Consider referencing RFC 8785 JSON Canonicalization Scheme (JCS) in canonicalization

[goneall]

From the 24 Feb 2026 tech call discussion on signing SPDX documents, we should consider referencing RFC 8785 JSON Canonicalization Scheme (JCS) as part of our JSON canonicalization specification.

Note that this is not complete - additional specifications are needed to cover items like graph serialization and handling contexts and namespace prefixes.

[bact]

JCS Appendix D. "Dealing with Big Numbers" is addressing the issue described here https://github.com/spdx/spdx-3-model/blob/develop/serialization/jsonld/validation.md#decimal where we see differences in programming languages and libraries when it comes to xsd:decimal, some put quotes around the decimal, some don't -- and SPDX 3.0.1 spec does not specified what it should be.

From JCS Appendix D.:

numbers that do not have a natural place in the current JSON ecosystem MUST be wrapped using the JSON string type.

[bact]

List of JCS implementations https://github.com/cyberphone/json-canonicalization

[bact]

See also this comment spdx/spdx-3-model#1065 (comment) from @j28smith