Shane Coughlan is an expert in communication, security and business development. His professional accomplishments include spearheading the licensing team that elevated Open Invention Network into the largest patent non-aggression community in history, establishing the leading professional network of Open Source legal experts and aligning stakeholders to launch both the first law journal and the first law book dedicated to Open Source.
Shane has extensive knowledge of Open Source governance, internal process development, supply chain management and community building. His experience includes engagement with the enterprise, embedded, mobile and automotive industries.
The OSS Review Toolkit (ORT) is a FOSS policy automation and orchestration toolkit that you can use to manage your (open source) software dependencies in a strategic, safe and efficient manner. This webinar digs into how the Erlang Ecosystem Foundation (EFF) makes use of this tool to address compliance issues.
Watch the Webinar:
This is part of the OpenChain and Friends: Stuttgart – Follow-Up Webinar Series:
Once upon a time, researchers at Ericsson developed Erlang/OTP, a programming language for the telecom industry. 39 years later, Erlang/OTP is used by the telecom, messaging, banking, and even game industry. Not only that, new languages were created and run on top of the Erlang BEAM virtual machine: Elixir, now a well-established language, and Gleam, the newest addition.
The proliferation of libraries and languages powering the BEAM ecosystem led to the creation of the Erlang Ecosystem Foundation (EFF),a foundation that caters for the BEAM ecosystem.
Today, 39 years from the creation of Erlang, it is not an easy task to categorise and be compliant with the more than 13000 (total) files that make up Erlang, Elixir, and Gleam. Yet, Erlang and Elixir are OpenChain compliant, and Gleam compliance is work in progress.
What steps took EEF towards making sure that Erlang, Elixir, and Gleam comply with the different licenses and copyrights?
This presentation features the collaboration between the Erlang/OTP team (Ericsson) and the Erlang Ecosystem Foundation (EEF), and the steps taken, and experience of using ORT as a crucial part of the EEF Ecosystem.
Our Speaker:
My name is Kiko Fernandez-Reyes and I work as a software engineer in the OTP team, building and improving the Erlang programming language at Ericsson. Before that, I was a backend software engineer at Klarna.
Before Klarna, (in 2014) I did my Ph.D. at Uppsala University where I developed concurrent and parallel programming languages for our research compiler. Among them, I developed typed-based optimisations for future-based programming languages and a capability-based dynamic language design that maintains data-race freedom and satisfies the gradual guarantee.
Experience: I have industrial experience with Haskell, Erlang, Python, among others and deployment languages and technologies, ranging from AWS to Ansible. During my research I have used heavily Haskell and C, and some Scala. I was the main lecturer of the course Advanced Software Design, where I taught object-oriented design ~80 master students.
My work has received the following awards: – Distinguished Artifact Award at Software Language Engineering (SLE), 2019 – Distinguished Artifact Award at European Conference in Object-oriented Programming (ECOOP), 2019 – Best Paper Award at International Federated Conference on Distributed Computing Techniques (DisCoTec), 2018 – Best Paper Award at International Conference on Coordination Models and Languages (COORDINATION), 2018
Interests: I am interested in type systems, programming languages, functional programming, compilers, and different logics. I promote open source technology, writing regularly in opensource.com. I also promote gender equality through the ACM-W student chapter at Uppsala University.
More About Our Webinars:
This event is part of the overarching OpenChain Project Webinar Series. Our series highlights knowledge from throughout the global OpenChain eco-system. Participants are discussing approaches, processes and activities from their experience, providing a free service to increase shared knowledge in the supply chain. Our goal, as always, is to increase trust and therefore efficiency. No registration or costs involved. This is user companies producing great informative content for their peers.
The OpenChain Project will have a keynote and also host an OpenChain China Day at the forthcoming OSPO Summit China on the 12th of June 2025. A big thanks to the organizers of the OSPO Summit and also to our community members, especially the leading contributors to the OpenChain China Work Group.
Thank you for helping to share knowledge and to bring people together!
The 3rd OSHeart Legal Salon took place on the 24th of May 2025, and OpenChain was explained by Zhenhua Sun, Chair of the OpenChain China Work Group and leader of the ByteDance open source team. We were delighted to work together with our colleagues from OpenAtom Foundation and elsewhere in sharing more knowledge about the international standards for open source business process management.
Reflections on our lessons learned in making ISO 18974, and our process of drafting proposed updates to the standards, to try and provide a template for other projects looking at making and maintaining standards.
Education:
A review of the updated Reference Library, updated open source policy template and drafting underway for a new OpenChain Adoption Guide + discussion about and call for engagement with updates to our online training.
The OSS Review Toolkit (ORT) is a FOSS policy automation and orchestration toolkit that you can use to manage your (open source) software dependencies in a strategic, safe and efficient manner. The next OpenChain webinar will dig into how the Erlang Ecosystem Foundation (EFF) makes use of this tool to address compliance issues.
2025-05-27 @ 08:00 UTC / 09:00 BST / 10:00 CEST / 16:00 CST / 17:00 KST + JST
Once upon a time, researchers at Ericsson developed Erlang/OTP, a programming language for the telecom industry. 39 years later, Erlang/OTP is used by the telecom, messaging, banking, and even game industry. Not only that, new languages were created and run on top of the Erlang BEAM virtual machine: Elixir, now a well-established language, and Gleam, the newest addition.
