Ground SML and SMP areas in the published specifications
Read Peppol SML 1.3.0 and SMP 1.4.0 (both 2025-02-06) and reworked the
affected pages. New Specifications page records which specs were
consulted,
their normative references (PFUOI 4.4.0, BDXL 1.0, RFC 4848 for U-NAPTR,
RFC 6234) and what still needs reading.
Two findings that change the plan:
- There is no anonymous SML read interface. Read() and List() exist, but
both
management interfaces require mTLS with a certificate under the Peppol
root
CA and are scoped to the authenticated SMP. So third-party lookup is
DNS
only, and "peppol sml query <someone else's id>" was dropped as
unimplementable. The SML area is now split into own-SMP operations and
DNS.
- SMP 1.4.0 section 3 states the spec does not define
create/update/delete
interfaces. The write API peppol-smp-client speaks is the BusDox-era
convention, not normative, so SMP write is implementation-dependent.
Raised
as Open Questions #10.
Resolved from the specs: the participant hash (SHA-256 over the
lowercased ID,
Base32, trailing = stripped) plus the spec's test vector, reproduced and
confirmed; U-NAPTR service name Meta:SMP and the URI constraints, which
become
a conformance check; SMP resource URLs, percent-encoding, HTTP status
codes and
the mandatory TLS on port 443; the XML signature algorithm profile;
one-degree
redirect limit and the destination-certificate cross-check; endpoint
activation
and expiry as normative MUST-ignore rules; the full SML operation set
including
CreateList/DeleteList batching and two-step migration; and the four SML
faults,
which fix six exit-code mappings. Eleven Glossary entries now cite the
specs
instead of carrying TODOs.
Also found: CSMLDefault.MIGRATION_CODE_PATTERN accepts underscore, which
is not
in the spec's permitted special-character set (Library Gaps #15), and
SML 1.3.0
contradicts itself on migration key content between 2.2 and 3.2.6.
phax
committed
Sep 28, 2026