SBOM naming updates

[joshbressers]

@sjn pointed out during the meeting that there are some new things we should update the naming document with

Examples

• Website default location (similar to .well-known)
• Repository locations
• Filesystem locations (like how we store license details in a distro)

Some simple guidelines to help

Kate thinks the FSFE has similar guidance, if they do, we should link to that

[sjn]

FSFE's reuse specification version 3.3 talks about .reuse and LICENSES. Maybe too narrow naming for what's suitable for metadata in general, no?

[bact]

If there will be an update, please also have the suggested extension for SPDX 3 files:
https://spdx.github.io/spdx-spec/v3.1-dev/serializations/#file-naming
Thank you.

[sjn]

I think there's also room for file naming conventions that communicate CISA SBOM Type.

E.g. a "Design SBOM" might have a static filename (not bound to a version/release), and a "Source SBOM" and later types (which probably should be assumed as "Published" SBOMs) might contain a version string in the filename, as recommended in the current naming document.

[bact]

SPDX 3 JSON now has the IANA media type as application/spdx3+json with .spdx3.json as the file extension.
https://www.iana.org/assignments/media-types/application/spdx3+json

(from 7 Aug 2026 SBOM Everywhere SIG meeting)

PR to add SPDX 3 file name #145