System Package Data Exchange™ (SPDX®) Ontology
This ontology defines the terms and relationships used in the SPDX specification to describe system packages
SPDX Project
System Package Data Exchange (SPDX) Ontology
Copyright (C) SPDX Project
An Individual Value for Element representing a set of Elements of unknown identity or cardinality (number).
An Individual Value for Element representing a set of Elements with cardinality (number/count) of zero.
An Individual Value for License when no assertion can be made about its actual value.
An Individual Value for License where the SPDX data creator determines that no license is present.
mass
Information related to physical hardware.
Mass is defined as an intrinsic property of a body for describing a physical hardware component.
exportControlClassificationResult
Provides the result of an export control assessment.
AIPackage
A Package that contains AI software or an AI model.
A Package that contains code or a model that provides artificial intelligence capabilities.
kilowattHour
Kilowatt-hour.
megajoule
Megajoule.
other
Any other units of energy measurement.
high
The second-highest level of risk posed by an AI system.
low
Low/no risk is posed by an AI system.
medium
The third-highest level of risk posed by an AI system.
serious
The highest level of risk posed by an AI system.
autonomyType
**DEPRECATED in SPDX 3.1.** Use /Core/isoAutomationLevel instead. Indicates whether the system can perform a decision or action without human involvement or guidance.
**NOTE:** This property is deprecated and only included for backward compatibility. New documents should use /Core/isoAutomationLevel instead. Indicates if the system is fully automated or a human is involved in any of the decisions of the AI system. - yes: Indicates that the system is fully automated. - no: Indicates that a human is involved in any of the decisions of the AI system. - noAssertion: Makes no assertion about the autonomy.
domain
Domain in which the AI package can be used.
A free-form text that describes the domain where the AI model contained in the AI software can be expected to operate successfully. Examples include computer vision, natural language processing, etc.
energyConsumption
Energy consumption incurred by an AI model.
Energy consumption of an AI model, either known or estimated. In the absence of direct measurements, an SPDX data creator may choose to estimate the energy consumption based on information about computational resources (e.g., number of floating-point operations), training time, and other relevant training details.
energyQuantity
Energy quantity.
Provides the quantity information of the energy.
energyUnit
Unit in which energy is measured.
Provides the unit information of the energy.
finetuningEnergyConsumption
Energy consumed when finetuning the AI model that is being used in the AI system.
The field specifies the amount of energy consumed when finetuning the AI model that is being used in the AI system.
hyperparameter
Hyperparameter used to build the AI model contained in the AI package.
Records a hyperparameter value. Hyperparameters are settings defined before the training process that control the learning algorithm's behavior. They differ from model parameters, which are learned from the data during training. Developers typically set hyperparameters manually or through a process of hyperparameter tuning (also known as trial and error). Examples of hyperparameters include learning rate, batch size, and the number of layers in a neural network.
inferenceEnergyConsumption
Energy consumed during inference time by an AI model that is being used in the AI system.
The field specifies the amount of energy consumed during inference time by an AI model that is being used in the AI system.
informationAboutApplication
Information about the AI software, not including the model description.
A free-form text description of how the AI model is used within the software. It should include any relevant information, such as pre-processing steps, third-party APIs, and other pertinent details. It can also include: - Functionality provided by the AI model within the software application, including: any specific tasks or decisions it is designed to perform; any pre-processing steps that are applied to the input data before it is fed into the AI model for inference, such as data cleaning, normalization, or feature extraction; and any third-party APIs or services that are used in conjunction with the AI model, such as data sources, cloud services, or other AI models. - Description of any dependencies or requirements needed to run the AI model within the software application, including: specific hardware, software libraries, and operating systems.
informationAboutTraining
Information about different steps of the training process.
A detailed explanation of the training process, including the specific techniques, algorithms, and methods employed. Examples include: - training data used to train the AI model, along with any relevant details about its source, quality, and pre-processing steps; - specific training algorithms employed, including stochastic gradient descent, backpropagation, and reinforcement learning; - specific training techniques used to improve the performance or accuracy of the AI model, such as transfer learning, fine-tuning, or active learning; and - any evaluation metrics used to assess the performance of the AI model during the training process, including accuracy, precision, recall, and F1 score.
limitation
Limitation of the AI software.
A free-form text that captures a limitation of the AI package (or of the AI models present in the AI package). Note that this is not guaranteed to be exhaustive. For instance, a limitation can be that the AI package is having poor accuracy for a certain demography.
metric
Metric used to evaluate the AI model.
Metric used to evaluate the AI model. This makes statements about the prediction quality including uncertainty, accuracy, characteristics of the tested population, quality, fairness, explainability, robustness etc.
metricDecisionThreshold
Threshold that was used for computation of a metric described in the metric field.
Each metric can be computed based on a decision threshold. For instance, precision or recall is typically computed by checking if the probability of the outcome is larger than 0.5. Each decision threshold shall match with a metric field defined in the AI package.
modelDataPreprocessing
Preprocessing steps applied to the training data before the model training.
A free-form text that describes the preprocessing steps applied to the training data before training of the model(s) contained in the AI software.
modelExplainability
Methods that can be used to explain the results from the AI model.
A free-form text that lists the different explainability mechanisms and how they can be used to explain the results from the AI model. The mechanisms can be model-agnostic methods, such as SHapley Additive exPlanations (SHAP) <https://shap.readthedocs.io/> and Local Interpretable Model-agnostic Explanations (LIME) <https://github.com/marcotcr/lime>, and model-specific methods that applied to a limited category of models.
safetyRiskAssessment
Results of general safety risk assessment of the AI system.
Results of general safety risk assessment of the AI system. Using categorization according to the EU general risk assessment methodology <https://ec.europa.eu/docsroom/documents/17107>. The methodology implements Article 20 of Regulation (EC) No 765/2008 and is intended to assist authorities when they assess general product safety compliance. It is important to note that this categorization differs from the one proposed in the EU AI Act's provisional agreement.
standardCompliance
A standard with which the artifact complies.
A free-form textual description that captures a standard with which the artifact complies. The standard may, but is not necessarily required to, satisfy a legal or regulatory requirement. If the artifact is using a standard as a reference or guideline, but not necessarily compliant with it, use the /Core/standardName property instead. For a detailed compliance information, please consider defining a /Core/Relationship with "conformsTo" relationship type to a /Core/Regulation.
trainingEnergyConsumption
Energy consumed when training the AI model that is being used in the AI system.
The field specifies the amount of energy consumed when training the AI model that is being used in the AI system.
typeOfModel
Type of the model used in the AI software.
A free-form text that records the type of the AI model(s) used in the software. For instance, if it is a supervised model, unsupervised model, reinforcement learning model or a combination of those.
useSensitivePersonalInformation
Records if sensitive personal information is used during model training or could be used during the inference.
Notes if sensitive personal information is used in the training or inference of the AI models. This can include biometric data, addresses or other data that can be used to infer a person's identity. Related: hasSensitivePersonalInformation in /Dataset/DatasetPackage
buildEndTime
**DEPRECATED in SPDX 3.1.** Use /Core/endTime instead. Property that describes the time at which a build stops.
**NOTE:** This property is deprecated and only included for backward compatibility. New documents should use /Core/endTime instead. buildEndTime describes the time at which a build stops or finishes. This value is typically recorded by the builder.
buildId
A buildId is a locally unique identifier used by a builder to identify a unique instance of a build produced by it.
A buildId is a locally unique identifier to identify a unique instance of a build, according to the buildType. This identifier differs based on build toolchain, platform, or naming convention used by an organization or standard.
buildStartTime
**DEPRECATED in SPDX 3.1.** Use /Core/startTime instead. Property describing the start time of a build.
**NOTE:** This property is deprecated and only included for backward compatibility. New documents should use /Core/startTime instead. buildStartTime is the time at which a build is triggered. The builder typically records this value.
buildType
A buildType is a hint that is used to indicate the toolchain, platform, or infrastructure that the build was invoked on.
A buildType is an IRI expressing the toolchain, platform, or infrastructure that the build was invoked on. The buildType is used to interpret the meaning of other build parameters by defining the "type" of build; if the same buildType is seen in different Build elements, it means they are the same kind of build, but difference instances and possible with different configurations. If you are not using a well-known buildType, it should be namespaced to a domain you own to prevent conflicts with other buildType IRIs. Examples of a buildType can be: - A GitHub action workflow - A step in a GitHub actions pipeline - An invocation of a compiler or other tool - A script that orchestrates builds at a higher level Keep in mind that builds can be "nested" using the ancestorOf relationship. If the buildType IRI is not recognized, it is still possible to inspect other properties of the build, but it may not be possible to derive deeper meaning from them. For more information, see the SLSA definition of buildType.
configSourceDigest
Property that describes the digest of the build configuration file used to invoke a build.
configSourceDigest is the checksum of the build configuration file used by a builder to execute a build, according to the buildType. This property uses the Core model's Hash class.
configSourceEntrypoint
Property describes the invocation entrypoint of a build.
