or name is required, but both are permitted. Is this what was intended, or should these properties be mutually exclusive?

This validates against the schema, but does it match the intended usage of the property?

"licenses": [
  {
    "license": {
      "id": "Apache-2.0",
      "name": "MIT"
    }
  }
]

Or might it make more sense to define the schema such that only one of id or name is allowed, for example by moving the id and name property definitions into their respective oneOf blocks?

Schema example

    "license": {
      "type": "object",
      "oneOf": [
        {
          "required": ["id"],
          "properties": {
            "id": {
              "$ref": "spdx.schema.json",
              "description": "A valid SPDX license ID"
            }
          }
        },
        {
          "required": ["name"],
          "properties": {
            "name": {
              "type": "string",
              "description": "If SPDX does not define the license used, this field may be used to provide the license name"
            }
          }
        }
      ],
      "additionalProperties": false,
      "properties": {
        "bom-ref": {
          "$ref": "#/definitions/refType",
          "description": "An optional identifier which can be used to reference the license elsewhere in the BOM. Every bom-ref MUST be unique within the BOM.\nValue SHOULD not start with the BOM-Link intro 'urn:cdx:' to avoid conflicts with BOM-Links."
        },
        // ...
      }
    }

[jkowalleck]

The intention is to have exactly one of name or id present.
And that is exactly what the current JSON schema does.

The JSON schema:

specification/schema/bom-1.6.schema.json

Lines 1232 to 1258 in 55343ba

	"oneOf": [
	{
	"required": ["id"]
	},
	{
	"required": ["name"]
	}
	],
	"additionalProperties": false,
	"properties": {
	"bom-ref": {
	"$ref": "#/definitions/refType",
	"title": "BOM Reference",
	"description": "An optional identifier which can be used to reference the license elsewhere in the BOM. Every bom-ref MUST be unique within the BOM.\nValue SHOULD not start with the BOM-Link intro 'urn:cdx:' to avoid conflicts with BOM-Links."
	},
	"id": {
	"$ref": "spdx.schema.json",
	"title": "License ID (SPDX)",
	"description": "A valid SPDX license ID",
	"examples": ["Apache-2.0"]
	},
	"name": {
	"type": "string",
	"title": "License Name",
	"description": "If SPDX does not define the license used, this field may be used to provide the license name",
	"examples": ["Acme Software License"]
	},

For comparison, see XML schema:

specification/schema/bom-1.6.xsd

Lines 761 to 772 in 55343ba

	<xs:choice>
	<xs:element name="id" type="spdx:licenseId" minOccurs="1" maxOccurs="1">
	<xs:annotation>
	<xs:documentation>A valid SPDX license ID</xs:documentation>
	</xs:annotation>
	</xs:element>
	<xs:element name="name" type="xs:normalizedString" minOccurs="1" maxOccurs="1">
	<xs:annotation>
	<xs:documentation>If SPDX does not define the license used, this field may be used to provide the license name</xs:documentation>
	</xs:annotation>
	</xs:element>
	</xs:choice>

---

This validates against the schema,

Nope, it does not. maybe your json schema validator is implemented wrong?

JSON is valid against more than one schema from 'oneOf' - therefore, the data set you provided is invalid.

data used for testing the JSON schema

could be used on https://www.jsonschemavalidator.net/

schema cutout

{
	"$schema": "http://json-schema.org/draft-07/schema#",
    "type": "object",
    "title": "License",
    "oneOf": [
        {
          "required": ["id"]
        },
        {
          "required": ["name"]
        }
    ],
    "additionalProperties": false,
    "properties": {
        "id": {  },
        "name": { },
    }
}

example data set

{

  "id": true,
  "name": true
}

[jkowalleck]

Additional technical detail:

Or might it make more sense to define the schema such that only one of id or name is allowed, for example by moving the id and name property definitions into their respective oneOf blocks?

We found this to be not-working.
Having "additionalProperties": false, set on "root" level of a property would not allow additional properties that were not defined already - Therefore, putting rules in an oneOf fails.