The proliferation of libraries and languages powering the BEAM ecosystem led to the creation of the Erlang Ecosystem Foundation (EFF),a foundation that caters for the BEAM ecosystem.
Today, 39 years from the creation of Erlang, it is not an easy task to categorise and be compliant with the more than 13000 (total) files that make up Erlang, Elixir, and Gleam. Yet, Erlang and Elixir are OpenChain compliant, and Gleam compliance is work in progress.
What steps took EEF towards making sure that Erlang, Elixir, and Gleam comply with the different licenses and copyrights?
This presentation features the collaboration between the Erlang/OTP team (Ericsson) and the Erlang Ecosystem Foundation (EEF), and the steps taken, and experience of using ORT as a crucial part of the EEF Ecosystem.
Our Speaker:
My name is Kiko Fernandez-Reyes and I work as a software engineer in the OTP team, building and improving the Erlang programming language at Ericsson. Before that, I was a backend software engineer at Klarna.
Before Klarna, (in 2014) I did my Ph.D. at Uppsala University where I developed concurrent and parallel programming languages for our research compiler. Among them, I developed typed-based optimisations for future-based programming languages and a capability-based dynamic language design that maintains data-race freedom and satisfies the gradual guarantee.
Experience: I have industrial experience with Haskell, Erlang, Python, among others and deployment languages and technologies, ranging from AWS to Ansible. During my research I have used heavily Haskell and C, and some Scala. I was the main lecturer of the course Advanced Software Design, where I taught object-oriented design ~80 master students.
My work has received the following awards: – Distinguished Artifact Award at Software Language Engineering (SLE), 2019 – Distinguished Artifact Award at European Conference in Object-oriented Programming (ECOOP), 2019 – Best Paper Award at International Federated Conference on Distributed Computing Techniques (DisCoTec), 2018 – Best Paper Award at International Conference on Coordination Models and Languages (COORDINATION), 2018
Interests: I am interested in type systems, programming languages, functional programming, compilers, and different logics. I promote open source technology, writing regularly in opensource.com. I also promote gender equality through the ACM-W student chapter at Uppsala University.
More About Our Webinars:
This event is part of the overarching OpenChain Project Webinar Series. Our series highlights knowledge from throughout the global OpenChain eco-system. Participants are discussing approaches, processes and activities from their experience, providing a free service to increase shared knowledge in the supply chain. Our goal, as always, is to increase trust and therefore efficiency. No registration or costs involved. This is user companies producing great informative content for their peers.
The OpenChain Project will hold a webinar on the 30th of May 2025 to discuss LLM generated code and the potential risks associated with it from the perspective of open source license compliance.
2025-05-30 @ 07:00 UTC / 08:00 BST / 09:00 CEST / 15:00 CST / 16:00 KST + JST
Oscar Goñi (Quique) has investigated source code similarity detection in Large Language Model (LLM) out-puts using the SCANOSS platform. While recent research has identified concerns regarding LLMs generating code that closely resembles their training data, the full extent of this similarity across the broader open-source ecosystem remained unexplored. Quique will describe during this talk his findings, which indicate that code similarity in LLM outputs may be more prevalent than previously indicated when evaluated against a broader open-source code base. At the same time, Quique will describe how this study contributes to the ongoing discussion of LLM-generated code’s originality and its implications for software licensing compliance, while validating the effectiveness of lightweight similarity detection algorithms as preliminary indicators for more comprehensive analysis. Finally, a Q&A session hopefully will provide participants some light of the implications of the study and to Quique about next steps in his research.
Oscar Enrique (Quique) Goñi, UNICEN, Professor – STF Head of academic program
Oscar Enrique Goñi is a systems engineer who graduated from the National University of the Center of the Province of Buenos Aires, Faculty of Exact Sciences (Argentina, 2009), and holds a Ph.D. in Computer Science from the National University of La Plata (Argentina, 2015). Since 2004, he has been engaged in teaching and research activities at the National University of the Center of the Province of Buenos Aires. Additionally, he has led the design and management of critical systems projects, as well as in data mining and high-performance systems.
In May, the OpenChain Project was invited to present the OpenChain Telco SBOM Guide at the Cybersecurity and Infrastructure Security Agency (CISA) SBOM Community Weekly Meeting. Jimmy Ahlberg (OpenChain Governing Board Chair + Ericsson) and Marc-Etienne Vargenau (OpenChain Telco Work Group Chair + Nokia) attended to share our work and goals.
The audience consisted of representatives from industry and government, and we had a lively discussion about how the OpenChain Telco SBOM Guide is designed to solve real-world challenges around SBOM quality.
We look forward to further collaboration with Allan Friedman and the rest of the team at CISA.
Be Part Of Our Work:
If you are interested in being part of our work around Software Bill of Materials, you are invited to join our work groups and study groups covering the topics.
The OpenChain Project will host a mini-summit to explore how standards and process management are driving the next phase of sustainable, efficient open source use in organizations. We will discuss emerging trends or concerns in areas like AI and SBOM quality, and we will also discuss the future development of our existing standards (ISO/IEC 5230 for license compliance and ISO/IEC 18974 for security assurance). Attendees will come away with increased knowledge of OpenChain activities, more generally of open source business process management, and with the ability to apply that learning to their own companies and projects.
