SPDX Vocabulary Specification

Class: SpdxDocument

An SdpxDocument represents the results of a contents, provenance, ownership and licensing analysis of exactly one software package. This is, effectively, the top level of SPDX information.

Status:

testing

Properties:

• specVersion
  Cardinality: Mandatory, one

• confidentiality
  Cardinality: Mandatory, one

• creationInfo
  Cardinality: Mandatory, one

• reviewed
  Cardinality: Optional, zero or more.

• describesPackage
  Cardinality: Mandatory, one

• hasExtractedLicensingInfo
  Cardinality: Optional, zero or more

• referencesFile
  Cardinality: Mandatory, one or more

• dataLicense
  Cardinality: Mandatory, one

Class: Package

A Package represents a piece software that is delivered as a single unit.

Status:

testing

Properties:

• name
  Cardinality: Mandatory, one

• versionInfo
  Cardinality: Optional, zero or one

• summary
  Cardinality: Optional, zero or one

• description
  Cardinality: Optional, zero or one

• packageFileName
  Cardinality: Mandatory, one

• downloadLocation
  Cardinality: Mandatory, one

• checksum
  Cardinality: Optional, zero or one

• packageVerificationCode
  Cardinality: Mandatory, one

• sourceInfo
  Cardinality: Optional, zero or one

• copyrightText
  Cardinality: Mandatory, one

• licenseComments
  Cardinality: Optional, zero or one

• licenseDeclared
  Cardinality: Mandatory, one

• licenseConcluded
  Cardinality: Mandatory, one

• licenseInfoFromFiles
  Cardinality: Mandatory, one or more

• hasFile
  Cardinality: Mandatory, one or more

Class: File

A File represents a named sequence of information that is contained in a software package.

Status:

testing

Properties:

• fileName
  Cardinality: Mandatory, one

• fileType
  Cardinality: Optional, zero or one

• copyrightText
  Cardinality: Mandatory, one

• licenseComments
  Cardinality: Optional, zero or one

• licenseConcluded
  Cardinality: Mandatory, one

• licenseInfoInFile
  Cardinality: Mandatory, one or more

• checksum
  Cardinality: Mandatory, one

• artifactOf
  Cardinality: Optional, zero or one

Class: License

A License represents a software copyright license. This class is used by the SPDX license list to represent standard license.

Status:

testing

Properties:

• licenseId
  Cardinality: Mandatory, one

• licenseText
  Cardinality: Mandatory, one

Class: Checksum

A Checksum is simple value that allows the contents of a file to be authenticated. Even small changes to the content of the file will change it's checksum value.

Status:

testing

Properties:

• algorithm
  Cardinality: Mandatory, one

• checksumValue
  Cardinality: Mandatory, one

Class: PackageVerificationCode

A PackageVerificationCode is a value that allows authentication of the package. This differs from the Checksum in that it uses an algorithm that allows the the SPDX file to be embedded in the pacakge. This digest is produced using a cryptographic hash algorithm applied to a manifest of the package. Some files in the package (ie, the SPDX files) are explicitly excluded from the digest. This allows those files to not impact the verification code.

Status:

testing

Properties:

• packageVerificationCodeExcludedFile
  Cardinality: Optional, zero or more

• packageVerificationCodeValue
  Cardinality: Mandatory, one

Class: CreationInfo

A CreationInfo provides information about the individuals, organizations and tools involved in the creation of an SpdxDocument.

Status:

testing

Properties:

• creator
  Cardinality: Mandatory, one or more

• created
  Cardinality: Mandatory, one

• rdfs:comment
  Cardinality: Optional, zero or one

Class: Review

A Review represents a signoff by an individual on the information in an SpdxDocument.

Status:

testing

Properties:

• reviewer
  Cardinality: Mandatory, one

• reviewDate
  Cardinality: Mandatory, one

• rdfs:comment
  Cardinality: Optional, zero or one

Class: ExtractedLicensingInfo

An ExtractedLicensingInfo represents a license or licensing notice that was found in the package. Any license text that is recognized as a license may be represented as a License rather than a ExtractedLicensingInfo.

Status:

testing

Properties:

• licenseId
  Cardinality: Mandatory, one

• extractedText
  Cardinality: Mandatory, one

Class: ConjunctiveLicenseSet

A ConjunctiveLicenseSet represents a set of licensing information all of which apply.

This class refines rdfs:Container.

Status:

testing

Properties:

• member
  Cardinality: Mandatory, two or more.

Class: DisjunctiveLicenseSet

A DisjunctiveLicenseSet represents a set of licensing information only one of which applies. This class implies that the copier gets to choose which of these licenses they would prefer to use.

This class refines rdfs:Container.

Status:

testing

Properties:

• member
  Cardinality: Mandatory, two or more.

Class: AnyLicenseInfo

The AnyLicenseInfo class includes all resources that represent licensing information.

