Add in ReleaseDate, BuiltDate, and ValidUntilDate as optional fields

[kestewart]

These fields will be in the Usage Profile in SPDX 3.0, however there is a need for them today to support some of the SBOM use cases. In particular the FDA guidance is asking for an "End of Support" date, which the ValidUntilDate will satisfy. Moving these into a 2.3 specific pull request.

Signed-off-by: Kate Stewart kate.stewart@att.net

[kestewart]

@yoshi-i, could you please review that I have summarized the right information from #671. If you are ok with this version, can you add in your "Signed-off-by:" to this thread.

[goneall]

@kestewart Are there any other tags for packages or files that are not prefixed by Package or File? If these are the first such non-specific tags to be introduced, it may require a significant redesign of the Java Tag/Value parser and other parsers as well. I'll need to review the code to confirm.

[seabass-labrax]

No objections to this being merged except for my comment about naming below. 😃

[goneall]

Are there any other tags for packages or files that are not prefixed by Package or File? If these are the first such non-specific tags to be introduced, it may require a significant redesign of the Java Tag/Value parser and other parsers as well. I'll need to review the code to confirm.

@kestewart I did some research on the parsers and there is no issue with the naming as proposed as long as we don't use the same property name for a file. The current proposal is just for packages, so we are fine. I do like the current naming proposal since it is compatible with the JSON and RDF notations.

[goneall]

@kestewart - Please add the DCO sign-off

[kestewart]

@goneall - hand holding please - I tried to add it (see initial comment), but something in my config needs to be updated it seems.

[yoshi-i]

Hello @kestewart -san, I reviewed your commits and discussed about it with @NorioKobota -san. I agree with your summarized proposal and I will gladly add "Signed-off-by:" to this comment.

If it need to other explicit commit action with signed-off-by field or other operation to package-information.md on specific branch, please let me know.

Signed-off-by: Yoshiyuki Ito yoshiyuki.ito.ub@renesas.com

[kestewart]

@goneall, please review and merge if you're ok with the explanation provided.

[seabass-labrax]

Thanks for the explanation Kate; I'll leave an 'approve' review now.