Agenda:
Current Compliance
OpenChain Standards for Process Management and Risk Reduction
Industry Specific and Cross-Industry SBOM Quality Management
Understand Automation – Open Source Tools for Open Source Compliance
Future Compliance
AI BOM Compliance in the Supply Chain
Mitigating Risk for Securing Information in a Post Quantum Computing (PQC) World
This key contributor of this work is David (Dongwei) Liu. David is a Research and Development (R&D) Engineer in ByteDance with a focus on Open Source and Software Supply Chain Security and Compliance. His personal interests include 3D Printing Technology (including the making 3D Printing Machines). He can be found on GitHub at https://github.com/ammend
In the specification of OpenChain Telco SBOM Guide, we say ‘An OpenChain Telco SBOM Guide compatible document SHALL adhere to the version 2.2 of the SPDX Data Format as standardized in ISO/IEC 5962:2021, or to the version 2.3 of the standard’. By 2024-08-05, v2.2, v2.2.1, v2.2.2 and v2.3 have been released in github website. We choose v2.2.2 and v2.3 as origin json schema implementation.
The difference between SPDX 2.2 and SPDX 2.3 is that SPDX 2.3 requires less license info. For example, you can see concluded license field in SPDX 2.2 link and in SPDX 2.3 link.
In the directory internal, you can see four files about SPDX JSON schema.
The term ‘fix’ means something has been fixed from the origin files. Why should we do it? There are three main reasons.
Firstly, doing a bugfix works. The SPDX github project link is rapidly developing. Unfortunately, official JSON schema implementations in the SPDX GitHub are not consistent with official SPDX specifications. To confirm this, a json_schema_compare.py script is developed. The comparison between SPDX v2.2.2 origin and the fixed one can be shown below:
In SPDX 2.2.2 specifications, name field in snippets in not mandatory, while in SPDX 2.2.2 json schema implementation is mandatory. And field documentNamespace, field checksums in files, field licenseInfoInFiles in files and field ranges in snippets is mandatory in SPDX 2.2.2 specifications, while not mandatory in JSON schema implementation. It is the same to SPDX 2.3 version. The bugfixes for SPDX have been pulled request to official GitHub project.
Secondly, it is impossible to reuse SPDX 2.2.2/2.3 JSON schema implementation in the OpenChain Telco SBOM Guide because declarations of "additionalProperties": false exist in it, which means you cannot extend any other field. So the fix one will omit this declaration to extend more fields.
Thirdly, arrange order of fields in implementation according to order of fields in official specifications to make implementation more human-readable. In origin json schema implementation of SPDX, orders of fields are in a messy.
SPDX 2.3 add four fields that are all not mandatory in comparison with SPDX 2.2 and require less license info mandatory fields. This means if it meets SPDX 2.2, it will meet SPDX 2.3. So we choose SPDX 2.3 as a base implementation of OpenChain Telco SBOM Guide. Then we add the MUST field in the OpenChain Telco SBOM Guide as shown below:
The difference between the OpenChain Telco SBOM Guide and SPDX 2.3 is shown below:
The field comment in field createInfo in declared as mandatory.
The field copyrightText, licenseConcluded, licenseDeclared, supplier, versionInfo in field packages is declared as mandatory.
add descriptions into some fields json schema.
Revise $id and title.
The Full Schema:
A warning in advance that this is included for completeness, but you may wish to view it on GitHub.
Preformatted Text Below:
{ "$schema": "http://json-schema.org/draft-07/schema#", "$id": "https://github.com/OpenChain-Project/Telco-WG", "title": "Open Chain Telco Guide 1.0", "type": "object", "required": [ "spdxVersion", "dataLicense", "SPDXID", "name", "documentNamespace", "creationInfo" ], "properties": { "spdxVersion": { "description": "Provide a reference number that can be used to understand how to parse and interpret the rest of the file. It will enable both future changes to the specification and to support backward compatibility. The version number consists of a major and minor version indicator. The major field will be incremented when incompatible changes between versions are made (one or more sections are created, modified or deleted). The minor field will be incremented when backwards compatible changes are made.", "type": "string" }, "dataLicense": { "description": "License expression for dataLicense. Compliance with the SPDX specification includes populating the SPDX fields therein with data related to such fields (\"SPDX-Metadata\"). The SPDX specification contains numerous fields where an SPDX document creator may provide relevant explanatory text in SPDX-Metadata. Without opining on the lawfulness of \"database rights\" (in jurisdictions where applicable), such explanatory text is copyrightable subject matter in most Berne Convention countries. By using the SPDX specification, or any portion hereof, you hereby agree that any copyright rights (as determined by your jurisdiction) in any SPDX-Metadata, including without limitation explanatory text, shall be subject to the terms of the Creative Commons CC0 1.0 Universal license. For SPDX-Metadata not containing any copyright rights, you hereby agree and acknowledge that the SPDX-Metadata is provided to you \"as-is\" and without any representations or warranties of any kind concerning the SPDX-Metadata, express, implied, statutory or otherwise, including without limitation warranties of title, merchantability, fitness for a particular purpose, non-infringement, or the absence of latent or other defects, accuracy, or the presence or absence of errors, whether or not discoverable, all to the greatest extent permissible under applicable law.", "type": "string" }, "SPDXID": { "type": "string", "description": "Uniquely identify any element in an SPDX document which may be referenced by other elements." }, "name": { "description": "Identify name of this SpdxElement.", "type": "string" }, "documentNamespace": { "type": "string", "description": "The URI provides an unambiguous mechanism for other SPDX documents to reference SPDX