THE SPDX WIKI IS NO LONGER ACTIVE. ALL CONTENT HAS BEEN MOVED TO https://github.com/spdx
Technical Team/Use Cases/2.0/Check to see if the SPDX data provided matches the files provided and is trustworthy and most current for package
From SPDX Wiki
< Technical Team | Use Cases/2.0
Revision as of 18:38, 2 October 2012 by Bschineller (Talk | contribs)
- Title: Check to see if the SPDX data provided matches the files provided
- Primary Actor: Downstream consumer of a package
- Goal in Context: Verify that the license obligations for code provided by the upstream supplier matches the licensing information provided by the supplier
- Stakeholders and Interests:
- Upstream Supplier:
- Express the contents of the delivered software and the license obligations in a manner which can be easily verified by the consumer
- Downstream Consumer:
- Verify the files match the description provided
- Verify the origin of the files match
- Verify the license obligations match
- Provide the verified information to further downstream consumers
- Upstream provider provides an SPDX file along with the package
- Main Success Senario:
- Supplier provides package and SPDX file.
- Consumer runs runs file checksums against received files and compares to the SPDX file to validate file origin.
- Consumer compares SPDX author and reviewer information and compares to a "trusted" list of authors. Reviewer and supplier information is confirmed by verifying their signatures. (signing)
- Consumer searches for any later revisions of the SPDX file which may contain corrections.
- Consumer runs independent tools verifying information. If any corrections are required, an updated SPDX file is produced and sent back to the supplier for comment.
- Failed End Condition: No SPDX file provided. No signatures for author and/or reviewers. Internally inconsistent SPDX file.
- Delivery of a software package
- Notes: The scenerio could work without an initial SPDX file if all of the information is provided in a different format. In this scenario, an SPDX file would be created as an output and the input pre-conditions would be essentially all of the required fields of the SPDX document.