diff --git a/README.md b/README.md index 4b31d0a..7caea30 100644 --- a/README.md +++ b/README.md @@ -34,8 +34,8 @@ Namespaces SHOULD be lower case. Base property names MAY use upper case. ### Examples ``` -local:information_security_classification -local:team_responsible +internal:information_security_classification +internal:team_responsible ``` ### ABNF for Official CycloneDX Property Names @@ -81,6 +81,7 @@ ABNF syntax as per [RFC5234: Augmented BNF for Syntax Specifications: ABNF](http | `snyk` | Namespace for use by Snyk. | Snyk | [Snyk Taxonomy Documentation](https://docs.snyk.io/snyk-api-info/get-a-projects-sbom-document-endpoint#custom-cyclonedx-properties) | | `sonatype` | Namespace for use by Sonatype | Sonatype | [Sonatype Taxonomy Documentation](https://help.sonatype.com/lift/open-source-vulnerability-analysis/dependency-view/cyclonedx-sonatype-namespace-taxonomy) | | `spack` | Namespace for use by the Spack package manager. | Spack Maintainers | [Spack SBOM Project](https://github.com/spack/spack-sbom#readme) | +| `spdx` | Namespace for interop with the SPDX format. | CycloneDX Core Working Group | [spdx taxonomy](spdx/spdx.md) | | `syft` | Namespace for use by the Syft project. | Syft Maintainers | [Syft Project](https://github.com/anchore/syft) | | `tern` | Namespace for use by the Tern project. | Tern Maintainers | [Tern Project](https://github.com/tern-tools/tern) | | `veracode` | Namespace for use by Veracode. | Veracode | [Veracode taxonomy](https://github.com/veracode/cyclonedx-property-taxonomy#readme) | diff --git a/spdx/spdx.md b/spdx/spdx.md new file mode 100644 index 0000000..05a1521 --- /dev/null +++ b/spdx/spdx.md @@ -0,0 +1,5 @@ +## `spdx` Namespace + +| Namespace | Description | Taxonomy | +| --- | --- | --- | +| `spdx:v2` | Namespace for SPDX v2. | [spdx:v2 taxonomy](v2.md) | \ No newline at end of file diff --git a/spdx/v2.md b/spdx/v2.md new file mode 100644 index 0000000..1a2cdf7 --- /dev/null +++ b/spdx/v2.md @@ -0,0 +1,90 @@ +## `spdx:v2` Namespace Taxonomy + +The SPDX namespaces and property names correspond to SPDX elements and fields. + +For more information on their meaning please refer to the [SPDX specification](https://spdx.github.io/spdx-spec/). + +| Namespace | Description | +| --- | --- | +| `spdx:v2:checksum` | Checksum information | +| `spdx:v2:creation-info` | Creation information | +| `spdx:v2:document` | Document information | +| `spdx:v2:external-reference` | External reference information | +| `spdx:v2:file` | File information | +| `spdx:v2:package` | Package information | + +| Property | +| --- | +| `spdx:v2:annotation` | +| `spdx:v2:comment` | +| `spdx:v2:download-location` | +| `spdx:v2:files-analyzed` | +| `spdx:v2:homepage` | +| `spdx:v2:license-comments` | +| `spdx:v2:license-concluded` | +| `spdx:v2:license-declared` | +| `spdx:v2:license-info-from-file` | +| `spdx:v2:spdxid` | + +## `spdx:v2:checksum` Namespace Taxonomy + +| Property | +| --- | +| `spdx:v2:checksum:md2` | +| `spdx:v2:checksum:md4` | +| `spdx:v2:checksum:md6` | +| `spdx:v2:checksum:sha225` | + +## `spdx:v2:document` Namespace Taxonomy + +| Property | +| --- | +| `spdx:v2:document:data-license` | +| `spdx:v2:document:describes` | +| `spdx:v2:document:document-namespace` | +| `spdx:v2:document:external-document-ref` | +| `spdx:v2:document:name` | +| `spdx:v2:document:spdx-version` | + +## `spdx:v2:creation-info` Namespace Taxonomy + +| Property | +| --- | +| `spdx:v2:creation-info:comment` | +| `spdx:v2:creation-info:creators-organization` | +| `spdx:v2:creation-info:license-list-version` | + +## `spdx:v2:external-reference` Namespace Taxonomy + +| Property | +| --- | +| `spdx:v2:external-reference:security:cpe22` | +| `spdx:v2:external-reference:security:cpe23` | +| `spdx:v2:external-reference:package-manager:bower` | +| `spdx:v2:external-reference:package-manager:maven-central` | +| `spdx:v2:external-reference:package-manager:npm` | +| `spdx:v2:external-reference:package-manager:nuget` | +| `spdx:v2:external-reference:package-manager:purl` | +| `spdx:v2:external-reference:persistent-id:swh` | +| `spdx:v2:external-reference:other` | + +## `spdx:v2:file` Namespace Taxonomy + +| Property | +| --- | +| `spdx:v2:file:type` | +| `spdx:v2:file:contributor` | +| `spdx:v2:file:notice-text` | + +## `spdx:v2:package` Namespace Taxonomy + +| Property | +| --- | +| `spdx:v2:package:file-name` | +| `spdx:v2:package:originator:email` | +| `spdx:v2:package:originator:organization` | +| `spdx:v2:package:source-info` | +| `spdx:v2:package:summary` | +| `spdx:v2:package:supplier:organization` | +| `spdx:v2:package:verification-code:value` | +| `spdx:v2:package:verification-code:excluded-file` |