elements within this SPDX document." }, "documentDescribes": { "description": "Packages, files and/or Snippets described by this SPDX document", "type": "array", "items": { "type": "string" } }, "externalDocumentRefs": { "description": "Identify any external SPDX documents referenced within this SPDX document.", "type": "array", "items": { "type": "object", "required": [ "externalDocumentId", "checksum", "spdxDocument" ], "properties": { "externalDocumentId": { "description": "externalDocumentId is a string containing letters, numbers, ., - and/or + which uniquely identifies an external document within this document.", "type": "string" }, "checksum": { "type": "object", "required": [ "algorithm", "checksumValue" ], "properties": { "algorithm": { "description": "Identifies the algorithm used to produce the subject Checksum. Currently, SHA-1 is the only supported algorithm. It is anticipated that other algorithms will be supported at a later time.", "type": "string", "enum": [ "SHA256", "SHA1", "SHA384", "MD2", "MD4", "SHA512", "MD6", "MD5", "SHA224" ] }, "checksumValue": { "description": "The checksumValue property provides a lower case hexidecimal encoded digest value produced using a specific algorithm.", "type": "string" } }, "description": "A Checksum is value that allows the contents of a file to be authenticated. Even small changes to the content of the file will change its checksum. This class allows the results of a variety of checksum and cryptographic message digest algorithms to be represented." }, "spdxDocument": { "description": "SPDX ID for SpdxDocument. A propoerty containing an SPDX document.", "type": "string" } }, "description": "Information about an external SPDX document reference including the checksum. This allows for verification of the external references." } }, "creationInfo": { "type": "object", "required": [ "creators", "created", "comment" ], "properties": { "licenseListVersion": { "description": "An optional field for creators of the SPDX file to provide the version of the SPDX License List used when the SPDX file was created.", "type": "string" }, "creators": { "description": "Identify who (or what, in the case of a tool) created the SPDX file. If the SPDX file was created by an individual, indicate the person's name. If the SPDX file was created on behalf of a company or organization, indicate the entity name. If the SPDX file was created using a software tool, indicate the name and version for that tool. If multiple participants or tools were involved, use multiple instances of this field. Person name or organization name may be designated as “anonymous” if appropriate.", "type": "array", "items": { "description": "Identify who (or what, in the case of a tool) created the SPDX file. If the SPDX file was created by an individual, indicate the person's name. If the SPDX file was created on behalf of a company or organization, indicate the entity name. If the SPDX file was created using a software tool, indicate the name and version for that tool. If multiple participants or tools were involved, use multiple instances of this field. Person name or organization name may be designated as “anonymous” if appropriate.", "type": "string" }, "minItems": 2 }, "created": { "description": "Identify when the SPDX file was originally created. The date is to be specified according to combined date and time in UTC format as specified in ISO 8601 standard. This field is distinct from the fields in section 8, which involves the addition of information during a subsequent review.", "type": "string" }, "comment": { "type": "string", "description": "Mandatory. MUST provide SBOM Type as defined by CISA in the field." } }, "description": "One instance is required for each SPDX file produced. It provides the necessary information for forward and backward compatibility for processing tools." }, "comment": { "type": "string", "description": "an optional field for creators of the SPDX file content to provide comments to the consumers of the SPDX document." }, "packages": { "description": "Packages referenced in the SPDX document", "type": "array", "items": { "type": "object", "required": [ "name", "SPDXID", "versionInfo", "downloadLocation", "licenseConcluded", "licenseDeclared", "copyrightText", "supplier" ], "properties": { "name": { "description": "Identify name of this SpdxElement.", "type": "string" }, "SPDXID": { "type": "string", "description": "Uniquely identify any element in an SPDX document which may be referenced by other elements." }, "versionInfo": { "description": "Provides an indication of the version of the package that is described by this SpdxDocument. Telco Guide required mandatory.", "type": "string" }, "packageFileName": { "description": "The base name of the package file name. For example, zlib-1.2.5.tar.gz.", "type": "string" }, "supplier": { "description": "The name and, optionally, contact information of the person or organization who was the immediate supplier of this package to the recipient. The supplier may be different than originator when the software has been repackaged. Values of this property must conform to the agent and tool syntax.", "type": "string" }, "originator": { "description": "The name and, optionally, contact information of the person or organization that originally created the package. Values of this property must conform to the agent and tool syntax.", "type": "string" }, "downloadLocation": { "description": "The URI at which this package is available for download. Private (i.e., not publicly reachable) URIs are acceptable as values of this property. The values http://spdx.org/rdf/terms#none and http://spdx.org/rdf/terms#noassertion may be used to specify that the package is not downloadable or that no attempt was made to determine its download location, respectively.", "type": "string" }, "filesAnalyzed": { "description": "Indicates whether the file content of this package has been available for or subjected to analysis when creating the SPDX document. If false indicates packages that represent metadata or URI references to a project, product, artifact, distribution or a component. If set to false, the package must not contain any