A build entrypoint is the invoked executable of a build which always runs when the build is triggered, according to the buildType. For example, when a build is triggered by running a shell script, the entrypoint is script.sh. In terms of a declared build, the entrypoint is the position in a configuration file or a build declaration which is always run when the build is triggered. For example, in the following configuration file, the entrypoint of the build is publish. name: Publish packages to PyPI on: create: tags: "*" jobs: publish: runs-on: ubuntu-latest if: startsWith(github.ref, 'refs/tags/') steps: ...
configSourceUri
Property that describes the URI of the build configuration source file.
If a build configuration exists for the toolchain or platform performing the build, the configSourceUri of a build is the URI of that build configuration, according to the buildType. For example, a build triggered by a GitHub Action is defined by a build configuration YAML file. In this case, the configSourceUri is the URL of that YAML file.
environment
Property describing the session in which a build is invoked.
environment is a map of environment variables and values that are set during a build session, according to the buildType. This is different from the parameter property in that it describes the environment variables set before a build is invoked rather than the variables provided to the builder.
parameter
Property describing a parameter used in an instance of a build.
parameter is a key-value of a build parameter and its value that was provided to the builder for a build instance, according to the buildType. This is different from the environment property in that the key and value are provided as command line arguments or a configuration file to the builder.
Used to store extra information about an Element which is not part of a review (e.g. extra information provided during the creation of the Element).
review
Used when someone reviews the Element.
compliance
A contact point for compliance (i.e. export control, licensing).
A generic contact point to be used when the contact type does not match any of the other options.
securityVulnerability
A contact for reporting security vulnerabilities.
support
A contact point for support.
ark
Archival Resource Key (ARK) <https://arks.org/about/>, is a Uniform Resource Identifier (URI) suited to being a persistent identifier for information objects of any type, standardized by the ARK Identifier Scheme <https://datatracker.ietf.org/doc/draft-kunze-ark/> Internet-Draft. It consists of the "ark:" label followed by a Name Assigning Authority Number, a forward slash, a name, and an optional qualifier (e.g., ark:12148/btv1b8449691v/f29).
bic
Business Identifier Code (BIC), also known as SWIFT-BIC or SWIFT code, is a unique 8 or 11-character alphanumeric code standardized by ISO 9362 <https://www.iso.org/standard/84108.html> to identify financial and non-financial institutions (e.g., BBWCUS33).
cpe22
Common Platform Enumeration Specification 2.2 <https://cpe.mitre.org/files/cpe-specification_2.2.pdf>.
cpe23
Common Platform Enumeration: Naming Specification Version 2.3 <https://csrc.nist.gov/publications/detail/nistir/7695/final>.
cve
Common Vulnerabilities and Exposures identifiers, an identifier for a specific software flaw defined within the official CVE Dictionary and that conforms to the CVE specification <https://csrc.nist.gov/glossary/term/cve_id>.
doi
Digital Object Identifier (DOI) <https://www.doi.org/the-identifier/what-is-a-doi/> is a unique, ISO 26324 <https://www.iso.org/standard/88862.html>-standardized identifier for physical, digital, or abstract objects, formatted as a prefix and suffix separated by a forward slash (e.g., 10.1000/182).
duns
Data Universal Numbering System (D-U-N-S) Number <https://www.dnb.com/en-us/smb/duns.html> is a unique nine-digit identifier, issued by Dun & Bradstreet, that identifies a business entity, often on a location-specific basis.
ecli
European Case Law Identifier (ECLI) <https://data.europa.eu/data/datasets/european-case-law-identifier-ecli> is a uniform identifier for judicial decisions across Europe. It consists of five mandatory components: the "ECLI" prefix, a country code, a court code, the year of the decision, and a unique serial number (e.g., ECLI:EU:C:2023:94).
eli
European Legislation Identifier (ELI) <https://eur-lex.europa.eu/content/help/eurlex-content/eli.html> is a Uniform Resource Identifier (URI) that uniquely identifies a legal resource, typically consisting of a document type, adoption year, and document number (e.g., http://data.europa.eu/eli/reg/2024/2847/oj).
email
Email address, as defined in RFC 3696 <https://datatracker.ietf.org/doc/rfc3696/> Section 3.
eori
Economic Operators Registration and Identification (EORI) number <https://taxation-customs.ec.europa.eu/customs/customs-procedures-import-and-export/customs-operations/economic-operators-registration-and-identification-number-eori_en> is a unique identifier for businesses undertaking customs operations across European Union customs territory, such as import, export, and transit. It consists of an ISO 3166-1 alpha-2 country code followed by a national identifier of up to 15 alphanumeric characters (e.g., PL1234567890ABCDE).
evidenceUID
The unique identifier used by a reporting management system or any other lifecycle management tool to uniquely identify an evidence relationship item.
gitoid
Gitoid <https://www.iana.org/assignments/uri-schemes/prov/gitoid>, stands for Git Object ID <https://git-scm.com/book/en/v2/Git-Internals-Git-Objects>. A gitoid of type blob is a unique hash of a binary artifact. A gitoid may represent either an Artifact Identifier <https://github.com/omnibor/spec/blob/eb1ee5c961c16215eb8709b2975d193a2007a35d/spec/SPEC.md#artifact-identifier-types> for the software artifact or an Input Manifest Identifier <https://github.com/omnibor/spec/blob/eb1ee5c961c16215eb8709b2975d193a2007a35d/spec/SPEC.md#input-manifest-identifier> for the software artifact's associated Artifact Input Manifest <https://github.com/omnibor/spec/blob/eb1ee5c961c16215eb8709b2975d193a2007a35d/spec/SPEC.md#artifact-input-manifest>; this ambiguity exists because the Artifact Input Manifest is itself an artifact, and the gitoid of that artifact is its valid identifier. Gitoids calculated on software artifacts (Snippet, File, or Package Elements) should be recorded in the SPDX 3 SoftwareArtifact's contentIdentifier property. Gitoids calculated on the Artifact Input Manifest (Input Manifest Identifier) should be recorded in the SPDX 3 Element's externalIdentifier property. See OmniBOR Specification <https://github.com/omnibor/spec/>, a minimalistic specification for describing software Artifact Dependency Graphs <https://github.com/omnibor/spec/blob/eb1ee5c961c16215eb8709b2975d193a2007a35d/spec/SPEC.md#artifact-dependency-graph-adg>.
gln
Global Location Number (GLN) <https://www.gs1.org/standards/id-keys/gln> is a 13-digit number, assigned by GS1, that uniquely identifies a legal entity (e.g., a company or customer), a function within a legal entity, a physical location (e.g., a warehouse or a specific shelf in a store), or a digital location (e.g., an Electronic Data Interchange (EDI) gateway).
glue
GLobal Unique Enterprise (GLUE) Identifiers <https://datatracker.ietf.org/doc/draft-ietf-spice-glue-id/>, as defined by the IETF Internet-Draft, is expressed as a GLUE URI, a Uniform Resource Identifier that standardizes the representation of existing organizational entity identifiers.
gtin
Global Trade Item Number (GTIN) <https://www.gs1.org/standards/id-keys/gtin> is a number, assigned by GS1, that uniquely identifies a trade item (product or service).
hsCodes
The Harmonized System (HS) <https://www.wcoomd.org/en/topics/nomenclature/overview/what-is-the-harmonized-system.aspx> of tariff nomenclature is an internationally standardized system of names and numbers, defined by the World Customs Organization, used to classify traded products.
iban
International Bank Account Number (IBAN) is a system for identifying bank accounts across national borders standardized by ISO 13616 <https://www.iso.org/standard/81090.html>. It consists of up to 34 alphanumeric characters, including a country code, two check digits, and a basic bank account number. While spaces may be inserted for human readability, they must be omitted when used for electronic data exchange (e.g., IE64IRCE92050112345678).
ibid
International Business Identifier (IBID) <https://ekys.org/business_identifiers/> is a verifiable unique identifier for legal entities as defined in the ISO/DIS 25500-3 <https://www.iso.org/standard/87705.html> draft standard. It is composed of three data elements: the International Business Registration Number (IBRN), the legal name, and the date of origin formatted as eight numeric characters (YYYYMMDD). Each element is separated by a pipe character (|) (e.g., US-DE.BER:3031657|Code Management Association|19990420).
ibrn
International Business Registration Number (IBRN) <https://ekys.org/business_identifiers/> is a unique identifier for legal entities standardized by ISO 8000-116 <https://www.iso.org/standard/75117.html>. It is composed of two parts: a jurisdiction prefix and a local authoritative legal entity identifier (ALEI), separated by a colon. The prefix contains an ISO 3166 country code, an optional subdivision code, and a register code (e.g., US-DE.BER:3031657).
isan
International Standard Audiovisual Number (ISAN) <https://www.isan.org/about/#what_is_isan> is a unique 24-digit hexadecimal identifier for audiovisual works standardized by ISO 15706 <https://www.iso.org/standard/83124.html>. The ISAN remains persistent for a work regardless of its distribution format or its use. To facilitate human readability, the "ISAN" label, grouping hyphens, and two check characters are included (e.g., ISAN 0000-0000-3A8D-0000-Z-0000-0000-6); however, these elements shall be omitted when the identifier is stored electronically (e.g., 000000003A8D000000000000).
