(registered 2022-05-09, last updated 2022-05-09) Media type name: application Media subtype name: cwl Required parameters: None Optional parameters: None Encoding considerations: binary Security considerations: CWL documents are encoded using a subset of JSON or YAML syntax. CWL parsers should take the same security precautions applicable for JSON or YAML to avoid arbitrary code execution and memory exhaustion. See CVE-2021-41110 for more information. CWL documents typically reference software containers and executors of CWL documents should evaluate the security of third party containers before downloading or executing them. Executing CWL documents with any combination of third-party data or containers can lead to arbitrary code execution and resource exhaustion. CWL executors should have resource limits, logging, and other measures to control and monitor usage. See https://cwe.mitre.org/data/definitions/502.html https://cwe.mitre.org/data/definitions/73.html https://cwe.mitre.org/data/definitions/410.html https://cwe.mitre.org/data/definitions/641.html CWL documents do not include digital signatures nor encryption of the workflow descriptions themselves. Users with data integrity, originator authenticity, and data confidentiality concerns with respect to the workflow descriptions themselves should address those concerns separately. Interoperability considerations: The CWL standards include extensive conformance tests https://w3id.org/cwl/v1.2/#Running_the_CWL_conformance_tests Published specification: https://w3id.org/cwl Specific versions of the CWL standards: https://w3id.org/cwl/v1.2 https://w3id.org/cwl/v1.1 https://w3id.org/cwl/v1.0 Academic citation: Peter Amstutz, Michael R. Crusoe, Nebojša Tijanić (editors), Brad Chapman, John Chilton, Michael Heuer, Andrey Kartashov, Dan Leehr, Hervé Ménager, Maya Nedeljkovich, Matt Scales, Stian Soiland-Reyes, Luka Stojanovic (2016): Common Workflow Language, v1.0. Specification, Common Workflow Language working group. https://w3id.org/cwl/v1.0/ https://doi.org/10.6084/m9.figshare.3115156.v2 Applications which use this media: CWL has been used to exchange command line tool and workflow definitions by many researchers and scientists since the publication of version 1.0 in 2016. See https://www.commonwl.org/gallery/ for a list of public sector adopters across multiple domains and countries. Fragment identifier considerations: Fragment identifiers in CWL URIs are defined in https://w3id.org/cwl/v1.0/SchemaSalad.html#Identifier_resolution The use of fragment identifiers in CWL URIs are to refer to specific parts of the document, their use should not change the result from a (HTTP) retrieval operation. Restrictions on usage: N/A Additional information: 1. Deprecated alias names for this type: None 2. Magic number(s): See entry under "Other Information & Comments" 3. File extension(s): .cwl 4. Macintosh file type code: N/A 5. Object Identifiers: N/A General Comments: Magic Numbers: CWL documents often start with the US-ASCII string "#!/usr/bin/env cwl-runner" (35 33 47 117 115 114 47 98 105 110 47 101 110 118 32 99 119 108 45 114 117 110 110 101 114) but this is not required. All CWL document have the US-ASCII string "cwlVersion" (99 119 108 86 101 114 115 105 111 110) as either the very first octets, or prepended by a newline later (13 10 or 13 or 10) in the file. Person to contact for further information: 1. Name: Michael R. Crusoe 2. Email: mrc&commonwl.org Intended usage: Common CWL documents are widely distributed. Author/Change controller: The CWL Project is currently part of Software Freedom Conservancy, Inc.; a USA based USA 501(c)(3) non-profit working in the public interest. The CWL Leadership Team can be reached via commonworkflowlanguage&sfconservancy.org