Following up on the SPDX tech call, here's a sample SPDX RDF/XML files for the use case 5.3: http://wiki.spdx.org/view/Technical_Team/Use_Cases/2.0/Project_maintainer_in corporates_another_project_by_including_binary
In this scenario, a fictitious company Acme is creating an open source project AcmeProject which uses the SPDX Tools library jar file SpdxParserv1.2.jar. The SPdxParserv1.2.jar is from the package SPDXParser version 1.2 which has an associated SPDX document for that package. The URL for the SPDX document is http://spdx.org/tools/spdxdocs/SpdxParser/v1.2/F96B1D26-3D8D-4FDF-87DF-8E760 CB68CD9. The file AcmeProjectSpdx.rdf contains an extremely simple SPDX rdf file with 2 source files and the file SpdxParser1.2.jar file. The file was built by hand, so there are likely some errors and/or inconsistencies. Some notes: . Making the external references seemed pretty straightforward for external RDF documents o I used the approach we discussed at LinuxCon - a URL format which is unique to the organization, package, and version followed by a generated random GUID . I added a verificationCode property to the Relationship class. This represents the verification code for the related SPDX element - it was in the model but not in the spec we discussed at LinuxCon. I would propose adding this to the spec. . I used the proposed reference generation mechanism where each element would get an "SPDXRef-X" which is unique only to the SPDX document - this seems to work. . Left referencesFile as is - it was not noted as deprecated in our LinuxCon minutes. Note - it could be replaced by a contains relationship from the document to the file. . I used the xml:base and rdf:ID to shorten references to the SPDX doc containing the elements being described . For the relationship to the SPDX library, I used a builtFrom relationship type and a package usage to the package described in the SPDX Library's SPDX document. There were a couple of other choices (both of which I believe are valid): o a separate builtFrom relationship to every source file in the SPDX Library's SPDX document o both the file level relationships and the package level relationships Here's the content of the RDF document with the important sections highlighted in yellow: <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"; xmlns="http://acme.com/acmeproj/downloads/v1.2#"; xmlns:doap="http://usefulinc.com/ns/doap#"; xmlns:spdx="http://spdx.org/rdf/terms#"; xmlns:rdfs="http://www.w3.org/2000/01/rdf-schema#"; xml:base="http://acme.com/spdxdocs/acmeproj/v1.2/1BE2A4FF-5F1A-48D3-8483-28A 9B0349A1B"> <spdx:SpdxDocument rdf:ID="spdxdoc"> <spdx:describesPackage> <spdx:Package rdf:ID="SPDXRef-1"> <spdx:packageFileName>Acmev0.2.zip</spdx:packageFileName> <spdx:relationship> <spdx:Relationship> <spdx:usage rdf:resource="http://spdx.org/rdf/terms#usageType_source"/> <spdx:relationshipType rdf:resource="http://spdx.org/rdf/terms#relationshipType_contains"/> <spdx:relatedSPdxItem rdf:resource="http://acme.com/spdxdocs/acmeproj/v1.2/1BE2A4FF-5F1A-48D3-8483 -28A9B0349A1B#SPDXRef-2"/> <spdx:verificationCode> <spdx:VerificationCode> <spdx:verificationCodeValue>2fd4e1c67a2d28fced849ee1bb76e7391b93eb12</spdx:v erificationCodeValue> </spdx:VerificationCode> </spdx:verificationCode> </spdx:Relationship> </spdx:relationship> <spdx:licenseComments></spdx:licenseComments> <spdx:copyrightText> Copyright 2014, Acme</spdx:copyrightText> <spdx:licenseInfoFromFiles rdf:resource="http://spdx.org/licenses/Apache-2.0"/> <spdx:licenseInfoFromFiles rdf:resource="http://spdx.org/licenses/MPL-1.1"/> <spdx:relationship> <spdx:Relationship> <spdx:usage rdf:resource="http://spdx.org/rdf/terms#usageType_dynamicLink"/> <spdx:relationshipType rdf:resource="http://spdx.org/rdf/terms#relationshipType_contains"/> <spdx:relatedSPdxItem rdf:resource="http://acme.com/spdxdocs/acmeproj/v1.2/1BE2A4FF-5F1A-48D3-8483 -28A9B0349A1B#SPDXRef-4"/> <spdx:verificationCode> <spdx:VerificationCode> <spdx:verificationCodeValue>c2b4e1c67a2d28fced849ee1bb76e7391b93f125</spdx:v erificationCodeValue> </spdx:VerificationCode> </spdx:verificationCode> </spdx:Relationship> </spdx:relationship> <spdx:versionInfo>Version 0.2</spdx:versionInfo> <spdx:licenseDeclared rdf:resource="http://spdx.org/licenses/MPL-1.1"/> <spdx:description>The Acme Project uses the SPDX Parser library</spdx:description> <spdx:sourceInfo></spdx:sourceInfo> <spdx:downloadLocation>http://acme.com/acmeproj/downloads/v1.2</spdx:downloa dLocation> <spdx:licenseConcluded rdf:resource="http://spdx.org/licenses/MPL-1.1"/> <spdx:summary>This is the Acme