files.", "type": "boolean" }, "packageVerificationCode": { "type": "object", "required": [ "packageVerificationCodeValue" ], "properties": { "packageVerificationCodeValue": { "description": "The actual package verification code as a hex encoded value. Use sha1 algorithm", "type": "string" }, "packageVerificationCodeExcludedFiles": { "description": "A file that was excluded when calculating the package verification code. This is usually a file containing SPDX data regarding the package. If a package contains more than one SPDX file all SPDX files must be excluded from the package verification code. If this is not done it would be impossible to correctly calculate the verification codes in both files.", "type": "array", "items": { "description": "A file that was excluded when calculating the package verification code. This is usually a file containing SPDX data regarding the package. If a package contains more than one SPDX file all SPDX files must be excluded from the package verification code. If this is not done it would be impossible to correctly calculate the verification codes in both files.", "type": "string" } } }, "description": "A manifest based verification code (the algorithm is defined in section 4.7 of the full specification) of the SPDX Item. This allows consumers of this data and/or database to determine if an SPDX item they have in hand is identical to the SPDX item from which the data was produced. This algorithm works even if the SPDX document is included in the SPDX item." }, "checksums": { "description": "The checksum property provides a mechanism that can be used to verify that the contents of a File or Package have not changed.", "type": "array", "items": { "type": "object", "required": [ "algorithm", "checksumValue" ], "properties": { "algorithm": { "description": "Identifies the algorithm used to produce the subject Checksum. Currently, SHA-1 is the only supported algorithm. It is anticipated that other algorithms will be supported at a later time.", "type": "string", "enum": [ "SHA256", "SHA1", "SHA384", "MD2", "MD4", "SHA512", "MD6", "MD5", "SHA224" ] }, "checksumValue": { "description": "The checksumValue property provides a lower case hexidecimal encoded digest value produced using a specific algorithm.", "type": "string" } }, "description": "A Checksum is value that allows the contents of a file to be authenticated. Even small changes to the content of the file will change its checksum. This class allows the results of a variety of checksum and cryptographic message digest algorithms to be represented." } }, "homepage": { "type": "string" }, "sourceInfo": { "description": "Allows the producer(s) of the SPDX document to describe how the package was acquired and/or changed from the original source.", "type": "string" }, "licenseConcluded": { "description": "Telco Guide required mandatory. License expression for licenseConcluded. See SPDX Annex D for the license expression syntax. The licensing that the preparer of this SPDX document has concluded, based on the evidence, actually applies to the SPDX Item.\n\nIf the licenseConcluded field is not present for an SPDX Item, it implies an equivalent meaning to NOASSERTION.", "type": "string" }, "licenseInfoFromFiles": { "description": "The licensing information that was discovered directly within the package. There will be an instance of this property for each distinct value of alllicenseInfoInFile properties of all files contained in the package.", "type": "array", "items": { "description": "License expression for licenseInfoFromFiles. The licensing information that was discovered directly within the package. There will be an instance of this property for each distinct value of alllicenseInfoInFile properties of all files contained in the package.", "type": "string" } }, "licenseDeclared": { "description": "Telco Guide required mandatory. License expression for licenseDeclared. See SPDX Annex D for the license expression syntax. The licensing that the creators of the software in the package, or the packager, have declared. Declarations by the original software creator should be preferred, if they exist.", "type": "string" }, "licenseComments": { "description": "The licenseComments property allows the preparer of the SPDX document to describe why the licensing in spdx:licenseConcluded was chosen.", "type": "string" }, "copyrightText": { "description": "Telco Guide required mandatory. The text of copyright declarations recited in the Package or File.", "type": "string" }, "summary": { "description": "Provides a short description of the package.", "type": "string" }, "description": { "description": "Provides a detailed description of the package.", "type": "string" }, "comment": { "type": "string" }, "externalRefs": { "description": "An External Reference allows a Package to reference an external source of additional information, metadata, enumerations, asset identifiers, or downloadable content believed to be relevant to the Package. A package SHOULD be identified by a Package URL (PURL). The PURL SHOULD be put in ExternalRef field", "type": "array", "items": { "type": "object", "required": [ "referenceCategory", "referenceType", "referenceLocator" ], "properties": { "referenceCategory": { "description": "Category for the external reference", "type": "string", "enum": [ "OTHER", "SECURITY", "PACKAGE_MANAGER" ] }, "referenceType": { "description": "Type of the external reference. These are definined in an appendix in the SPDX specification.", "type": "string" }, "referenceLocator": { "description": "The unique string with no spaces necessary to access the package-specific information, metadata, or content within the target location. The format of the locator is subject to constraints defined by the <type>.", "type": "string" }, "comment": { "type": "string" } }, "description": "An External Reference allows a Package to reference an external source of additional information, metadata, enumerations, asset identifiers, or downloadable content believed to be relevant to the Package." } }, "attributionTexts": { "description": "This field provides a place for the SPDX data creator to record acknowledgements that may be required to be communicated in some contexts. This is not meant to include