This specification describes the SPDX language, defined as a dictionary of named properties and classes using W3C's RDF Technology.
SPDX is a designed to allow the exchange of data about software package. This information includes both lists of files contained in the package and the licensing information related to the contained files or the package as a whole.
Each SdpxDocument represents the results of an analysis of a software package. This is, effectively, the top level of SPDX information.
specVersion
Cardinality: Mandatory, one
creationInfo
Cardinality: Mandatory, one or more
reviewed
Cardinality: Optional, zero or more.
describesPackage
Cardinality: Mandatory, one
An SpdxDocument provides information for only one package.
Each Package represents a piece software that is delivered as a single unit.
name
Cardinality: Mandatory, one
summary
Cardinality: Mandatory, one
description
Cardinality: Mandatory, one
packageFileName
Cardinality: Mandatory, one
downloadLocation
Cardinality: Optional, zero or one
checksum
Cardinality: Optional, zero or one
packageVerificationCode
Cardinality: Mandatory, one
sourceInfo
Cardinality: Optional, zero or one
copyrightText
Cardinality: Optional, zero or one
licenseComments
Cardinality: Optional, zero or one
licenseDeclared
Cardinality: Optional, zero or one
licenseConcluded
Cardinality: Optional, zero or one
licenseInfoFromFiles
Cardinality: Optional, zero or more.
hasFile
Cardinality: Mandatory, one or more
Each File represents a sequence of octets that is contained in a software package.
fileName
Cardinality: Mandatory, one
fileType
Cardinality: Mandatory, one
copyrightText
Cardinality: Optional, zero or one
licenseComments
Cardinality: Optional, zero or one
licenseConcluded
Cardinality: Optional, zero or one
licenseInfoInFile
Cardinality: Optional, zero or more
checksum
Cardinality: Mandatory, one
artifactOf
Cardinality: Optional, zero or one
Each License represents a software license. This class is used by the SPDX license repository to represent standard license.
licenseID
Cardinality: Mandatory, one
licenseText
Cardinality: Mandatory, one
Each Checksum is a digest of a file. This digest is produced using a cryptographic hash algorithm which allows the contents of a file to be verified.
algorithm
Cardinality: Mandatory, one
checksumValue
Cardinality: Mandatory, one
Each CreationInfo provides information about an individual, organization or tool that was involved in the creation of this SpdxDocument.
creator
Cardinality: Mandatory, one
created
Cardinality: Mandatory, one
rdfs:comment
Cardinality: Mandatory, one
Each Review represents a signoff by an individual on the information in the SpdxDocument.
reviewer
Cardinality: Mandatory, one
reviewDate
Cardinality: Mandatory, one
rdfs:comment
Cardinality: Mandatory, one
Each ExtractedLicensingInfo represents a license or licensing notice that was found in the package. Any license text that is recognized as a license may be represented as a License rather than and ExtractedLicensingInfo.
licenseID
Cardinality: Mandatory, one
extractedText
Cardinality: Mandatory, one
Each ConjunctiveLicenseSet represents set of licenses, or other licensing information, all of which apply.
Refines rdfs:Container.
member
Cardinality: Mandatory, one or more.
Each DisjunctiveLicenseSet represents set of licenses, or other licensing information, only one of which apply.
Refines rdfs:Container.
member
Cardinality: Mandatory, one or more.
Identifies the algorithm used to produce a checksum.
Currently, SHA-1 is the only supported algorithm. It is anticpated that other algorithms will be supported at a later time"
http://spdx.org/rdf/terms#checksumAlgorithm_sha1
Indicates the project in which the file originated.
The checksum property provides a digest of a File or File. This allows consumers of the SPDX document to verify that the content of the files or package has not changed.
The checksumValue property provides a digest value produced using a specific algorithm.
The date and time at which the SpdxDocument was created.
The text of copyright declarations discovered in the package of file.
The creationInfo property relates an SpdxDocument to a set of information about the creation of the SpdxDocument.
The name and, optionally, contact information of a person, organization or tool that created, or was used to create, the SpdxDocument.
The describesPackage property relates an SpdxDocument to the package which it describes.
Provides a detailed description of the package.
The URI at which this package is available for download. Private (ie, not publicly reachable) URIs are acceptable as values of this property.
Verbatim license or licensing notice text that was discovered.
The name of the file relative to the root of the package.
The type of the file.
http://spdx.org/rdf/terms#fileType_source
Indicates the file is a source code file.
http://spdx.org/rdf/terms#fileType_archive
Indicates the file is an archive file.
http://spdx.org/rdf/terms#fileType_binary
Indicates the file is not a text file. filetype_archive is preferred for archive files even though they are binary.
http://spdx.org/rdf/terms#fileType_other
Indicates the file did not fall into any of the other categories.
The licenseComments property provides a for the preparer of the SPDX document to describe why the license concluded was chosen.
The licensing that the preparer of this SPDX document has concluded, based on the evidence, actual applies to the package.
http://spdx.org/rdf/terms#none
The none value is used to indicate the preparer of the SPDX document believes this package or file is not licensed at all. If no attempt was made to determine the actually licensing of the package or file this property should be omitted entirely.
The licensing that is declared by the authors of the package.
http://spdx.org/rdf/terms#none
The none value is used to indicate that the package does not declared license. An attempt should be made to determine the package's declared licensing when using this value.
A short name for the license that is made up of ascii characters from the set 'a'-'z', 'A'-'Z', '0'-'9', '+', '_', '.', and '-'.
The full text of the license.
Licensing information that was discovered directly in the package. This is effectively a union of the licenseInfoInFile properties of all the files contained in the package.
http://spdx.org/rdf/terms#none
The none value is used to indicate that all files in the package appear to be devoid of licensing information. If no attempt was made to find licensing information this property should be omitted entirely.
Licensing information that was discovered directly in the subject File.
http://spdx.org/rdf/terms#none
The none value is used to indicate that the file appears to be devoid of licensing information. If no attempt was made to find licensing information this property should be omitted entirely.
A license, or other licensing information, that is a member of the subject license set.
The full name of the package including version information.
The base name of the package filename. This will often included the package name, version information and archive/compression method. For example, zlib-1.2.5.tar.gz.
A manifest based hash of the package. This allows consumers of this dataset to determin if a package they have in hand is identical to the package from which the data was produced. This algorithm works even if the SPDX document is included in the package. This algorithm is described in detail in the SPDX spec.
The date and time at which the SpdxDocument was reviewed.
The review property relates a SpdxDocument to the review history.
The name and, optionally, contact information of the person who performed the review.
Allows the producer(s) of the SPDX document to describe how the package was acquired and/or changed from the original source.
Identifies the version of this specification that was used to produce this SPDX document.
Provides a short description of the package.
An xsd:dateTime where the timezone is UTC and the timezone indicator is set to 'Z'.
A shorten name/identifier for a license suitable for use in URIs. License slugs are xsd:strings that match the following regular expression: [-+_.a-zA-Z0-9]+