As the SDL format seems to turn out as the generally favored choice (with the main concern of it not being a widely used format), I've started drafting a possible specification: https://github.com/rejectedsoftware/dub/wiki/Sdl-based-package-format-draft
It's currently a more or less literal translation of the JSON format, adapted to SDL specific features in some places (such as dependency or configuration lists).