Status:

testing

Members

All resources in any of the following classes:

• License
• ExtractedLicensingInfo
• ConjunctiveLicenseSet
• DisjunctiveLicenseSet

Class: SimpleLicenseInfo

The SimpleLicenseInfo class includes all resources that represent simple, atomic, licensing information.

Status:

testing

Members

All resources in any of the following classes:

• License
• ExtractedLicensingInfo

Property: algorithm

Identifies the algorithm used to produce the subject Checksum.

Currently, SHA-1 is the only supported algorithm. It is anticpated that other algorithms will be supported at a later time.

Status:

testing

Domain:

Checksum

Range:

spdx:checksumAlgorithm_sha1

Property: artifactOf

Status:

testing

Domain:

File

Range:

doap:Project

Property: checksum

The checksum property provides a digest of a File or Package. This allows consumers of the SPDX document to verify that the content of the files or package has not changed.

Status:

testing

Domain:

Any of:

• Package
• File

Range:

Checksum

Property: checksumValue

The checksumValue property provides a hex encoded digest value produced using a specific algorithm.

Status:

testing

Domain:

Checksum

Range:

xsd:hexBinary

Property: created

The date and time at which the SpdxDocument was created. This value must in UTC and have 'Z' as its timezone indicator.

Status:

testing

Domain:

CreationInfo

Range:

xsd:dateTime

Property: copyrightText

The text of copyright declarations discovered in the Package or File.

Status:

testing

Domain:

Any of:

• Package
• File

Range:

Any of:

• rdfs:Literal
• spdx:none
• spdx:noassertion

Property: confidentiality

Indicates the level of confidentiality the producer of this SpdxDocument expects to apply to this document.

Status:

testing

Domain:

SpdxDocument

Range:

Any of:

• spdx:confidentiality_private
• spdx:confidentiality_public

Property: creationInfo

The creationInfo property relates an SpdxDocument to a set of information about the creation of the SpdxDocument.

Status:

testing

Domain:

SpdxDocument

Range:

CreationInfo

Property: creator

The name and, optionally, contact information of a person, organization or tool that created, or was used to create, the SpdxDocument.

Status:

testing

Domain:

CreationInfo

Range:

xsd:string

Property: dataLicense

The licensing under which the the preparer of this SPDX document allows this data to be copied. By default this is PDDL.

Status:

testing

Domain:

SpdxDocument

Range:

AnyLicenseInfo

Property: describesPackage

The describesPackage property relates an SpdxDocument to the package which it describes.

Status:

testing

Domain:

SpdxDocument

Range:

Package

Property: description

Provides a detailed description of the package.

Status:

testing

Domain:

Package

Range:

xsd:string

Property: downloadLocation

The URI at which this package is available for download. Private (ie, not publicly reachable) URIs are acceptable as values of this property.

The values http://spdx.org/rdf/terms#none and http://spdx.org/rdf/terms#noassertion may be used to specify that the package is not downloadable or that no attempt was made to determine its download location, respectively.

Status:

testing

Domain:

Package

Range:

xsd:anyURI

Property: extractedText

Verbatim license or licensing notice text that was discovered.

Status:

testing

Domain:

ExtractedLicensingInfo

Range:

xsd:string

Property: fileName

The name of the file relative to the root of the package.

Status:

testing

Domain:

File

Range:

xsd:string

Property: fileType

The type of the file.

Status:

testing

Domain:

File

Range:

One of:

• spdx:fileType_source

  Indicates the file is a source code file.

• spdx:fileType_archive

  Indicates the file is an archive file.

• spdx:fileType_binary

  Indicates the file is not a text file. filetype_archive is preferred for archive files even though they are binary.

• spdx:fileType_other

  Indicates the file did not fall into any of the other categories.

Property: hasExtractedLicensingInfo

Indicates that a particular ExtractedLicensingInfo was defined in the subject SpdxDocument.

Status:

testing

Domain:

SpdxDocument

Range:

ExtractedLicensingInfo

Property: hasFile

Indicates that a particular file belongs to a package.

Status:

testing

Domain:

Package

Range:

File

Property: licenseComments

The licenseComments property allows the preparer of the SPDX document to describe why the licensing in spdx:licenseConcluded was chosen.

Status:

testing

Domain:

Any of:

• Package
• File

Range:

xsd:string

Property: licenseConcluded

The licensing that the preparer of this SPDX document has concluded, based on the evidence, actual applies to the package.

Status:

testing

Domain:

Any of:

• Package
• File

Range:

Any of:

• AnyLicenseInfo
• spdx:none
• spdx:noassertion

Property: licenseDeclared

The licensing that the creators of the software in the package, or the packager, have declared. Declarations by the original software creator should be preferred, if they exist.