project</spdx:summary> <spdx:packageVerificationCode> <spdx:PackageVerificationCode> <spdx:verificationCodeValue>4e3211c67a2d28fced849ee1bb76e7391b93feba</spdx:v erificationCodeValue> </spdx:PackageVerificationCode> </spdx:packageVerificationCode> <spdx:checksum rdf:nodeID="A0"/> <doap:homepage>http://www.spdx.org/tools</doap:homepage> <spdx:name>Acme Package</spdx:name> <spdx:relationship> <spdx:Relationship> <spdx:usage rdf:resource="http://spdx.org/rdf/terms#usageType_source"/> <spdx:relationshipType rdf:resource="http://spdx.org/rdf/terms#relationshipType_contains"/> <spdx:relatedSPdxItem rdf:resource="http://acme.com/spdxdocs/acmeproj/v1.2/1BE2A4FF-5F1A-48D3-8483 -28A9B0349A1B#SPDXRef-3"/> <spdx:verificationCode> <spdx:VerificationCode> <spdx:verificationCodeValue>3ab4e1c67a2d28fced849ee1bb76e7391b93f125</spdx:v erificationCodeValue> </spdx:VerificationCode> </spdx:verificationCode> </spdx:Relationship> </spdx:relationship> </spdx:Package> </spdx:describesPackage> <spdx:creationInfo> <spdx:CreationInfo> <spdx:licenseListVersion>1.19</spdx:licenseListVersion> <spdx:created>2014-07-02T00:00:00Z</spdx:created> <spdx:creator>Organization: Acme</spdx:creator> </spdx:CreationInfo> </spdx:creationInfo> <spdx:dataLicense rdf:resource="http://spdx.org/licenses/CC0-1.0"/> <spdx:specVersion>SPDX-1.2</spdx:specVersion> <spdx:referencesFile> <spdx:File rdf:ID="SPDXRef-3"> <spdx:copyrightText> Copyright 2014, Acme</spdx:copyrightText> <spdx:licenseComments></spdx:licenseComments> <spdx:licenseInfoInFile rdf:resource="http://spdx.org/licenses/MIT"/> <spdx:licenseConcluded rdf:resource="http://spdx.org/licenses/MIT"/> <spdx:fileType rdf:resource="http://spdx.org/rdf/terms#fileType_source"/> <spdx:checksum> <spdx:Checksum> <spdx:checksumValue>3ab4e1c67a2d28fced849ee1bb76e7391b93f125</spdx:checksumV alue> <spdx:algorithm rdf:resource="http://spdx.org/rdf/terms#checksumAlgorithm_sha1"/> </spdx:Checksum> </spdx:checksum> <spdx:fileName>src/org/acme/dao.java</spdx:fileName> </spdx:File> </spdx:referencesFile> <spdx:referencesFile> <spdx:File rdf:ID="SPDXRef-2"> <spdx:copyrightText> Copyright 2014, Acme</spdx:copyrightText> <spdx:licenseComments></spdx:licenseComments> <spdx:licenseInfoInFile rdf:resource="http://spdx.org/licenses/MIT"/> <spdx:licenseConcluded rdf:resource="http://spdx.org/licenses/MIT"/> <spdx:fileType rdf:resource="http://spdx.org/rdf/terms#fileType_source"/> <spdx:checksum> <spdx:Checksum rdf:nodeID="A0"> <spdx:checksumValue>2fd4e1c67a2d28fced849ee1bb76e7391b93eb12</spdx:checksumV alue> <spdx:algorithm rdf:resource="http://spdx.org/rdf/terms#checksumAlgorithm_sha1"/> </spdx:Checksum> </spdx:checksum> <spdx:fileName>src/org/acme/main.java</spdx:fileName> </spdx:File> </spdx:referencesFile> <spdx:referencesFile> <spdx:File rdf:ID="SPDXRef-4"> <spdx:copyrightText>Copyright 2014, Source Auditor Inc.</spdx:copyrightText> <spdx:licenseComments></spdx:licenseComments> <spdx:licenseInfoInFile rdf:resource="http://spdx.org/licenses/Apache-2.0"/> <spdx:licenseConcluded rdf:resource="http://spdx.org/licenses/Apache-2.0"/> <spdx:fileType rdf:resource="http://spdx.org/rdf/terms#fileType_binary"/> <spdx:checksum> <spdx:Checksum> <spdx:checksumValue>c2b4e1c67a2d28fced849ee1bb76e7391b93f125</spdx:checksumV alue> <spdx:algorithm rdf:resource="http://spdx.org/rdf/terms#checksumAlgorithm_sha1"/> </spdx:Checksum> </spdx:checksum> <spdx:fileName>lib/SpdxParser1.2.jar</spdx:fileName> <spdx:relationship> <spdx:Relationship> <spdx:usage rdf:resource="http://spdx.org/rdf/terms#usageType_package"/> <spdx:relationshipType rdf:resource="http://spdx.org/rdf/terms#relationshipType_generatedFrom"/> <spdx:relatedSPdxItem rdf:resource="http://spdx.org/tools/spdxdocs/SpdxParser/v1.2/F96B1D26-3D8D-4 FDF-87DF-8E760CB68CD9#SPDXRef-1"/> <spdx:verificationCode> <spdx:VerificationCode> <spdx:verificationCodeValue>4e3211c67a2d28fced849ee1bb76e7391b93feba</spdx:v erificationCodeValue> <spdx:verificationCodeExcludedFile>SpdxTranslatorSpdx.txt</spdx:verification CodeExcludedFile> <spdx:verificationCodeExcludedFile>SpdxTranslatorSpdx.rdf</spdx:verification CodeExcludedFile> </spdx:VerificationCode> </spdx:verificationCode> <rdfs:comment>This is a relationship to a package using a built from relationship. Note that it is to a package and not to all individula files.</rdfs:comment> </spdx:Relationship> </spdx:relationship> </spdx:File> </spdx:referencesFile> </spdx:SpdxDocument> </rdf:RDF> ------------------------------------------------- Gary O'Neall Principal Consultant Source Auditor Inc. Mobile: 408.805.0586 Email: <mailto:[email protected]> [email protected]
_______________________________________________ Spdx-tech mailing list [email protected] https://lists.spdx.org/mailman/listinfo/spdx-tech