theactual complete license text (see licenseConculded and licenseDeclared), and may or may not include copyright notices (see also copyrightText). The SPDX data creator may use this field to record other acknowledgements, such as particular clauses from license texts, which may be necessary or desirable to reproduce.", "type": "array", "items": { "description": "This field provides a place for the SPDX data creator to record acknowledgements that may be required to be communicated in some contexts. This is not meant to include theactual complete license text (see licenseConculded and licenseDeclared), and may or may not include copyright notices (see also copyrightText). The SPDX data creator may use this field to record other acknowledgements, such as particular clauses from license texts, which may be necessary or desirable to reproduce.", "type": "string" } }, "primaryPackagePurpose": { "description": "This field provides information about the primary purpose of the identified package. Package Purpose is intrinsic to how the package is being used rather than the content of the package.", "type": "string", "enum": [ "OTHER", "INSTALL", "ARCHIVE", "FIRMWARE", "APPLICATION", "FRAMEWORK", "LIBRARY", "CONTAINER", "SOURCE", "DEVICE", "OPERATING_SYSTEM", "FILE" ] }, "releaseDate": { "description": "This field provides a place for recording the date the package was released.", "type": "string" }, "builtDate": { "description": "This field provides a place for recording the actual date the package was built.", "type": "string" }, "validUntilDate": { "description": "This field provides a place for recording the end of the support period for a package from the supplier.", "type": "string" }, "annotations": { "description": "Provide additional information about an SpdxElement.", "type": "array", "items": { "type": "object", "required": [ "annotationDate", "comment", "annotator", "annotationType" ], "properties": { "annotationDate": { "description": "Identify when the comment was made. This is to be specified according to the combined date and time in the UTC format, as specified in the ISO 8601 standard.", "type": "string" }, "comment": { "type": "string" }, "annotator": { "description": "This field identifies the person, organization or tool that has commented on a file, package, or the entire document.", "type": "string" }, "annotationType": { "description": "Type of the annotation.", "type": "string", "enum": [ "OTHER", "REVIEW" ] } }, "description": "An Annotation is a comment on an SpdxItem by an agent." } }, "hasFiles": { "description": "Indicates that a particular file belongs to a package.", "type": "array", "items": { "description": "SPDX ID for File. Indicates that a particular file belongs to a package.", "type": "string" } } } } }, "files": { "description": "Files referenced in the SPDX document", "type": "array", "items": { "type": "object", "required": [ "fileName", "SPDXID", "checksums" ], "properties": { "fileName": { "description": "The name of the file relative to the root of the package.", "type": "string" }, "SPDXID": { "type": "string", "description": "Uniquely identify any element in an SPDX document which may be referenced by other elements." }, "fileTypes": { "description": "The type of the file.", "type": "array", "items": { "description": "The type of the file.", "type": "string", "enum": [ "OTHER", "DOCUMENTATION", "IMAGE", "VIDEO", "ARCHIVE", "SPDX", "APPLICATION", "SOURCE", "BINARY", "TEXT", "AUDIO" ] } }, "checksums": { "description": "The checksum property provides a mechanism that can be used to verify that the contents of a File or Package have not changed.", "type": "array", "items": { "type": "object", "required": [ "algorithm", "checksumValue" ], "properties": { "algorithm": { "description": "Identifies the algorithm used to produce the subject Checksum. Currently, SHA-1 is the only supported algorithm. It is anticipated that other algorithms will be supported at a later time.", "type": "string", "enum": [ "SHA256", "SHA1", "SHA384", "MD2", "MD4", "SHA512", "MD6", "MD5", "SHA224" ] }, "checksumValue": { "description": "The checksumValue property provides a lower case hexidecimal encoded digest value produced using a specific algorithm.", "type": "string" } }, "description": "A Checksum is value that allows the contents of a file to be authenticated. Even small changes to the content of the file will change its checksum. This class allows the results of a variety of checksum and cryptographic message digest algorithms to be represented." }, "minItems": 1 }, "licenseConcluded": { "description": "License expression for licenseConcluded. See SPDX Annex D for the license expression syntax. The licensing that the preparer of this SPDX document has concluded, based on the evidence, actually applies to the SPDX Item.\n\nIf the licenseConcluded field is not present for an SPDX Item, it implies an equivalent meaning to NOASSERTION.", "type": "string" }, "licenseInfoInFiles": { "description": "Licensing information that was discovered directly in the subject file. This is also considered a declared license for the file.", "type": "array", "items": { "description": "License expression for licenseInfoInFile. Licensing information that was discovered directly in the subject file. This is also considered a declared license for the file.", "type": "string" }, "minItems": 1 }, "licenseComments": { "description": "The licenseComments property allows the preparer of the SPDX document to describe why the licensing in spdx:licenseConcluded was chosen.", "type": "string" }, "copyrightText": { "description": "The text of copyright declarations recited in the Package or File.", "type": "string" }, "artifactOfs": { "description": "Deprecated. Indicates the project in which the SpdxElement originated. Tools must preserve doap:homepage and doap:name properties and the URI (if one is known) of doap:Project resources that are values of this property. All other properties of doap:Projects are not directly supported by SPDX and may be dropped when translating to or from some SPDX formats.", "type": "array", "items": { "type": "object", "properties": {} } }, "comment": { "description": "This field provides a place for the SPDX