Overview
ISO/IEC 18670:2025 - SoftWare Hash IDentifier (SWHID) Specification V1.2 defines a standardized data format for intrinsic identifiers that reference software artifacts modeled after modern distributed version control systems. SWHIDs encode the tree-like filesystem hierarchy, special nodes for revisions, releases, and the full VCS state (branches, snapshots). A core design goal is decentralized integrity verification: SWHIDs are computable directly from the digital objects (using cryptographically strong functions and Merkle Acyclic Directed Graphs), so anyone with a copy of the objects can independently verify identity and integrity without a central registry. Note: the specification covers identifier syntax and computation; resolving identifiers (retrieving artifacts) is explicitly out of scope.
Key Topics and Requirements
- Identifier structure and syntax: SWHIDs use a compact core identifier format (scheme version "1") with object-type tags such as cnt (content), dir (directory), rev (revision), rel (release), and snp (snapshot). Qualified identifiers may include contextual qualifiers after semicolons.
- Intrinsic identifiers: Identifiers are derived from artifact content and metadata so they are reproducible and tamper-evident.
- Merkle Acyclic Directed Graphs (Merkle ADGs): Computation of SWHIDs is based on Merkle ADGs, a generalization of Merkle trees suited to version control graphs.
- Cryptographic functions and SHA1: The specification references SHA‑1 (RFC‑3174) and includes provisions to detect collision-prone files; SHA‑1 is treated carefully (partial function) and counter-cryptanalysis is noted to avoid ambiguous references.
- Qualifiers and fragments: Support for context qualifiers (origin, visit, anchor, path) and fragment qualifiers (lines, bytes) lets users pinpoint subparts or contextual views of artifacts.
- Compatibility: The standard addresses compatibility considerations with established VCS tools (e.g., Git).
- Formal grammar: ABNF grammar (RFC‑5234) and IRI handling (RFC‑3987) define exact syntax and percent-encoding rules.
Applications and Who Uses It
- Software archive and preservation projects (for long-term reproducible identifiers)
- Software supply chain security and provenance tracking (integrity checks, auditability)
- Package managers, dependency scanners and SBOM tools (precise artifact referencing)
- Source code repositories and CI/CD systems (traceability across builds and branches)
- Researchers and reproducible science practitioners (exact version referencing)
- Security teams and compliance auditors (tamper detection and verification without centralized trust)
Related Standards
- RFC‑3174 (SHA‑1), RFC‑3986 / RFC‑3987 (URI/IRI syntax), RFC‑5234 (ABNF)
- The specification references Software Heritage as an origin of examples but does not require its use.
ISO/IEC 18670:2025 is a practical, interoperable approach for uniquely and verifiably identifying software artifacts at all granularities across distributed development ecosystems. Keywords: SWHID, software hash identifier, intrinsic identifier, Merkle ADG, SHA1, software provenance, software supply chain, integrity verification.