isbn
International Standard Book Number (ISBN) <https://www.isbn-international.org/content/isbn-users-manual/29> is a unique numeric identifier for monographic publications standardized by ISO 2108 <https://www.iso.org/standard/65483.html>. It consists of either 10 digits (for assignments prior to January 1, 2007) or 13 digits. A 13-digit ISBN is composed of five parts: a GS1 prefix, a registration group, a registrant, a publication element, and a check digit. While elements may be divided by spaces or hyphens for human readability, these separators shall be omitted when the identifier is stored electronically (e.g., 9780198836063).
iscc
International Standard Content Code (ISCC) <https://iscc.io/> is a content-derived identifier standardized by ISO 24138 <https://www.iso.org/standard/77899.html> for identifying digital assets. ISCC can be used in conjunction with other schemes, such as DOI, ISAN, ISBN, ISRC, ISSN and ISWC. A standard ISCC-CODE is build from multiple ISCC-UNITs. Each unit serve a different purpose. An ISCC-CODE typically look like ISCC:KACT4EBWK27737D2AYCJRAL5Z36G76RFRMO4554RU26HZ4ORJGIVHDI.
isci
International Standard Collection Identifier (ISCI) is a variable-length identifier standardized by ISO 27730 <https://www.iso.org/standard/44293.html> for identifying collections held by libraries, archives, museums, and other memory institutions. It consists of two parts: the identifier for the assigning organization (an ISIL) enclosed in square brackets, followed by a local collection identifier string (e.g., [FR-751041001]Casadesus1).
isil
International Standard Identifier for Libraries and Related Organizations (ISIL) <https://slks.dk/english/work-areas/libraries-and-literature/library-standards/isil/> is a unique alphanumeric code for identifying libraries, archives, museums, and related organizations standardized by ISO 15511 <https://www.iso.org/standard/77849.html>. It consists of a prefix—which may be an ISO 3166-1 alpha-2 country code or a non-country code assigned by the ISIL Registration Authority—followed by a unit identifier, totaling up to 16 characters (e.g., FI-Sipoo-Sö or ZDB-1-SBD). Valid symbols include any alphanumeric character, solidus (/), hyphen-minus (-), or colon.
ismn
International Standard Music Number (ISMN) <https://ismn-international.org/ismn/the-ismn/> is a unique numeric identifier for printed music (notated music) standardized by ISO 10957 <https://www.iso.org/standard/83122.html>. It consists of either 10 characters (starting with the letter "M" for assignments prior to January 1, 2008) or 13 digits. A 13-digit ISMN is composed of four parts: the GS1 prefix 979-0, a registrant element, an item element, and a check digit. While elements may be divided by spaces or hyphens for human readability, these separators shall be omitted when the identifier is stored electronically (e.g., 9790006538424).
isni
International Standard Name Identifier (ISNI) <https://isni.org/page/what-is-isni/> is a unique identifier used to distinguish the public identities of parties involved in the creation, production, and distribution of media content. Standardized by ISO 27729 <https://www.iso.org/standard/87177.html>, it consists of 16 characters—15 digits plus a final check character—and is often represented as a URI, such as https://isni.org/isni/000000012146438X.
isrc
International Standard Recording Code (ISRC) <https://isrc.ifpi.org/isrc-standard> is a unique 12-character alphanumeric identifier for sound recordings and music video recordings standardized by ISO 3901 <https://www.iso.org/standard/64817.html>. While the "ISRC" label and grouping hyphens used for human readability, they shall be omitted when the identifier is stored electronically (e.g., USCA28900153).
issn
International Standard Serial Number (ISSN) <https://www.issn.org/understanding-the-issn/what-is-an-issn/> is an eight-digit identifier for serial publications and other continuing resources standardized by ISO 3297 <https://www.iso.org/standard/84536.html>. It consists of two groups of four digits separated by a hyphen, where the final character is a check digit that may be an "X". The hyphen is retained when the identifier is stored electronically to maintain the standard 9-character string format (e.g., 1464-3693). The ISSN is media-specific; the same journal title may be assigned different identifiers for its physical and digital versions.
iswc
International Standard Musical Work Code (ISWC) <https://www.iswc.org/iswc> is an 11-character unique identifier standardized by ISO 15707 <https://www.iso.org/standard/83125.html> for musical works (compositions) as distinct from specific recordings. While the "ISWC" label and grouping separators (dots and hyphens) are used for human readability, they shall be omitted when the identifier is stored electronically (e.g., T0017812031).
lei
The Legal Entity Identifier (LEI) <https://www.gleif.org/en/organizational-identity/introducing-the-legal-entity-identifier-lei> is a 20-character, alphanumeric code based on the ISO 17442 <https://www.iso.org/standard/78829.html> standard developed by the International Organization for Standardization.
lexid
LEX Identifier is a Uniform Resource Name (URN) for sources of law within the LEX namespace <https://www.iana.org/assignments/urn-formal/lex>, as defined in RFC 9676 <https://datatracker.ietf.org/doc/rfc9676/> (e.g., urn:lex:it:stato:decreto.legislativo:2018-08-10;101).
nli
Natural Location Identifier (NLI) <https://eccma.org/enli-eccma-natural-location-identifier/> is a 14- or 15-character alphanumeric string standardized by ISO 8000-118 <https://www.iso.org/standard/85428.html> that uniquely identifies a three-dimensional geographic point location. The identifier is generated from geodetic coordinates and elevation data. For electronic storage, the ISO.NLI: prefix shall be retained (e.g., ISO.NLI:41TS8M-A8ELTQ-H2).
orcidid
Open Researcher and Contributor ID (ORCID) iD <https://info.orcid.org/what-is-orcid/> is a unique identifier for authors and contributors in scholarly communication; as a subset of the International Standard Name Identifier (ISNI), it typically appears as a URI such as https://orcid.org/0000-0002-1825-0097.
Used when the type does not match any of the other options.
packageUrl
Package-URL (PURL), as defined in ECMA-427 <https://ecma-international.org/publications-and-standards/standards/ecma-427/>.
phoneNumber
Phone number; A string of decimal digits that uniquely indicates the network termination point defined in RFC 3966 <https://datatracker.ietf.org/doc/rfc3966/> Section 5.
requirementUID
The unique identifier used by a requirements management or any other lifecycle management tool to uniquely identify a requirement item.
rorid
Research Organization Registry (ROR) identifier <https://ror.org/about/> is a unique identifier for research and funding organization, typically expressed in its preferred URI form such as https://ror.org/02mhbdp94.
securityOther
Used when there is a security related identifier of unspecified type.
swhid
SoftWare Hash IDentifier, a persistent intrinsic identifier for digital artifacts, such as files, trees (also known as directories or folders), commits, and other objects typically found in version control systems. The format of the identifiers is defined in the SWHID specification <https://www.swhid.org/swhid-specification/v1.2/> (ISO/IEC 18670 <https://www.iso.org/standard/89985.html>). They typically look like swh:1:cnt:94a9ed024d3859793618152ea559a168bbcbb5e2.
swid
Concise Software Identification (CoSWID) tag, as defined in RFC 9393 <https://datatracker.ietf.org/doc/rfc9393/> Section 2.3.
urlScheme
Uniform Resource Identifier (URI) Schemes <https://www.iana.org/assignments/uri-schemes/uri-schemes.xhtml>. The scheme used in order to locate a resource.
vatNumber
Value Added Tax (VAT) number, or Goods and Services Tax (GST) number, is an identifier assigned by tax authorities that uniquely identifies a business within a specific national border or tax jurisdiction for the collection and tracking of VAT/GST.
verificationUID
The unique identifier used by a verification management system or any other lifecycle management tool to uniquely identify a verification item.
webpage
A Uniform Resource Locator (URL) that can be used to locate a resource, as defined in RFC 9110 <https://datatracker.ietf.org/doc/rfc9110/> Section 4.2.1 or Section 4.2.2. It may include an optional fragment identifier as specified in RFC 3986 <https://datatracker.ietf.org/doc/rfc3986> Section 3.5.
altDownloadLocation
A reference to an alternative download location.
altWebPage
A reference to an alternative web page.
binaryArtifact
A reference to binary artifacts related to a package.
bom
A reference to a bill of materials related to a package.
bower
A reference to a Bower package. The package locator format, looks like package#version, is defined in the "install" section of Bower API documentation <https://bower.io/docs/api/#install>.
buildMeta
A reference to the build metadata related to a published package.
buildSystem
A reference to the build system used to create or publish the package.
certificationReport
A reference to a certification report for a package from an accredited/independent body.
chat
A reference to the instant messaging system used by the maintainer for a package.
componentAnalysisReport
A reference to a Software Composition Analysis (SCA) report.
cwe
Common Weakness Enumeration <https://csrc.nist.gov/glossary/term/common_weakness_enumeration>. A reference to a source of software flaws defined within the official CWE List <https://cwe.mitre.org/data/> that conforms to the CWE specification <https://cwe.mitre.org/>.
documentation
A reference to the documentation for a package.
dynamicAnalysisReport
A reference to a dynamic analysis report for a package.
eolNotice
A reference to the End Of Sale (EOS) and/or End Of Life (EOL) information related to a package.
exportControlAssessment
A reference to an export control assessment for a package.
funding
A reference to funding information related to a package.
issueTracker
A reference to the issue tracker for a package.
license
A reference to additional license information related to an artifact.
mailingList
A reference to the mailing list used by the maintainer for a package.
