From 49ce8e1db3de47786175c4c04c737c01a4907fc9 Mon Sep 17 00:00:00 2001 From: Patrick Dwyer Date: Sat, 8 Jan 2022 15:14:18 +1000 Subject: [PATCH 1/3] Add SPDX taxonomy Signed-off-by: Patrick Dwyer --- README.md | 1 + spdx.md | 90 +++++++++++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 91 insertions(+) create mode 100644 spdx.md diff --git a/README.md b/README.md index 1a1a7a5..60c140f 100644 --- a/README.md +++ b/README.md @@ -60,6 +60,7 @@ ABNF syntax as per [RFC5234: Augmented BNF for Syntax Specifications: ABNF](http | `internal` | Namespace for internal use only. BOMs shared with 3rd parties SHOULD NOT include properties in the local namespace. | CycloneDX Core Working Group | N/A | | `aquasecurity` | Namespace for use by Aqua Security. | Aqua Security | `RESERVED` | | `dependency-track` | Namespace for use by the Dependency-Track project. | Dependency-Track Maintainers | `RESERVED` | +| `spdx` | Namespace for inter-op with the SPDX format. | CycloneDX Core Working Group | [spdx taxonomy](spdx.md) | | `tern` | Namespace for use by the Tern project. | Tern Maintainers | [Tern Project](https://github.com/tern-tools/tern) | ## Registering New Top Level Namespaces diff --git a/spdx.md b/spdx.md new file mode 100644 index 0000000..f73113d --- /dev/null +++ b/spdx.md @@ -0,0 +1,90 @@ +## `spdx` Namespace Taxonomy + +The SPDX namespaces and property names correspond to SPDX elements and fields. + +For more information on their meaning please refer to the [SPDX specification](https://spdx.github.io/spdx-spec/). + +| Namespace | Description | +| --- | --- | +| `spdx:checksum` | Checksum information | +| `spdx:creation-info` | Creation information | +| `spdx:document` | Document information | +| `spdx:external-reference` | External reference information | +| `spdx:file` | File information | +| `spdx:package` | Package information | + +| Property | +| --- | +| `spdx:annotation` | +| `spdx:comment` | +| `spdx:download-location` | +| `spdx:files-analyzed` | +| `spdx:homepage` | +| `spdx:license-comments` | +| `spdx:license-concluded` | +| `spdx:license-declared` | +| `spdx:license-info-from-file` | +| `spdx:spdxid` | + +## `spdx:checksum` Namespace Taxonomy + +| Property | +| --- | +| `spdx:checksum:md2` | +| `spdx:checksum:md4` | +| `spdx:checksum:md6` | +| `spdx:checksum:sha225` | + +## `spdx:document` Namespace Taxonomy + +| Property | +| --- | +| `spdx:document:data-license` | +| `spdx:document:describes` | +| `spdx:document:document-namespace` | +| `spdx:document:external-document-ref` | +| `spdx:document:name` | +| `spdx:document:spdx-version` | + +## `spdx:creation-info` Namespace Taxonomy + +| Property | +| --- | +| `spdx:creation-info:comment` | +| `spdx:creation-info:creators-organization` | +| `spdx:creation-info:license-list-version` | + +## `spdx:external-reference` Namespace Taxonomy + +| Property | +| --- | +| `spdx:external-reference:security:cpe22` | +| `spdx:external-reference:security:cpe23` | +| `spdx:external-reference:package-manager:bower` | +| `spdx:external-reference:package-manager:maven-central` | +| `spdx:external-reference:package-manager:npm` | +| `spdx:external-reference:package-manager:nuget` | +| `spdx:external-reference:package-manager:purl` | +| `spdx:external-reference:persistent-id:swh` | +| `spdx:external-reference:other` | + +## `spdx:file` Namespace Taxonomy + +| Property | +| --- | +| `spdx:file:type` | +| `spdx:file:contributor` | +| `spdx:file:notice-text` | + +## `spdx:package` Namespace Taxonomy + +| Property | +| --- | +| `spdx:package:file-name` | +| `spdx:package:originator:email` | +| `spdx:package:originator:organization` | +| `spdx:package:source-info` | +| `spdx:package:summary` | +| `spdx:package:supplier:organization` | +| `spdx:package:verification-code:value` | +| `spdx:package:verification-code:excluded-file` | From eff58148d84734bbe7e4f6a0862604a398d5f20f Mon Sep 17 00:00:00 2001 From: Patrick Dwyer Date: Mon, 10 Jan 2022 08:57:41 +1000 Subject: [PATCH 2/3] Update examples to use `internal` namespace Signed-off-by: Patrick Dwyer --- README.