file creator to record any general comments about the file.", "type": "string" }, "noticeText": { "description": "This field provides a place for the SPDX file creator to record potential legal notices found in the file. This may or may not include copyright statements.", "type": "string" }, "fileContributors": { "description": "This field provides a place for the SPDX file creator to record file contributors. Contributors could include names of copyright holders and/or authors who may not be copyright holders yet contributed to the file content.", "type": "array", "items": { "description": "This field provides a place for the SPDX file creator to record file contributors. Contributors could include names of copyright holders and/or authors who may not be copyright holders yet contributed to the file content.", "type": "string" } }, "attributionTexts": { "description": "This field provides a place for the SPDX data creator to record acknowledgements that may be required to be communicated in some contexts. This is not meant to include theactual complete license text (see licenseConculded and licenseDeclared), and may or may not include copyright notices (see also copyrightText). The SPDX data creator may use this field to record other acknowledgements, such as particular clauses from license texts, which may be necessary or desirable to reproduce.", "type": "array", "items": { "description": "This field provides a place for the SPDX data creator to record acknowledgements that may be required to be communicated in some contexts. This is not meant to include theactual complete license text (see licenseConculded and licenseDeclared), and may or may not include copyright notices (see also copyrightText). The SPDX data creator may use this field to record other acknowledgements, such as particular clauses from license texts, which may be necessary or desirable to reproduce.", "type": "string" } }, "fileDependencies": { "description": "Deprecated. The field provides a place for the SPDX file creator to record a list of other files (referenceable within this SPDX file) which the file is a derivative of and/or depends on for the build", "type": "array", "items": { "description": "SPDX ID for File", "type": "string" } }, "annotations": { "description": "Provide additional information about an SpdxElement.", "type": "array", "items": { "type": "object", "required": [ "annotationDate", "comment", "annotator", "annotationType" ], "properties": { "annotator": { "description": "This field identifies the person, organization or tool that has commented on a file, package, or the entire document.", "type": "string" }, "annotationDate": { "description": "Identify when the comment was made. This is to be specified according to the combined date and time in the UTC format, as specified in the ISO 8601 standard.", "type": "string" }, "comment": { "type": "string" }, "annotationType": { "description": "Type of the annotation.", "type": "string", "enum": [ "OTHER", "REVIEW" ] } }, "description": "An Annotation is a comment on an SpdxItem by an agent." } } } } }, "snippets": { "description": "Snippets referenced in the SPDX document", "type": "array", "items": { "type": "object", "required": [ "SPDXID", "snippetFromFile", "ranges" ], "properties": { "SPDXID": { "type": "string", "description": "Uniquely identify any element in an SPDX document which may be referenced by other elements." }, "snippetFromFile": { "description": "SPDX ID for File. File containing the SPDX element (e.g. the file contaning a snippet).", "type": "string" }, "ranges": { "description": "This field defines the byte range in the original host file (in X.2) that the snippet information applies to", "minItems": 1, "type": "array", "items": { "type": "object", "properties": { "endPointer": { "type": "object", "properties": { "reference": { "description": "SPDX ID for File", "type": "string" }, "offset": { "type": "integer", "description": "Byte offset in the file" }, "lineNumber": { "type": "integer", "description": "line number offset in the file" } }, "required": [ "reference" ] }, "startPointer": { "type": "object", "properties": { "reference": { "description": "SPDX ID for File", "type": "string" }, "offset": { "type": "integer", "description": "Byte offset in the file" }, "lineNumber": { "type": "integer", "description": "line number offset in the file" } }, "required": [ "reference" ] } }, "required": [ "endPointer", "startPointer" ], "additionalProperties": false } }, "licenseConcluded": { "description": "License expression for licenseConcluded. See SPDX Annex D for the license expression syntax. The licensing that the preparer of this SPDX document has concluded, based on the evidence, actually applies to the SPDX Item.\n\nIf the licenseConcluded field is not present for an SPDX Item, it implies an equivalent meaning to NOASSERTION.", "type": "string" }, "licenseInfoInSnippets": { "description": "Licensing information that was discovered directly in the subject snippet. This is also considered a declared license for the snippet.", "type": "array", "items": { "description": "License expression for licenseInfoInSnippet. Licensing information that was discovered directly in the subject snippet. This is also considered a declared license for the snippet.", "type": "string" } }, "licenseComments": { "description": "The licenseComments property allows the preparer of the SPDX document to describe why the licensing in spdx:licenseConcluded was chosen.", "type": "string" }, "copyrightText": { "description": "The text of copyright declarations recited in the Package or File.", "type": "string" }, "comment": { "type": "string" }, "name": { "description": "Identify name of this SpdxElement.", "type": "string" }, "attributionTexts": { "description": "This field provides a place for the SPDX data creator to record acknowledgements that may be required to be communicated in some contexts. This is not meant to include theactual complete license text (see licenseConculded and licenseDeclared), and may or may not include copyright notices (see also copyrightText). The SPDX data creator may use this field to record other acknowledgements, such as particular clauses from license