mavenCentral
A reference to a Maven repository artifact. The artifact locator format is defined in the Maven documentation <https://maven.apache.org/guides/mini/guide-naming-conventions.html> and looks like groupId:artifactId[:version].
metrics
A reference to metrics related to a package such as OpenSSF scorecards.
npm
A reference to an npm package. The package locator format is defined in the npm documentation <https://docs.npmjs.com/cli/v10/configuring-npm/package-json> and looks like package@version.
nuget
A reference to a NuGet package. The package locator format is defined in the NuGet documentation <https://docs.nuget.org> and looks like package/version.
privacyAssessment
A reference to a privacy assessment for a package.
productMetadata
A reference to additional product metadata such as a reference within an organization's product catalog.
purchaseOrder
A reference to a purchase order for a package.
qualityAssessmentReport
A reference to a quality assessment for a package.
releaseHistory
A reference to a published list of releases for a package.
releaseNotes
A reference to the release notes for a package.
riskAssessment
A reference to a risk assessment for a package.
runtimeAnalysisReport
A reference to a runtime analysis report for a package.
secureSoftwareAttestation
A reference to information assuring that the software is developed using security practices as defined by NIST SP 800-218 Secure Software Development Framework (SSDF) Version 1.1 <https://csrc.nist.gov/pubs/sp/800/218/final> or CISA Secure Software Development Attestation Form <https://www.cisa.gov/resources-tools/resources/secure-software-development-attestation-form>.
securityAdversaryModel
A reference to the security adversary model for a package.
securityAdvisory
A reference to a published security advisory (where advisory is defined per ISO 29147:2018 <https://www.iso.org/standard/72311.html>) that may affect one or more elements, e.g., vendor advisories or specific NVD entries.
securityFix
A reference to the patch or source code that fixes a vulnerability.
A reference to related security information of unspecified type.
securityPenTestReport
A reference to a penetration test <https://en.wikipedia.org/wiki/Penetration_test> report for a package.
securityPolicy
A reference to instructions for reporting newly discovered security vulnerabilities for a package.
securityThreatModel
A reference to the security threat model <https://en.wikipedia.org/wiki/Threat_model> for the package.
socialMedia
A reference to a social media channel for a package.
sourceArtifact
A reference to an artifact containing the sources for a package.
staticAnalysisReport
A reference to a static analysis report for a package.
A reference to the software support channel or other support information for a package.
vcs
A reference to a version control system related to a software artifact.
vulnerabilityDisclosureReport
A reference to a Vulnerability Disclosure Report (VDR) which provides the software supplier's analysis and findings describing the impact (or lack of impact) that reported vulnerabilities have on packages or products in the supplier's SBOM as defined in NIST SP 800-161 Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations <https://csrc.nist.gov/pubs/sp/800/161/r1/final>.
vulnerabilityExploitabilityAssessment
A reference to a Vulnerability Exploitability eXchange (VEX) statement which provides information on whether a product is impacted by a specific vulnerability in an included package and, if affected, whether there are actions recommended to remediate. See also NTIA VEX one-page summary <https://ntia.gov/files/ntia/publications/vex_one-page_summary.pdf>.
x509Cert
A reference to an X.509 certificate as defined in RFC 5280 <https://datatracker.ietf.org/doc/rfc5280/>. The primary media type shall be application/pkix-cert. The legacy media types application/x-x509-ca-cert and application/x-x509-user-cert may be used for backward compatibility, but shall not be used in new implementations. NOTE — RFC 5280 supersedes earlier X.509 profiles, including RFC 1422. Existing references based on RFC 1422 remain valid.
assistiveAutomation
Level 1 - Assistive automation. The system assists an operator.
autonomous
Level 6 - Autonomous. The system is capable of modifying its intended domain of use or its goals without external intervention, control or oversight.
conditionalAutomation
Level 3 - Conditional automation. The system can propose strategies and then automatically execute the approved plan, with an external agent being ready to take over when necessary.
fullAutomation
Level 5 - Full automation. The system is capable of performing its entire mission without external intervention.
highAutomation
Level 4 - High automation. The system performs parts of its mission without external intervention.
notAutomated
Level 0 - Not automated. No automation. The operator fully controls the system.
partialAutomation
Level 2 - Partial automation or task automation. Some sub-functions of the system are fully automated while the system remain under control of an external agent. The system can perform actions for an approved task without requiring the agent's continuous direct control.
Person
An individual human being.
A Person is an individual human being.
active
In use.
draft
Not yet finalized; under development or review.
obsoleted
Superseded or not valid at present.
Other.
The element follows the AI profile specification.
build
The element follows the Build profile specification.
core
The element follows the Core profile specification.
dataset
The element follows the Dataset profile specification.
expandedLicensing
The element follows the ExpandedLicensing profile specification.
extension
The element follows the Extension profile specification.
functionalSafety
The element follows the FunctionalSafety profile specification.
hardware
The element follows the Hardware profile specification.
lite
The element follows the Lite profile specification.
operations
The element follows the Operations profile specification.
security
The element follows the Security profile specification.
service
The element follows the Service profile specification.
simpleLicensing
The element follows the SimpleLicensing profile specification.
software
The element follows the Software profile specification.
supplyChain
The element follows the SupplyChain profile specification.
Regulation
Regulation represents a rule or directive maintained by an authority.
The Regulation class represents any rules or directives enforced by an official authority. Regulations within this class can be either mandatory or voluntary. Examples of these regulations include the EU Radio Equipment Directive, EU Cyber Resilience Act, the Japan Cyber STAR, or the U.S. Cyber Trust Mark.
complete
The relationship is known to be exhaustive.
incomplete
The relationship is known not to be exhaustive.
noAssertion
No assertion can be made about the completeness of the relationship.
amendedBy
The from Element is amended by each to Element.
ancestorOf
The from Element is an ancestor of each to Element.
availableFrom
The from Element is available from the additional supplier described by each to Element.
contains
The from Element contains each to Element.
copiedTo
The from Element has been copied to each to Element.
descendantOf
The from Element is a descendant of each to Element.
describes
The from Element describes each to Element. To denote the root(s) of a tree of elements in a collection, the rootElement property shall be used.
evaluatedOn
The from Element has been evaluated on the to Element(s).
expandsTo
The from Element expands out as an artifact described by each to Element.
finetunedOn
The from Element has been finetuned on the to Element(s).
follows
The to Element succeeds the from Element, establishing a unidirectional sequence. This succession is defined as chronological, procedural, or logical. It is used to represent either a temporal order (e.g., in a workflow) or a logical order for processing and traversal (e.g., in an ordered list).
generates
The from Element generates each to Element.
hasAddedFile
Every to Element is a file added to the from Element (from hasAddedFile to).
hasDataFile
The from Element treats each to Element as a data file. A data file is an artifact that stores data required or optional for the from Element's functionality. A data file can be a database file, an index file, a log file, an AI model file, a calibration data file, a temporary file, a backup file, and more. For AI training dataset, test dataset, test artifact, configuration data, build input data, and build output data, please consider using the more specific relationship types: trainedOn, testedOn, hasTest, configures, hasInput, and hasOutput, respectively. This relationship does not imply dependency.
hasDeletedFile
Every to Element is a file deleted from the from Element (from hasDeletedFile to).
hasDependencyManifest
The from Element has manifest files that contain dependency information in each to Element.
hasDistributionArtifact
The from Element is distributed as an artifact in each to Element (e.g. an RPM or archive file).
hasDocumentation
The from Element is documented by each to Element.
hasEvidence
Every to Element is considered as evidence for the from Element (from hasEvidence to).
hasExample
Every to Element is an example for the from Element (from hasExample to).
hasMetadata
Every to Element is metadata about the from Element (from hasMetadata to).
hasOptionalComponent
Every to Element is an optional component of the from Element (from hasOptionalComponent to).
hasTestCase
Every to Element is a test case for the from Element (from hasTestCase to).
hasVariant
Every to Element is a variant the from Element (from hasVariant to).
modifiedBy
The from Element is modified by each to Element.
Every to Element is related to the from Element where the relationship type is not described by any of the SPDX relationship types (this relationship is directionless).
packagedBy
Every to Element is a packaged instance of the from Element (from packagedBy to).
patchedBy
Every to Element is a patch for the from Element (from patchedBy to).
pretrainedOn
The from Element has been pretrained on the to Element(s).
republishedBy
Designates a from /Security/Vulnerability's details were tracked, aggregated, and/or enriched to improve context (i.e. NVD) by each to Agent.
resolved
The to /SupplyChain/OutOfSpecAction is resolved in the from /SupplyChain/ResolutionAction.
testedOn
The from Element has been tested on the to Element(s).
trainedOn
The from Element has been trained on the to Element(s).
validatedOn
The from Element has been validated on the to Element(s).
A requirement has been approved by stakeholder, and can be include in traceability.
backlog
A requirement has been captured and logged, but not yet ready to become a formal requirement draft. A backlog requirement may still be incomplete or ambiguous.
A requirement is considered a draft state and may be modified before being submitted for review.
retired
A requirement is no longer active for a specific use.
reviewable
A requirement is ready for formal review by stakeholders for a specific use.
SoftwareAgent
A software agent.