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index 60c140f..4dc4f04 100644 --- a/README.md +++ b/README.md @@ -34,8 +34,8 @@ Namespaces SHOULD be lower case. Base property names MAY use upper case. ### Examples ``` -local:information_security_classification -local:team_responsible +internal:information_security_classification +internal:team_responsible ``` ### ABNF for Official CycloneDX Property Names From 48d9ed70dfdc4affb0fe61a5b395b8fee1804710 Mon Sep 17 00:00:00 2001 From: Patrick Dwyer Date: Mon, 10 Jan 2022 08:58:32 +1000 Subject: [PATCH 3/3] Restructure `spdx` namespace into `spdx:v2` namespace Signed-off-by: Patrick Dwyer --- README.md | 2 +- spdx.md | 90 ---------------------------------------------------- spdx/spdx.md | 5 +++ spdx/v2.md | 90 ++++++++++++++++++++++++++++++++++++++++++++++++++++ 4 files changed, 96 insertions(+), 91 deletions(-) delete mode 100644 spdx.md create mode 100644 spdx/spdx.md create mode 100644 spdx/v2.md diff --git a/README.md b/README.md index 4dc4f04..de36496 100644 --- a/README.md +++ b/README.md @@ -60,7 +60,7 @@ ABNF syntax as per [RFC5234: Augmented BNF for Syntax Specifications: ABNF](http | `internal` | Namespace for internal use only. BOMs shared with 3rd parties SHOULD NOT include properties in the local namespace. | CycloneDX Core Working Group | N/A | | `aquasecurity` | Namespace for use by Aqua Security. | Aqua Security | `RESERVED` | | `dependency-track` | Namespace for use by the Dependency-Track project. | Dependency-Track Maintainers | `RESERVED` | -| `spdx` | Namespace for inter-op with the SPDX format. | CycloneDX Core Working Group | [spdx taxonomy](spdx.md) | +| `spdx` | Namespace for interop with the SPDX format. | CycloneDX Core Working Group | [spdx taxonomy](spdx/spdx.md) | | `tern` | Namespace for use by the Tern project. | Tern Maintainers | [Tern Project](https://github.com/tern-tools/tern) | ## Registering New Top Level Namespaces diff --git a/spdx.md b/spdx.md deleted file mode 100644 index f73113d..0000000 --- a/spdx.md +++ /dev/null @@ -1,90 +0,0 @@ -## `spdx` Namespace Taxonomy - -The SPDX namespaces and property names correspond to SPDX elements and fields. - -For more information on their meaning please refer to the [SPDX specification](https://spdx.github.io/spdx-spec/). - -| Namespace | Description | -| --- | --- | -| `spdx:checksum` | Checksum information | -| `spdx:creation-info` | Creation information | -| `spdx:document` | Document information | -| `spdx:external-reference` | External reference information | -| `spdx:file` | File information | -| `spdx:package` | Package information | - -| Property | -| --- | -| `spdx:annotation` | -| `spdx:comment` | -| `spdx:download-location` | -| `spdx:files-analyzed` | -| `spdx:homepage` | -| `spdx:license-comments` | -| `spdx:license-concluded` | -| `spdx:license-declared` | -| `spdx:license-info-from-file` | -| `spdx:spdxid` | - -## `spdx:checksum` Namespace Taxonomy - -| Property | -| --- | -| `spdx:checksum:md2` | -| `spdx:checksum:md4` | -| `spdx:checksum:md6` | -| `spdx:checksum:sha225` | - -## `spdx:document` Namespace Taxonomy - -| Property | -| --- | -| `spdx:document:data-license` | -| `spdx:document:describes` | -| `spdx:document:document-namespace` | -| `spdx:document:external-document-ref` | -| `spdx:document:name` | -| `spdx:document:spdx-version` | - -## `spdx:creation-info` Namespace Taxonomy - -| Property | -| --- | -| `spdx:creation-info:comment` | -| `spdx:creation-info:creators-organization` | -| `spdx:creation-info:license-list-version` | - -## `spdx:external-reference` Namespace Taxonomy - -| Property | -| --- | -| `spdx:external-reference:security:cpe22` | -| `spdx:external-reference:security:cpe23` | -| `spdx:external-reference:package-manager:bower` | -| `spdx:external-reference:package-manager:maven-central` | -| `spdx:external-reference:package-manager:npm` | -| `spdx:external-reference:package-manager:nuget` | -| `spdx:external-reference:package-manager:purl` | -| `spdx:external-reference:persistent-id:swh` | -| `spdx:external-reference:other` | - -## `spdx:file` Namespace Taxonomy - -| Property | -| --- | -| `spdx:file:type` | -| `spdx:file:contributor` | -| `spdx:file:notice-text` | - -## `spdx:package` Namespace Taxonomy - -| Property | -| --- | -| `spdx:package:file-name` | -| `spdx:package:originator:email` | -| `spdx:package:originator:organization` | -| `spdx:package:source-info` | -| `spdx:package:summary` | -| `spdx:package:supplier:organization` | -| `spdx:package:verification-code:value` | -| `spdx:package:verification-code:excluded-file` | diff --git a/spdx/spdx.md b/spdx/spdx.md new file mode 100644 index 0000000..05a1521 --- /dev/null +++ b/spdx/spdx.md @@ -0,0 +1,5 @@ +## `spdx` Namespace + +| Namespace | Description | Taxonomy | +| --- | --- | --- | +| `spdx:v2` | Namespace for SPDX v2. | [spdx:v2 taxonomy](v2.md) | \ No newline at end of file diff --git a/spdx/v2.md b/spdx/v2.md new file mode 100644 index 0000000..1a2cdf7 --- /dev/null +++ b/spdx/v2.md @@ -0,0 +1,90 @@ +## `spdx:v2` Namespace Taxonomy + +The SPDX namespaces and property names correspond to SPDX elements and fields. + +For more information on their meaning please refer to the [SPDX specification](https://spdx.github.io/spdx-spec/). + +| Namespace | Description | +| --- | --- | +| `spdx:v2:checksum` | Checksum information | +| `spdx:v2:creation-info` | Creation information | +| `spdx:v2:document` | Document information | +| `spdx:v2:external-reference` | External reference information | +| `spdx:v2:file` | File information | +| `spdx:v2:package` | Package information | + +| Property | +| --- | +| `spdx:v2:annotation` | +| `spdx:v2:comment` | +| `spdx:v2:download-location` | +| `spdx:v2:files-analyzed` | +| `spdx:v2:homepage` | +| `spdx:v2:license-comments` | +| `spdx:v2:license-concluded` | +| `spdx:v2:license-declared` | +| `spdx:v2:license-info-from-file` | +| `spdx:v2:spdxid` | + +## `spdx:v2:checksum` Namespace Taxonomy + +| Property | +| --- | +| `spdx:v2:checksum:md2` | +| `spdx:v2:checksum:md4` | +| `spdx:v2:checksum:md6` | +| `spdx:v2:checksum:sha225` | + +## `spdx:v2:document` Namespace Taxonomy + +| Property | +| --- | +| `spdx:v2:document:data-license` | +| `spdx:v2:document:describes` | +| `spdx:v2:document:document-namespace` | +| `spdx:v2:document:external-document-ref` | +| `spdx:v2:document:name` | +| `spdx:v2:document:spdx-version` | + +## `spdx:v2:creation-info` Namespace Taxonomy + +| Property | +| --- | +| `spdx:v2:creation-info:comment` | +| `spdx:v2:creation-info:creators-organization` | +| `spdx:v2:creation-info:license-list-version` | + +## `spdx:v2:external-reference` Namespace Taxonomy + +| Property | +| --- | +| `spdx:v2:external-reference:security:cpe22` | +| `spdx:v2:external-reference:security:cpe23` | +| `spdx:v2:external-reference:package-manager:bower` | +| `spdx:v2:external-reference:package-manager:maven-central` | +| `spdx:v2:external-reference:package-manager:npm` | +| `spdx:v2:external-reference:package-manager:nuget` | +| `spdx:v2:external-reference:package-manager:purl` | +| `spdx:v2:external-reference:persistent-id:swh` | +| `spdx:v2:external-reference:other` | + +## `spdx:v2:file` Namespace Taxonomy + +| Property | +| --- | +| `spdx:v2:file:type` | +| `spdx:v2:file:contributor` | +| `spdx:v2:file:notice-text` | + +## `spdx:v2:package` Namespace Taxonomy + +| Property | +| --- | +| `spdx:v2:package:file-name` | +| `spdx:v2:package:originator:email` | +| `spdx:v2:package:originator:organization` | +| `spdx:v2:package:source-info` | +| `spdx:v2:package:summary` | +| `spdx:v2:package:supplier:organization` | +| `spdx:v2:package:verification-code:value` | +| `spdx:v2:package:verification-code:excluded-file` |