texts, which may be necessary or desirable to reproduce.", "type": "array", "items": { "description": "This field provides a place for the SPDX data creator to record acknowledgements that may be required to be communicated in some contexts. This is not meant to include theactual complete license text (see licenseConculded and licenseDeclared), and may or may not include copyright notices (see also copyrightText). The SPDX data creator may use this field to record other acknowledgements, such as particular clauses from license texts, which may be necessary or desirable to reproduce.", "type": "string" } }, "annotations": { "description": "Provide additional information about an SpdxElement.", "type": "array", "items": { "type": "object", "required": [ "annotationDate", "comment", "annotator", "annotationType" ], "properties": { "annotationDate": { "description": "Identify when the comment was made. This is to be specified according to the combined date and time in the UTC format, as specified in the ISO 8601 standard.", "type": "string" }, "comment": { "type": "string" }, "annotator": { "description": "This field identifies the person, organization or tool that has commented on a file, package, or the entire document.", "type": "string" }, "annotationType": { "description": "Type of the annotation.", "type": "string", "enum": [ "OTHER", "REVIEW" ] } }, "description": "An Annotation is a comment on an SpdxItem by an agent." } } } } }, "hasExtractedLicensingInfos": { "description": "Indicates that a particular ExtractedLicensingInfo was defined in the subject SpdxDocument.", "type": "array", "items": { "type": "object", "required": [ "licenseId", "extractedText" ], "properties": { "licenseId": { "description": "A human readable short form license identifier for a license. The license ID is iether on the standard license oist or the form \"LicenseRef-\"[idString] where [idString] is a unique string containing letters, numbers, \".\", \"-\" or \"+\".", "type": "string" }, "extractedText": { "description": "Verbatim license or licensing notice text that was discovered.", "type": "string" }, "name": { "description": "Identify name of this SpdxElement.", "type": "string" }, "seeAlsos": { "type": "array", "items": { "type": "string" } }, "crossRefs": { "description": "Cross Reference Detail for a license SeeAlso URL", "type": "array", "items": { "type": "object", "required": [ "url" ], "properties": { "isWayBackLink": { "description": "True if the License SeeAlso URL points to a Wayback archive", "type": "boolean" }, "match": { "description": "Status of a License List SeeAlso URL reference if it refers to a website that matches the license text.", "type": "string" }, "timestamp": { "description": "Timestamp", "type": "string" }, "order": { "description": "The ordinal order of this element within a list", "type": "integer" }, "url": { "description": "URL Reference", "type": "string" }, "isLive": { "description": "Indicate a URL is still a live accessible location on the public internet", "type": "boolean" }, "isValid": { "description": "True if the URL is a valid well formed URL", "type": "boolean" } }, "description": "Cross reference details for the a URL reference" } }, "comment": { "type": "string" } }, "description": "An ExtractedLicensingInfo represents a license or licensing notice that was found in the package. Any license text that is recognized as a license may be represented as a License rather than an ExtractedLicensingInfo." } }, "relationships": { "description": "Relationships referenced in the SPDX document", "type": "array", "items": { "type": "object", "required": [ "spdxElementId", "relatedSpdxElement", "relationshipType" ], "properties": { "spdxElementId": { "type": "string", "description": "Id to which the SPDX element is related" }, "relationshipType": { "description": "Describes the type of relationship between two SPDX elements.", "type": "string", "enum": [ "VARIANT_OF", "COPY_OF", "PATCH_FOR", "TEST_DEPENDENCY_OF", "CONTAINED_BY", "DATA_FILE_OF", "OPTIONAL_COMPONENT_OF", "ANCESTOR_OF", "GENERATES", "CONTAINS", "OPTIONAL_DEPENDENCY_OF", "FILE_ADDED", "DEV_DEPENDENCY_OF", "DEPENDENCY_OF", "BUILD_DEPENDENCY_OF", "DESCRIBES", "PREREQUISITE_FOR", "HAS_PREREQUISITE", "PROVIDED_DEPENDENCY_OF", "DYNAMIC_LINK", "DESCRIBED_BY", "METAFILE_OF", "DEPENDENCY_MANIFEST_OF", "PATCH_APPLIED", "RUNTIME_DEPENDENCY_OF", "TEST_OF", "TEST_TOOL_OF", "DEPENDS_ON", "FILE_MODIFIED", "DISTRIBUTION_ARTIFACT", "DOCUMENTATION_OF", "GENERATED_FROM", "STATIC_LINK", "OTHER", "BUILD_TOOL_OF", "TEST_CASE_OF", "PACKAGE_OF", "DESCENDANT_OF", "FILE_DELETED", "EXPANDED_FROM_ARCHIVE", "DEV_TOOL_OF", "EXAMPLE_OF" ] }, "relatedSpdxElement": { "description": "SPDX ID for SpdxElement. A related SpdxElement.", "type": "string" }, "comment": { "type": "string" } } } }, "annotations": { "description": "Provide additional information about an SpdxElement.", "type": "array", "items": { "type": "object", "required": [ "annotationDate", "comment", "annotator", "annotationType" ], "properties": { "annotator": { "description": "This field identifies the person, organization or tool that has commented on a file, package, or the entire document.", "type": "string" }, "annotationDate": { "description": "Identify when the comment was made. This is to be specified according to the combined date and time in the UTC format, as specified in the ISO 8601 standard.", "type": "string" }, "comment": { "type": "string" }, "annotationType": { "description": "Type of the annotation.", "type": "string", "enum": [ "OTHER", "REVIEW" ] } }, "description": "An Annotation is a comment on an SpdxItem by an agent." } }, "revieweds": { "description": "Deprecated. Reviewed", "type": "array", "items": { "type": "object", "required": [ "reviewDate" ], "properties": { "reviewer": { "description": "The name and, optionally, contact information of the person who performed the review. Values of this property must conform to the agent and tool syntax.", "type": "string" }, "reviewDate": { "description": "The date and time at which the SpdxDocument was reviewed. This value must be in UTC and have 'Z' as its timezone indicator.", "type": "string" }, "comment": { "type": "string" } } } } } }