Status:

testing

Domain:

Package

Range:

Any of:

• AnyLicenseInfo
• spdx:none
• spdx:noassertion

Property: licenseId

A short name for the license that is at least 3 characters long and made up of the characters from the set 'a'-'z', 'A'-'Z', '0'-'9', '+', '_', '.', and '-'. Formally, all licenseId values must match the regular expression: [-+_.a-zA-Z0-9]{3,}

Status:

testing

Domain:

• License
• ExtractedLicensingInfo

Range:

xsd:string

Property: licenseText

The full text of the license.

Status:

testing

Domain:

License

Range:

xsd:string

Property: licenseInfoFromFiles

Licensing information that was discovered directly in the package. There will be an instance of this property for each distinct value of all licenseInfoInFile properties of all files contained in the package.

Status:

testing

Domain:

Package

Range:

Any of:

• SimpleLicenseInfo
• spdx:none
• spdx:noassertion

Property: licenseInfoInFile

Licensing information that was discovered directly in the subject file.

Status:

testing

Domain:

File

Range:

Any of:

• SimpleLicenseInfo
• spdx:none
• spdx:noassertion

Property: member

A license, or other licensing information, that is a member of the subject license set.

Status:

testing

Domain:

Any of:

• ConjunctiveLicenseSet
• DisjunctiveLicenseSet

Range:

AnyLicenseInfo

Refines:

rdfs:member

Property: name

The full name of the package including version information.

Status:

testing

Domain:

Package

Range:

xsd:string

Property: packageFileName

The base name of the package file name. For example, zlib-1.2.5.tar.gz.

Status:

testing

Domain:

Package

Range:

xsd:string

Property: packageVerificationCode

A manifest based digest (the algorithm is defined in section 4.5 of the full specification) of the package. This allows consumers of this dataset to determine if a package they have in hand is identical to the package from which the data was produced. This algorithm works even if the SPDX document is included in the package. This algorithm is described in detail in the SPDX spec.

Status:

testing

Domain:

Package

Range:

PackageVerificationCode

Property: packageVerificationCodeExcludedFile

A file that was excluded when calculating the package verification code. This is usually be a file containg SPDX data regarding the package. If a package contains more than one SPDX file all SPDX files must be excluded from the package verification code. If this is not done each recalculation of the package verification code in one file will require the other to be recalculated to be valid which will require the original which will require the original file's be recalculated, ad infinitum.

Status:

testing

Domain:

PackageVerificationCode

Range:

xsd:string

Property: packageVerificationCodeValue

The actual package verification code as a hex encoded value.

Status:

testing

Domain:

PackageVerificationCode

Range:

xsd:hexBinary

Property: referencesFile

Indicates that the intellectual property metadata of the value is described in SpdxDocument.

Status:

testing

Domain:

SpdxDocument

Range:

File

Property: reviewDate

The date and time at which the SpdxDocument was reviewed. This value must be in UTC and have 'Z' as its timezone indicator.

Status:

testing

Domain:

Review

Range:

xsd:dateTime

Property: reviewed

The review property relates a SpdxDocument to the review history.

Status:

testing

Domain:

SpdxDocument

Range:

Review

Property: reviewer

The name and, optionally, contact information of the person who performed the review.

Status:

testing

Domain:

Review

Range:

xsd:string

Property: sourceInfo

Allows the producer(s) of the SPDX document to describe how the package was acquired and/or changed from the original source.

Status:

testing

Domain:

Package

Range:

xsd:string

Property: specVersion

Identifies the version of this specification that was used to produce this SPDX document. Currently the only supported value is SPDX-1.0.

Status:

testing

Domain:

SpdxDocument

Range:

xsd:string

Property: summary

Provides a short description of the package.

Status:

testing

Domain:

Package

Range:

xsd:string

Property: versionInfo

Provides an indication of the version of the package that is described by this SpdxDocument.

Status:

testing

Domain:

Package

Range:

xsd:string

Individual: checksumAlgorithm_sha1

Indicates the algorithm used was SHA-1

Status:

testing

Individual: confidentiality_private

Indicates the producer of the SpdxDocument desires the information in the document to be kept seceret.

Status:

testing

Individual: confidentiality_public

Indicates the producer of the SpdxDocument places no restriction on public release of the information contained in the document.

Status:

testing

Individual: fileType_archive

Indicates the file is a archive file.

Status:

testing

Individual: fileType_binary

Indicates the file is not a text file. spdx:filetype_archive is preferred for archive files even though they are binary.

Status:

testing

Individual: fileType_other

Indicates the file is not a source, archive or binary file.

Status:

testing

Individual: fileType_source

Indicates the file is a source code file.

Status:

testing

Individual: noassertion

Indicates that the preparer of the SPDX document is not making any assertion regarding the value of this field.

Status:

testing

Individual: none

When this value is used as the object of a property it indicates that the preparer of the SpdxDocument believes that there is no value for the property. This value should only be used if there is sufficient evidence to support this contention.

Status:

testing