checksum of vocabulary do not match

[pchampin]

The spec claims that the vocabulary at https://w3id.org/security# has the following checkums

media-type	checksum
application/ld+json	SHA2-256 Digest: 082434d5b742418753bbc5d593f93b66d4f1ccf1c627417c0caa2dea40728245
text/turtle	SHA2-256 Digest: 9a5ba1e23f54b9adc9c39429f5eb3bd672cb392495cc4159561462921e012b37
text/html	SHA2-256 Digest: dadc810b5bb2c01a3caf276dc03a7c826311cddfefe86160a8c7d34704f50422

But following the instructions in the spec, this is what I get:

> curl -sL -H "Accept: application/ld+json" https://w3id.org/security | openssl dgst -sha256
SHA2-256(stdin)= 02c4b4882bbf2bf4cf5270bb2dcc2b394bdd56167f45a1eefbe5c39bc44ac270

~ 
> curl -sL -H "Accept: text/turtle" https://w3id.org/security | openssl dgst -sha256
SHA2-256(stdin)= e446e484b2fd43df9cb2a2c69b735ffa245dfc12f1d9b9305a98ac5e376a9f70

~ 
> curl -sL -H "Accept: text/html" https://w3id.org/security | openssl dgst -sha256
SHA2-256(stdin)= c0489f23f76e4b46fef21c244d7a09472ffb46e64ece7f631758733a2260eece

My understanding of https://w3id.org/security# is that it is a "living" vocabulary, so prividing checksum in a spec seems doomed to this.

[TallTed]

This is where embedding a version identifier in each URL, and increasing the version ID with each revision of the document content, does something handy.

Dereferencing the versionless URL gets the latest version of the document, via a 30x redirect. The location URL tells you the versioned URL, which you can then use to get the appropriate checksum which then gets compared to the checksum of the versioned document you got in the dereference.