A SoftwareAgent is a software program that is given the authority (similar to a user's authority) to act on a system.
formalStandard
A formal standard is a standard ratified by a recognized standards-development organization and published as a normative reference.
Any specification that does not fall under any of the other entries.
regulation
A mandatory legal specification issued by a governmental or regulatory authority. Compliance is enforceable by law.
specification
A specification is a detailed document (or set of documents) that describes the requirements, design, behavior, or other characteristics of a system, component, or process so that all stakeholders have a clear, unambiguous reference.
actionLocation
Location of a specific action.
The location of an action is defined by the actionLocation. Action locations help define and validate a specific action.
additionalInformation
Additional relevance information.
This element provides relevant information to the action.
annotationType
Describes the type of annotation.
An annotationType describes the type of an annotation.
assignedBy
assignedBy identifies the agent that grants or assigns the role to the target element.
assignedBy is an property that specifies the agent responsible for assigning the givenRole to the target element. This property tracks who assigned the role, providing accountability and traceability for role assignments.
authorization
Authorization specifies the permissions, rights, privileges, or benefits granted to a Role, defining what the role is authorized to access, perform, or receive.
Authorization is a string property that captures the specific permissions, rights, privileges, or benefits that are associated with a Role. This property defines what the role is entitled to do or receive within a given context (e.g., build, system, distribution, supply chain, or lifecycle). For example, authorization might include access to certain resources, permissions to perform specific actions, or eligibility for particular benefits.
beginIntegerRange
Defines the beginning of a range.
beginIntegerRange is a positive integer that defines the beginning of a range.
builtTime
Specifies the time an artifact was built.
A builtTime specifies the time an artifact was built.
city
City is a specific name used to define a locality.
completeness
Provides information about the completeness of relationships.
Completeness gives information about whether the provided relationships are complete, known to be incomplete or if no assertion is made either way.
contactType
Identifies the nature of the contactPointRelationship.
Identifies the role of the Artifact to the contact point.
context
Gives information about the circumstances or unifying properties that Elements of the bundle have been assembled under.
A context gives information about the circumstances or unifying properties that Elements of the bundle have been assembled under.
country
Specifies a country code of the location.
countyCode
A code that identifies a county.
A code that identifies a county. A county is a territorial division in some countries, often forming a primary unit of local administration. In the US, a county is a political and administrative division of a state.
created
Identifies when the Element was originally created.
Created is a date that identifies when the Element was originally created. The time stamp can serve as an indication as to whether the analysis needs to be updated. This is often the date of last change (e.g., a git commit date), not the date when the SPDX data was created, as doing so supports reproducible builds.
createdBy
Identifies who or what created the Element.
CreatedBy identifies who or what created the Element. The generation method will assist the recipient of the Element in assessing the general reliability/accuracy of the analysis information.
createdUsing
Identifies the tooling that was used during the creation of the Element.
CreatedUsing identifies the tooling that was used during the creation of the Element. The generation method will assist the recipient of the Element in assessing the general reliability/accuracy of the analysis information.
creationInfo
Provides information about the creation of the Element.
CreationInfo provides information about the creation of the Element.
dataLicense
Provides the license under which the SPDX documentation of the Element can be used.
The data license provides the license under which the SPDX documentation of the Element can be used. This is to alleviate any concern that content (the data or database) in an SPDX file is subject to any form of intellectual property right that could restrict the re-use of the information or the creation of another SPDX file for the same project(s). This approach avoids intellectual property and related restrictions over the SPDX file, however individuals can still contract with each other to restrict release of specific collections of SPDX files (which map to software bill of materials) and the identification of the supplier of SPDX files. Compliance with this document includes populating the SPDX fields therein with data related to such fields ("SPDX-Metadata"). This document contains numerous fields where an SPDX file creator may provide relevant explanatory text in SPDX-Metadata. Without opining on the lawfulness of "database rights" (in jurisdictions where applicable), such explanatory text is copyrightable subject matter in most Berne Convention countries. By using the SPDX specification, or any portion hereof, you hereby agree that any copyright rights (as determined by your jurisdiction) in any SPDX-Metadata, including without limitation explanatory text, shall be subject to the terms of the Creative Commons CC0 1.0 Universal license. For SPDX-Metadata not containing any copyright rights, you hereby agree and acknowledge that the SPDX-Metadata is provided to you "as-is" and without any representations or warranties of any kind concerning the SPDX-Metadata, express, implied, statutory or otherwise, including without limitation warranties of title, merchantability, fitness for a particular purpose, non-infringement, or the absence of latent or other defects, accuracy, or the presence or absence of errors, whether or not discoverable, all to the greatest extent permissible under applicable law.
definingArtifact
Artifact representing a serialization instance of SPDX data containing the definition of a particular Element.
A definingArtifact property is used to link the Element identifier for an Element defined external to a given SpdxDocument to an Artifact Element representing the SPDX serialization instance which contains the definition for the Element.
definitionSource
It is the authoritative or credible entity, document, or body of knowledge that provides the meaning of a type, ensuring accuracy, context, and standardization.
It is the authoritative or credible entity, document, or body of knowledge that provides the meaning of a type, ensuring accuracy, context, and standardization. These are adopted to create uniformity and facilitate interoperability within industries.
description
Provides a detailed description of the Element.
This field is a detailed description of the Element. It may also be extracted from the Element itself. The intent is to provide recipients of the SPDX file with a detailed technical explanation of the functionality, anticipated use, and anticipated implementation of the Element. This field may also include a description of improvements over prior versions of the Element.
devLifecycleStage
The product lifecycle phase, the requirement is applicable for.
The development lifecycle stage specifies the phase or phases of a product’s lifecycle to which a given requirement applies. These may include requirements that govern the design phase, guide development activities, define constraints for the build environment, provide instructions for the decommissioning phase, etc.
element
Refers to one or more Elements that are part of an ElementCollection.
This field refers to one or more Elements that are part of an ElementCollection.
elementValue
A value used in a key-value pair with a generic key that refers to an Element
A value used in a key-value pair with a generic key that refers to an Element. A key-value pair can be used to implement a dictionary which associates a key with an Element.
endIntegerRange
Defines the end of a range.
endIntegerRange is a positive integer that defines the end of a range.
externalIdentifier
Provides a reference to a resource outside the scope of SPDX 3 content that uniquely identifies an Element.
ExternalIdentifier points to a resource outside the scope of SPDX 3 content that uniquely identifies an Element.
externalIdentifierType
Specifies the type of the external identifier.
An externalIdentifierType specifies the type of the external identifier.
externalRef
Points to a resource outside the scope of the SPDX 3 content that provides additional characteristics of an Element.
This field points to a resource outside the scope of the SPDX 3 content that provides additional characteristics of an Element.
externalRefType
Specifies the type of the external reference.
An externalRefType specifies the type of the external reference.
externalSpdxId
Identifies an external Element used within an SpdxDocument but defined external to that SpdxDocument.
An externalSpdxId identifies an external Element used within an SpdxDocument but defined external to that SpdxDocument.
geographicPointLocation
A set of geographic point location coordinates.
Geographic point location coordinates expressed in the format defined by ISO 6709:2022.
givenRole
givenRole is a property that specifies the role being assigned in a RoleRelationship. It links the relationship to an instance of the Role class, defining the function, responsibility, or position that the source element confers upon the target element.
givenRole specific the role that is being assigned or defined by the relationship. This role represents the function, responsibility, or position that the source element (e.g., an organization, tool, or component) confers upon the target element (e.g., a person, team, or system).
headquartersLocation
A location of the organization's headquarters.
Headquarters denotes the location where most or all of the important functions of an organization are coordinated. In some jurisdictions, it represents the central entity of a corporation that assumes full responsibility for managing all business activities. Accurate identification of an organization's headquarters requires the provision of relevant address data, including mailing, street, and geographic point location.
identifier
Uniquely identifies an external element.
An identifier uniquely identifies an external element.
identifierLocator
Provides the location for more information regarding an external identifier.
Identifiers are not always structured as URIs. An identifierLocator is a location hint (a URL) that provides contextual information relevant to the identifier.
import
Provides an ExternalMap of Element identifiers.
An import provides an ExternalMap of an Element identifier that is used within a document but defined external to that document.
inLanguage
Specifies a human language used within the content of an Element or a property.
Specifies a human language used within the content of an Element or a property. The property value shall be an IETF BCP 47 language tag <https://datatracker.ietf.org/doc/rfc5646/> used to indicating human languages, dialects, scripts, regions, and variants.
intendedUse
A statement of how, or for what purpose, an item or artifact is intended to be used.
A free-form textual description outlining the scope and boundaries of appropriate or intended applications for the item or artifact.
isoAutomationLevel
ISO level of automation.
The level of automation describes a spectrum of system capability, defining the degree of control and decision-making authority a system possesses relative to an external control. This classification helps to define the roles and responsibilities of both the human operator and the automated system. It is a critical component for risk assessment, regulatory compliance, and user interface design.
issuingAuthority
An entity that is authorized to issue identification credentials.
An issuingAuthority is an entity that is authorized to issue identification credentials. The entity may be a government, non-profit, educational institution, or commercial enterprise. The string provides a unique identifier for the issuing authority.
locationHint
Provides an indication of where to retrieve an external Element.
