The review property relates a SpdxDocument to the review history.
Each SdpxDocument represents the results of a provenance, ownership and licensing analysis of exactly on software package. This is, effectively, the top level of SPDX information.
SpdxDocument
testing
This specification describes the SPDX language, defined as a dictionary of named properties and classes using W3C's RDF Technology.
SPDX is a designed to allow the exchange of data about software package. This information includes both lists of files contained in the package and the licensing information related to the contained files or the package as a whole.
reviewed
Each Review represents a signoff by an individual on the information in the SpdxDocument.
Review
testing
testing
The full text of the license.
Each License represents a software license. This class is used by the SPDX license repository to represent standard license.
License
testing
licenseText
testing
Indicates the file is not a source, archive or binary file.
fileType_other
testing
Indicates the file is not a text file. spdx:filetype_archive is preferred for archive files even though they are binary.
fileType_binary
testing
Indicates the file is a archive file.
fileType_archive
testing
Indicates the algorithm used was SHA-1
checksumAlgorithm_sha1
testing
Provides a short description of the package.
Each Package represents a piece software that is delivered as a single unit.
Package
testing
summary
testing
Identifies the version of this specification that was used to produce this SPDX document. Currently the only supported value is SPDX-1.0.
specVersion
testing
Allows the producer(s) of the SPDX document to describe how the package was acquired and/or changed from the original source.
sourceInfo
testing
The name and, optionally, contact information of the person who performed the review.
reviewer
testing
Indicates the file is a source code file.
fileType_source
testing
The date and time at which the SpdxDocument was reviewed. This value must be in UTC and have 'Z' as its timezone indicator.
reviewDate
testing
A manifest based hash (the algorithm is defined in section [link goes here]) of the package. This allows consumers of this dataset to determine if a package they have in hand is identical to the package from which the data was produced. This algorithm works even if the SPDX document is included in the package. This algorithm is described in detail in the SPDX spec.
packageVerificationCode
testing
The base name of the package file name. For example, zlib-1.2.5.tar.gz.
packageFileName
testing
The full name of the package including version information.
name
testing
Licensing information that was discovered directly in the subject File.
Each File represents a sequence of octets that is contained in a software package.
File
testing
licenseInfoInFile
The SimpleLicenseInfo class includes all resources that represent simple, atomic, licensing information.
SimpleLicenseInfo
Each ExtractedLicensingInfo represents a license or licensing notice that was found in the package. Any license text that is recognized as a license may be represented as a License rather than and ExtractedLicensingInfo.
ExtractedLicensingInfo
testing
testing
NoneSeen
When this value is used as the object of a property it indicates that the preparer of the SpdxDocument found no information for the property.
noneSeen
testing
Undetermined
When this value is used as the object of a property it indicates that the preparer of the SpdxDocument made no attempt to determine the actual value.
undetermined
testing
testing
When this value is used as the object of a property it indicates that the preparer of the SpdxDocument believes that there is no value for the property. This value should only be used if there is sufficient evidence to support this contention. This is different from spdx:undetermined in that spdx:none indicates some effort was taken to determine the value.
none
testing
Licensing information that was discovered directly in the package. This is effectively a union of the licenseInfoInFile properties of all the files contained in the package.
licenseInfoFromFiles
testing
The licensing that is declared by the authors of the package.
licenseDeclared
The AnyLicenseInfo class includes all resources that represent licensing information.
AnyLicenseInfo
Each ConjunctiveLicenseSet represents set of licenses, or other licensing information, all of which apply.
ConjunctiveLicenseSet
testing
Each DisjunctiveLicenseSet represents set of licenses, or other licensing information, only one of which apply.
DisjunctiveLicenseSet
testing
testing
None
testing
NotAnalyzed
When this value is used as the object of a property it indicates that the preparer of the SpdxDocument made no attempt to determine the actual value.
notAnalyzed
testing
Indicates that a particular file belongs to a package.
hasFile
testing
The type of the file.
fileType
testing
The name of the file relative to the root of the package.
fileName
testing
Verbatim license or licensing notice text that was discovered.
extractedText
testing
The URI at which this package is available for download. Private (ie, not publicly reachable) URIs are acceptable as values of this property.
downloadLocation
testing
Provides a detailed description of the package.
description
testing
The describesPackage property relates an SpdxDocument to the package which it describes.
describesPackage
testing
The name and, optionally, contact information of a person, organization or tool that created, or was used to create, the SpdxDocument.
Each CreationInfo provides information about an individual, organization or tool that was involved in the creation of this SpdxDocument.
CreationInfo
testing
creator
testing
The creationInfo property relates an SpdxDocument to a set of information about the creation of the SpdxDocument.
creationInfo
testing
The date and time at which the SpdxDocument was created. This value must in UTC and have 'Z' as its timezone indicator.
created
testing
The checksumValue property provides a hex encoded digest value produced using a specific algorithm.
Each Checksum is a digest of a file. This digest is produced using a cryptographic hash algorithm which allows the contents of a file to be verified.
Checksum
testing
checksumValue
testing
Indicates the project in which the file originated. Full doap:Project resources are supported. However, some SPDX specific formats can only encode the doap:name and doap:homepage properties. Those formats also encode the doap:Project URI so if the resource is publicly dereferenceable and has an RDF representation the full set of data can pass through those formats. If the URI is not publicly dereferenceable all properties except the name and homepage will be lost in the translation.
artifactOf
testing
Identifies the algorithm used to produce the subject checksum.
algorithm
testing
1
1
1
1
1
1
A short name for the license that is at least 3 characters long and made up of the characters from the set 'a'-'z', 'A'-'Z', '0'-'9', '+', '_', '.', and '-'. Formally, all licenseId values must match the regular expression: [-+_.a-zA-Z0-9]{3,}
licenseId
testing
1
1
A license, or other licensing information, that is a member of the subject license set.
member
testing
1
1
1
The checksum property provides a digest of a File or Package. This allows consumers of the SPDX document to verify that the content of the files or package has not changed.
checksum
testing
1
The text of copyright declarations discovered in the package or file.
copyrightText
testing
1
1
1
1
1
The licensing that the preparer of this SPDX document has concluded, based on the evidence, actual applies to the package.
licenseConcluded
testing
1
The licenseComments property allows the preparer of the SPDX document to describe why the licensing in spdx:licenseConcluded was chosen.
licenseComments
testing
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1
1