Minor versioning; was: Discussion of substitution groups

["Anthony B. Coates" <abcoates@londonmarketsystems.com>]

On Wed, 20 Jul 2005 16:23:22 +0100, CRAWFORD, Mark <MCRAWFORD@lmi.org>  
wrote:

> 	If I were engaging in a trading partner
> 	agreement and was agreeing that UBL 2.0
> 	be used. I would hardly want that to leave
> 	things open to any minor change of content
> 	2.1, 2.2, 2.3, even 2.99! I would want to limit
> 	things to say 2.2, 2.0 and maybe 2.1. I would
> 	want to specifiy this with the namespace(s)
>
> 	[mrc] This still strikes me as an inappropriate use of
> namespaces.  We have versioned the schema, and the schema location which
> strikes me as the more proper way to indicate the version for the sum
> total of the contents.  I may want to use different versions of
> different namespaces in a particular schema - and thats ok because the
> namespace versions are only indications of the specific vocabulary set I
> am drawing from.

You will find that the ATG proposal to use the 'schemaLocation' to carry  
the essential Schema version information may not prove widely acceptable.   
It certainly hasn't been in past when other groups have tried it.  There  
are two issues:

(i) as the Schema spec makes 'schemaLocation' optional, you can't rely on  
instances having a schema location;
(ii) more importantly, many companies are uncomfortable about externally  
supplied Schema locations, due to the risk of Schema "bombing" attacks,  
etc.  Part of the problem is that there isn't a standard place in the XML  
infrastructure to "validate" Schema locations , i.e. judge whether you  
consider them acceptable or not, before the validator starts using the  
Schema from that location.  There are real security issues that come out  
of trying to use 'schemaLocation' for versioning.

It's a pity the namespace and XML Schema specs don't really lay out a  
workable versioning scheme, but they don't, so any solution we come up  
with will be a compromise.  It shouldn't be ignored that most groups to  
date have compromised about versioning the namespaces, in spite of the  
issues that introduces.

Cheers, Tony.
-- 
Anthony B. Coates
London Market Systems Limited
33 Throgmorton Street, London, EC2N 2BR, UK
http://www.londonmarketsystems.com/
mailto:abcoates@londonmarketsystems.com
Mobile/Cell: +44 (79) 0543 9026
[MDDL Editor (Market Data Definition Language), http://www.mddl.org/]
[FpML Arch WG Member (Financial Products Markup Language),  
http://www.fpml.org/]
-----------------------------------------------------------------------
This Email may contain confidential information and/or copyright material  
and is intended for the use of the addressee only.  Any unauthorised use  
may be unlawful. If you receive this Email by mistake please advise the  
sender immediately by using the reply  facility in your e-mail software.   
Email is not a secure method of communication and London Market Systems  
Limited cannot accept responsibility for the accuracy or completeness of  
this message or any attachment(s). Please examine this email for virus  
infection, for which London Market Systems Limited accepts no  
responsibility. If verification of this email is sought then please  
request a hard copy. Unless otherwise stated any views or opinions  
presented are solely those of the author and do not represent those of  
London Market Systems Limited.