Hi Kotrappa,
Responses inline below Gary > -----Original Message----- > From: [email protected] > [mailto:[email protected]] > Sent: Wednesday, July 2, 2014 10:10 AM > To: [email protected]; [email protected]; > [email protected] > Subject: Question regarding packages with in a package > > Hello Gary, > > > This is regarding representation of spdx data. > > Does a Package contain mulitiple other packages? > [Gary] The current spec only has one package per SPDX file. The SPDX 2.0 spec (currently under development) will allow multiple SPDX packages within the same file. > if so, how does current SPDX document represent multiple packages? > [Gary] To deal with multiple packages before SPDX 2.0, I would recommend the following: - Whatever artifact contains the embedded package uses that packages declared and concluded license at the file level - The file ArtifactOf points to the package home page - The file comment is used to note that this is an embedded package. Suggest that the comment also indicates how the embedded package is used (e.g. linked as a dynamic library) - If there is a dependency between two files (e.g. the source files for an embedded package are included along with the binary generated by the source), the fileDependency property is used to relate the two files - One package is chosen to represent the highest level package for the SPDX document/file. The concludedLicense should take into account any embedded packages > for e.g. a application binary say aaa.bin is generated as a result of > linking mulitple shared libraries (lib1.so, lib2.so), binaries, shell > commands (/bin/aa, /bin/abcd, /bin/xxx) [Gary] Here I would have the shared binary libraries use the artifactOf and comments to indicate the packages they are derived from > > Can we represent each shared library, shell command in one single spdx > file? [Gary] Yes, but before SPDX 2.0, there is no way to reference one SPDX file from another. In SPDX 2.0 this will be allowed. If you use a separate file for each library, it should be straightforward to migrate to SPDX 2.0 by just referencing the separate files. > > Best regards > Kotrappa > The information contained in this electronic message and > attachments to this message are intended for the exclusive use of the > addressee(s) and may contain proprietary, confidential or privileged > information. If you are not the intended recipient, you should not > disseminate, distribute or copy this e-mail. Please notify the sender > immediately and destroy all copies of this message and any attachments. > > WARNING: Computer viruses can be transmitted via email. The recipient > should check this email and any attachments for the presence of > viruses. The company accepts no liability for any damage caused by any > virus transmitted by this email. > > www.wipro.com _______________________________________________ Spdx-tech mailing list [email protected] https://lists.spdx.org/mailman/listinfo/spdx-tech