A locationHint provides an indication of where to retrieve an external Element.
locationTime
A known location is specified at this time.
The locationTime establishes the relationship between a specific time and location. For example, at 8:45 the company's headquarters is located at this location. An action occurred at this location at this specific time.
locator
Provides the location of an external reference.
A locator provides the location of an external reference.
name
Identifies the name of an Element as designated by the creator.
This field identifies the name of an Element as designated by the creator. The name of an Element is an important convention and easier to refer to than the URI.
namespace
Provides an unambiguous mechanism for conveying a URI fragment portion of an Element ID.
A namespace provides an unambiguous mechanism for conveying a URI fragment portion of an Element ID.
namespaceMap
Provides a NamespaceMap of prefixes and associated namespace partial URIs applicable to an SpdxDocument and independent of any specific serialization format or instance.
This field provides a NamespaceMap of prefixes and associated namespace partial URIs applicable to an SpdxDocument and independent of any specific serialization format or instance.
originatedBy
Identifies from where or whom the Element originally came.
An originatedBy identifies from where or whom the Element originally came.
packageVerificationCodeExcludedFile
The relative file name of a file to be excluded from the PackageVerificationCode.
A relative filename with the root of the package archive or directory referencing a file to be excluded from the PackageVerificationCode. Every filename is preceded with a ./.
postOfficeBoxNumber
The number that identifies a PO box. A PO box is a box in a post office or other postal service location assigned to an organization where postal items may be kept.
A postal box (P.O. Box) is a secure, numbered mailbox located at a post office or mail facility, used to receive mail. It provides a fixed mailing address, independent of a physical home or business location.
postalCode
Text specifying the postal code for an address.
postalName
The name of the recipient expressed in text.
postalName is a property that specifies the name of the organization, entity, or addressee to which mail or deliveries should be directed.
prefix
A substitute for a URI.
A prefix is a substitute for a URI.
processReadiness
The readiness of a process.
The readiness of a process, expressed using the ProcessReadinessType enumeration.
profileConformance
Describes one a profile which the creator of this ElementCollection intends to conform to.
Describes a profile to which the creator of this ElementCollection intends to conform. The profileConformance will apply to all Elements contained within the collection as well as the collection itself. Conformance to a profile is defined by the additional restrictions documented in the profile specific documentation and schema files. Use of this property allows the creator of an ElementCollection to communicate to consumers their intent to adhere to the profile additional restrictions. The profileConformance has a default value of "core" if no other profileConformance is specified since all ElementCollections and Element shall adhere to the Core profile.
provinceStateCode
Text specifying a province or state.
Text specifying a province or state (e.g., Buenos Aires, California, Cebu).
quantity
Quantity is the amount in the selected QUDT unit.
Quantity is a property that defines the count, multitude or magnitude. Express it as an xsd:decimal whenever possible. If it is not an xsd:decimal, place the notation being used in the parent element's comment field.
referenceSpecification
referenceSpecification provides a reference to a DefinedType that defines the specific meaning, structure, and semantics of a Role. It connects the role to its authoritative source definition, ensuring consistent interpretation across different contexts.
referenceSpecification is an object property that links a Role element to an instance of DefinedType. This property establishes the authoritative source and type specification that defines what the role represents, its boundaries, and its intended interpretation. It specifies the tasks, rights, and qualifications associated with the role.
releaseTime
Specifies the time an artifact was released.
A releaseTime specifies the time an artifact was released.
requirementStatement
A textual expression describing the actual need defined by the requirement.
The text-based portion of a requirement. This statement typically adheres to established rules and best practices of requirements engineering, such as the Easy Approach to Requirements Syntax (EARS).
requirementStatus
The assessment of the state of a requirement.
The status specifies the state of a requirement in its lifecycle.
A requirementUID is a unique identifier assigned to a Requirement.
A unique identifier, as used by requirements management or other lifecycle management tools, usually a string that follows a project specific naming convention.
responsibility
Describes the specific responsibility of a Role.
roleQualification
roleQualification specifies the requirements, criteria, or conditions that must be met for an entity to be considered qualified to fulfill a particular role.
roleQualification is an object property that links a Role to one or more Requirement elements. It defines the qualifications—educational, experiential, certification, or competency-based—that an entity must possess to be considered capable of performing the responsibilities associated with the role.
rootElement
This property is used to denote the root Element(s) of a tree of elements contained in a BOM.
This property is used to denote the root Element(s) of a tree of elements contained in a BOM. The tree consists of other elements directly and indirectly related through properties or Relationships from the root.
scope
Capture the scope of information about a specific relationship between elements.
A scope is additional context about a relationship, that clarifies the relationship between elements.
specType
A specification type defines the nature of a specification.
specVersion
Provides a reference number that can be used to understand how to parse and interpret an Element.
The specVersion provides a reference number that can be used to understand how to parse and interpret an Element. It will enable both future changes to the specification and to support backward compatibility. The major version number shall be incremented when incompatible changes between versions are made (one or more sections are created, modified or deleted). The minor version number shall be incremented when backwards compatible changes are made. The optional patch version number shall be incremented when backward compatible bug fixes are made. If no patch version is present, the latest released patch version can be assumed. Here, parties exchanging information in accordance with the SPDX specification need to provide 100% transparency as to which SPDX specification version such information is conforming to.
standardName
The name of a relevant standard that may apply to an artifact.
Various standards may be relevant or useful to capture for specific artifacts. This does not imply that the artifact is compliant with the standard, but rather that the standard is used as a reference or guideline for the design, implementation, production, or evaluation of the artifact. For compliance with a standard, use the standardCompliance property instead.
statement
Commentary on an assertion that an annotator has made.
A statement is a commentary on an assertion that an annotator has made.
streetAddress
Street address includes a street number, name and unit ID to identify a specific street.
subject
An Element an annotator has made an assertion about.
A subject is an Element an annotator has made an assertion about.
summary
A short description of an Element.
A summary is a short description of an Element. Here, the intent is to allow the Element creator to provide concise information about the function or use of the Element.
typeFromSource
typeFromSource is a value used to define an item within the definitionSource.
A typeFromSource is a specific term or label assigned within a definitionSource to define or identify an item, concept, or category. It represents a unique or standardized value within the classification system that helps categorize and describe the item's place or characteristics within the overall definitionSource.
unitQUDT
A QUDT unit applied to measurement criteria based on product type, region, and use.
QUDT (Quantity, Unit, Dimension and Type) specifies a standardized framework for describing measurable quantities, units of measure, numerical values, and their underlying data structures and types. The QUDT ontology and specifications are available at https://www.qudt.org/.
validUntilTime
Specifies until when the artifact can be used before its usage needs to be reassessed.
A validUntilTime specifies until when the artifact can be used before its usage needs to be reassessed.
value
A value used in a generic key-value pair.
A value used in a generic key-value pair. A key-value pair can be used to implement a dictionary which associates a key with a value.
amber
Limited distribution - organization and clients. The dataset shall be shared only with specific organizations and their clients on a need-to-know basis.
amberStrict
Limited distribution - organization only. The dataset shall be shared only with specific organizations on a need-to-know basis.
clear
Unlimited. Subject to standard copyright rules, the dataset may be shared freely, without restriction.
green
Community wide. The dataset shall be shared only within a community of peers and partners.
red
For named recipients only. The dataset is highly confidential and shall be shared only with named recipients.
clickthrough
Dataset is not publicly available and can only be accessed after affirmatively accepting terms on a clickthrough webpage.
directDownload
Dataset is publicly available and can be downloaded directly.
query
Dataset is publicly available, but not all at once, and can only be accessed through queries which return parts of the dataset.
registration
Dataset is not publicly available and an email registration is required before accessing the dataset, although without an affirmative acceptance of terms.
scrapingScript
Dataset provider is not making available the underlying data and the dataset shall be reassembled, typically using the provided script for scraping the data.
DatasetPackage
A Package that contains a dataset.
A Package that contains data used for the operation, training, testing, evaluation, or calibration of software, hardware, or systems, or for reporting, documentation, reference, and archival purposes.
audio
Data is audio based, such as a collection of music from the 80s.
categorical
Data that is classified into a discrete number of categories, such as the eye color of a population of people.
graph
Data is in the form of a graph where entries are somehow related to each other through edges, such as a social network of friends.
image
Data is a collection of images such as pictures of animals.
Data type is not known.
numeric
Data consists only of numeric entries.
Data is of a type not included in this list.
sensor
Data is recorded from a physical sensor, such as a thermometer reading or biometric device.
structured
Data is stored in tabular format or retrieved from a relational database.
syntactic
Data describes the syntax or semantics of a language or text, such as a parse tree used for natural language processing.
text
Data consists of unstructured text, such as a book, a Wikipedia article (without images), or a transcript.
timeseries
Data is recorded in an ordered sequence of timestamped entries, such as the price of a stock over the course of a day.
timestamp
Data is recorded with a timestamp for each entry, but not necessarily ordered or at specific intervals, such as when a taxi ride starts and ends.
video
Data is video based, such as a collection of movie clips.
anonymizationMethodUsed
Anonymization methods used.
A free-form text that describes the methods used to anonymize the dataset or fields in the dataset.
confidentialityLevel
Confidentiality level of the data points contained in the dataset.
Describes the levels of confidentiality of the data points contained in the dataset.
dataCollectionProcess
How the dataset was collected.
A free-form text that describes how a dataset was collected. Examples include the sources from which a dataset was scraped and the interview protocol that was used for data collection.
dataPreprocessing
Preprocessing steps that were applied to the raw data to create the given dataset.
A free-form text that describes the various preprocessing steps that were applied to the raw data to create the dataset. Examples include standardization, normalization, deduplication, tokenization, and removal of tokens.
datasetAvailability
Availability of a dataset.
Some datasets are publicly available and can be downloaded directly. Others are only accessible behind a clickthrough, or after filling a registration form. This field will describe the dataset availability from that perspective.
datasetNoise
Potentially noisy elements of the dataset.
Describes what kinds of noises a dataset can encompass. The free-form text specifies fields or samples that can be noisy. Alternatively, it can also be used to describe various noises that can impact the whole dataset.
datasetSize
**DEPRECATED in SPDX 3.1.** Use /Software/artifactSize instead. Size of the dataset.
**NOTE:** This property is deprecated and only included for backward compatibility. New documents should use /Software/artifactSize instead. How large a dataset is. The size is to be measured in bytes.
datasetType
Type of data in a dataset.
Describes the datatype contained in the dataset. For example, a dataset can be an image dataset for computer vision applications, a text dataset such as the contents of a book or Wikipedia article, or sometimes a multimodal dataset that contains multiple types of data.
datasetUpdateMechanism
Mechanism to update the dataset.
A free-form text that describes a mechanism to update the dataset.
hasSensitivePersonalInformation
Describes if any sensitive personal information is present in the dataset.
Indicates the presence of sensitive personal data or information that allows drawing conclusions about a person's identity. Related: useSensitivePersonalInformation in /AI/AIPackage
**DEPRECATED in SPDX 3.1.** Use /Core/intendedUse instead. The intended use of a given dataset.
**NOTE:** This property is deprecated and only included for backward compatibility. New documents should use /Core/intendedUse instead. A free-form text that describes what the given dataset should be used for. Some datasets are collected to be used only for particular purposes. For example, medical data collected from a specific demography should only be applicable for training machine learning models to make predictions for that demography. In such a case, the intendedUse field would capture this information. Similarly, if a dataset is collected for building a facial recognition model, the intendedUse field would specify that.
knownBias
Records the biases that the dataset is known to encompass.
A free-form text that describes the different biases that the dataset encompasses.
Describes a sensor used for collecting the data.
Describes a sensor that was used for collecting the data and its calibration value as a key-value pair.
additionText
Identifies the full text of a LicenseAddition.
An additionText contains the plain text of the LicenseAddition, without templating or other similar markup. Users of the additionText for a License can apply the SPDX License List Matching Guidelines when comparing it to another text for matching purposes.
isDeprecatedAdditionId
Specifies whether an additional text identifier has been marked as deprecated.
The isDeprecatedAdditionId property specifies whether an identifier for a LicenseAddition has been marked as deprecated. If the property is not defined, then it is presumed to be false (i.e., not deprecated). If the LicenseAddition is included on the SPDX License Exceptions <https://spdx.org/licenses/exceptions-index.html>, then the deprecatedVersion property indicates on which version release of the Exceptions List it was first marked as deprecated. "Deprecated" in this context refers to deprecating the use of the _identifier_, not the underlying license addition. In other words, even if a LicenseAddition's author or steward has stated that a particular LicenseAddition generally should not be used, that would _not_ mean that the LicenseAddition's identifier is "deprecated." Rather, a LicenseAddition operator is typically marked as "deprecated" when it is determined that use of another identifier is preferable.
isDeprecatedLicenseId
Specifies whether a license or additional text identifier has been marked as deprecated.
The isDeprecatedLicenseId property specifies whether an identifier for a License or LicenseAddition has been marked as deprecated. If the property is not defined, then it is presumed to be false (i.e., not deprecated). If the License or LicenseAddition is included on the SPDX License List <https://spdx.org/licenses/>, then the deprecatedVersion property indicates on which version release of the License List it was first marked as deprecated. "Deprecated" in this context refers to deprecating the use of the _identifier_, not the underlying license. In other words, even if a License's author or steward has stated that a particular License generally should not be used, that would _not_ mean that the License's identifier is "deprecated." Rather, a License or LicenseAddition operator is typically marked as "deprecated" when it is determined that use of another identifier is preferable.
isFsfLibre
Specifies whether the License is listed as free by the Free Software Foundation (FSF).
isFsfLibre specifies whether the Free Software Foundation (FSF) <https://fsf.org> has listed this License as "free" in their commentary on licenses, located at the time of this writing at Various Licenses and Comments about Them <https://www.gnu.org/licenses/license-list.en.html>. A value of "true" indicates that the license is in the list of licenses that FSF publishes as libre. A value of "false" indicates that the license is explicitly not in the corresponding list of FSF libre licenses (e.g., FSF has the license on a non-free list). If the isFsfLibre field is not specified, the SPDX data creator makes no assertions about whether the License is listed in the FSF's commentary.
isOsiApproved
Specifies whether the License is listed as approved by the Open Source Initiative (OSI).
isOsiApproved specifies whether the Open Source Initiative (OSI) <https://opensource.org> has listed this License as "approved" in their list of OSI Approved Licenses, located at the time of this writing at OSI Approved Licenses <https://opensource.org/licenses>. A value of "true" indicates that the license is in the list of licenses that OSI publishes as approved. A value of "false" indicates that the license is explicitly not in the corresponding list of OSI licenses (e.g., OSI has stated publicly that a license is not approved). If the isOsiApproved field is not specified, the SPDX data creator makes no assertions about whether the License is approved by the OSI.
standardAdditionTemplate
Identifies the full text of a LicenseAddition, in SPDX templating format.
A standardAdditionTemplate contains a license addition template which describes sections of the LicenseAddition text which can be varied. See the Legacy Text Template format section of the SPDX License List Matching Guidelines for format information. It is recommended to use licenseXml instead, as it can capture all the text and metadata associated with a license.
standardLicenseHeader
Provides a License author's preferred text to indicate that a file is covered by the License.
A standardLicenseHeader contains the plain text of the License author's preferred wording to be used, typically in a source code file's header comments or similar location, to indicate that the file is subject to the specified License.
standardLicenseTemplate
Identifies the full text of a License, in SPDX templating format.
A standardLicenseTemplate contains a license template which describes sections of the License text which can be varied. See the Legacy Text Template format section of the SPDX License List Matching Guidelines for format information. It is recommended to use licenseXml instead, as it can capture all the text and metadata associated with a license.
subjectAddition
A LicenseAddition participating in a 'with addition' model.
A subjectAddition is a LicenseAddition which is subject to a 'with additional text' effect (WithAdditionOperator).
subjectExtendableLicense
A License participating in a 'with addition' model.
A subjectExtendableLicense is a License which is subject to a 'with additional text' effect (WithAdditionOperator).
subjectLicense
A License participating in an 'or later' model.
A subjectLicense is a License which is subject an 'or later' effect (OrLaterOperator).
CdxPropertiesExtension
A type of extension consisting of a list of name value pairs.
This extension provides a more structured extension using a name-value approach. Unlike key-value stores, properties in CdxPropertiesExtension support duplicate names, each potentially having different values. This is intended to be compatible with the CycloneDX property properties.
cdxPropName
A name used in a CdxPropertyEntry name-value pair.
A cdxPropName is used in a CdxPropertyEntry name-value pair. Unlike key-value stores, properties in CdxPropertiesExtension support duplicate names, each potentially having different values.
cdxPropValue
A value used in a CdxPropertyEntry name-value pair.
A cdxPropValue is used in a CdxPropertyEntry name-value pair. Unlike key-value stores, properties in CdxPropertiesExtension support duplicate names, each potentially having different values.
cdxProperty
Provides a map of a property name to a value.
This field provides a mapping of a name to a value. This is intended to be compatible with the CycloneDX property properties. Unlike key-value stores, properties in CdxPropertiesExtension support duplicate names, each potentially having different values.
fail
Indicates a failed evaluation where the requirement or condition is not met.
inconclusive
Inconclusive refers to a result or outcome from a verification, test, or analysis that cannot be clearly classified as either positive (successful, pass) or negative (failed, reject). An inconclusive result means there was not enough clear evidence, data, or signal to make a definitive determination, and further investigation or additional testing is necessary. An inconclusive result always shall need a comment on it.
pass
Indicates a successful evaluation where the requirement or condition is clearly met.
EvidenceRelationship
EvidenceRelationship defines the association between pieces of evidence and EvaluationResult.
EvidenceRelationship defines the association between pieces of evidence and EvaluationResult. This establishes traceability and contextual linkage between evidence items, supporting certification, verification, and audit activities.
log
Time-stamped records capturing system or operational data recorded as usually as a response to specific triggers in a specified environment.
observation
Documentation of direct monitoring or witnessing of the demonstration of processes, tests, or any kind of system responses during a specified timeframe under specified environmental conditions.
Any other relevant type of proof or documentation not covered above.
recording
Captured datastream like audio, video, or any other kind of continuous electronic capture of events, behavior or conditions.
report
Structured documentation of test results, inspections, or analyses.
analysis
Analytical evaluating of data, designs, or processes methodically to verify correctness against standards or expectations. Typical analysis methods are FMEA, FTA, STPA, static analysis for MISRA compliance etc.
assessment
A systematic examination of a system, process, or outcome to evaluate compliance of specific work products with a specific expectation with a specification, regulation or standard. Often involves judgement and a rationale of this judgement.
audit
An examination typically focusing on compliance with policies, standards, or regulations. Usually this is done during an audit meeting, while the assessment also involves deep and detailed reviews of work products (e.g. requirements, verification specifications, reports etc.)
demonstration
Demonstrating and monitoring or recording that the item under verification to confirm that a requirement is met by the item under verification.
inspection
A thorough examination or checking of documentation, records, processes, or systems to confirm compliance or adherence. An inspection needs to have a defined set of acceptance criteria (e.g. a checklist), a documentation of roles involved in the inspection (e.g. to document the inspector's independence) and a clear documentation of when and how it was performed.
Any other specialized or custom verification method that fits the context.
A examination or checking of documentation, records, processes, or systems to confirm compliance or adherence with an upper level requirement. Typically done as peer review, offline review or review meeting.
test
Conducting controlled tests, experiments or simulations to verify that specific requirements regarding performance, functionality, robustness, etc. are met.
assumptionStatement
A text describing the design constraint defined by the assumption.
The text describing a constraint is imposed by the intended design, the requirement context, or the operational context.
assumptionUID
An assumptionUID is a unique identifier assigned to an Assumption item.
An assumptionUID is a unique identifier assigned to an item that represents a design constraint.
evaluation
Evaluation is an outcome considering results of a verification.
Evaluation is the judgement, assessment or opinion regarding the compliance of a verification outcome with the expectations of this verification to meet the verification's acceptance criteria.
evaluationBasedOn
Indicates the specific RequirementVerification instance on which the EvaluationResult is based.
The evaluationBasedOn property represents the linkage to the particular RequirementVerification that serves as the foundation for generating an EvaluationResult. It connects the evaluation outcome to the defined process or activity that verified the requirement, enabling traceability and verification of the evaluation’s basis. This linkage is critical in systems engineering to ensure that evaluation conclusions clearly reference the verified requirements and their verification methods, supporting auditability, compliance, and quality control.
evidenceCategory
evidenceCategory refers to a category of documented or observable proof.
evidenceCategory refers to a category of documented or observable proof used to verify compliance, qualification, or performance.
A evidenceUID is a unique identifier assigned to an entity, item, or requirement.
A evidenceUID is a unique identifier assigned to an entity, item, or any other kind of evaluated verification outcome.
verificationMethod
verificationMethod refers to the specific approach used for a checking an element's conformance with its requirements.
verificationMethod refers to the specific approach used to confirm that a (lower level) requirement or implemented system element complies with its higher level requirement.
verificationPostcondition
Verification postcondition that are true immediately after a verification method has been performed
Verification postcondition are explicit criteria, states, or conditions that are true immediately after a verification method (such as a test, inspection, or analysis) has been performed, confirming the successful execution and complete outcomes of the verification.
verificationPrecondition
Verification preconditions are initial criteria that are to be met prior to initiating the verification method.
Verification preconditions are specific conditions, requirements, or initial states that are to be satisfied before a verification will be executed.
A verificationUID is a unique identifier assigned to a Verification item.
A verificationUID is a unique identifier assigned to an entity, item, or verification requirement.
ProductSpecification
A product specification (product spec) is a detailed document that outlines the technical, functional, and design requirements of a product.
A product specification (product spec) is a detailed document that outlines the technical, functional, and design requirements of a product. It serves as a guide for engineers, designers, and manufacturers to ensure the final product meets expectations.
cycle
Simulation architectures with precise cycle-level accuracy.
function
Simulation the function of the hardware.
All other simulation types.
This element provides relevant information about the product.
additionalInformationSpecification
It is the authoritative or credible entity, document, or body of knowledge that provides the meaning of an additionalInformation key and/or its values, ensuring accuracy, context, and standardization.
It is the authoritative or credible entity, document, or body of knowledge that provides the meaning of an additionalInformation key and/or its values, ensuring accuracy, context, and standardization. These are adopted to create uniformity and facilitate interoperability within industries.
batchNumber
Identifier for product production batch.
A group of products produced in a common process is called a batch. Batches are identified by batch numbers.
bulkQuantity
The amount or measure of a bulk product.
The amount or measure of a bulk product includes the quantity and unit of measure.
category
The category describes the hardware item in a DefinedType.
centerOfMass
A point representing the mean position of the matter in a body or system.
The mass-center is a fixed property for a given rigid body (e.g. with no slosh or articulation), whereas the center-of-gravity may, in addition, depend upon its orientation in a non-uniform gravitational field.
dimensions
Information related to hardware dimension.
Product dimensions describe the physical characteristics of a specific product.
massOfHardware
Information related to massOfHardware physical hardware.
productAgent
An Agent responsible for product identification, such as an original equipment manufacturer (OEM).
An Agent responsible for defining the partNumber, batchNumber or serialNumber of the unit of hardware.
releaseDate
Date of product release.
This is the first date associated to a specific product release.
serialNumber
Identifier for specific product is called a serial number.
This is a specific identifier assigned to a specific product.
virtualHardwareModel
Information related to virtual hardware simulation.
Information related to virtual hardware simulation modelling process.
xAxisLength
Information related to xAxis measurement of an object.
yAxisLength
Information related to yAxis measurement of an object.
zAxisLength
Information related to zAxis measurement of an object. Z axis is the height of the object.
assessedElement
Specifies an Element as subject of an assessment.
assessmentContext
Sets the context for an assessment by specifying the related project.
assessmentResult
assessmentTime
Timestamp, when an assessment was conducted.
assessor
An entity providing an assessment.
exportClassification
Expression for the export control classification.
Expression for the export control classification, e.g. "EAR99".
exportControlSpecification
Specification basis for the export control classification.
exportingCountry
Country for which export controls must be taken into account.
projectContract
Link to the project contract.
projectOwner
Owner or lead of the project.
Agent responsible for the project.
projectSponsor
Sponsor of the project.
projectTitle
Title of the project.
weight
Weight to express relevance in de minimis consideration.
kev
CISA's Known Exploited Vulnerability (KEV) catalog.
Other exploit catalogs.
act
The vulnerability requires attention from the organization's internal, supervisory-level and leadership-level individuals. Necessary actions include requesting assistance or information about the vulnerability, as well as publishing a notification either internally and/or externally. Typically, internal groups would meet to determine the overall response and then execute agreed upon actions. CISA recommends remediating Act vulnerabilities as soon as possible.
attend
The vulnerability requires attention from the organization's internal, supervisory-level individuals. Necessary actions include requesting assistance or information about the vulnerability, and may involve publishing a notification either internally and/or externally. CISA recommends remediating Attend vulnerabilities sooner than standard update timelines.
track
The vulnerability does not require action at this time. The organization would continue to track the vulnerability and reassess it if new information becomes available. CISA recommends remediating Track vulnerabilities within standard update timelines.
trackStar
("Track\*" in the SSVC spec) The vulnerability contains specific characteristics that may require closer monitoring for changes. CISA recommends remediating Track\* vulnerabilities within standard update timelines.
componentNotPresent
The software is not affected because the vulnerable component is not in the product.
inlineMitigationsAlreadyExist
Built-in inline controls or mitigations prevent an adversary from leveraging the vulnerability.
vulnerableCodeCannotBeControlledByAdversary
The vulnerable component is present, and the component contains the vulnerable code. However, vulnerable code is used in such a way that an attacker cannot mount any anticipated attack.
vulnerableCodeNotInExecutePath
The affected code is not reachable through the execution of the code, including non-anticipated states of the product.
vulnerableCodeNotPresent
The product is not affected because the code underlying the vulnerability is not present in the product.
actionStatement
Provides advise on how to mitigate or remediate a vulnerability when a VEX product is affected by it.
When an element is referenced with a VexAffectedVulnAssessmentRelationship, the relationship shall include one actionStatement that should describe actions to remediate or mitigate the vulnerability.
actionStatementTime
Records the time when a recommended action was communicated in a VEX statement to mitigate a vulnerability.
When a VEX statement communicates an affected status, the author shall include an action statement with a recommended action to help mitigate the vulnerability's impact. The actionStatementTime property records the time when the action statement was first communicated.
Specifies an Element where a vulnerability was found.
Specifies components, subpackages, files or snippets referenced by a security assessment to specify the precise location where a vulnerability was found.
catalogType
Specifies the exploit catalog type.
A catalogType is a mandatory value and shall select one of the existing entries in the ExploitCatalogType vocabulary.
decisionType
Provide the enumeration of possible decisions in the Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree <https://www.cisa.gov/stakeholder-specific-vulnerability-categorization-ssvc>.
A decisionType is a mandatory value and shall select one of the four entries in the SsvcDecisionType vocabulary.
exploited
Denote whether a CVE is present in an exploit catalog.
This field is set to True when a CVE is present in an exploit catalog and False when the CVE is not present.
impactStatement
Explains why a VEX product is not affected by a vulnerability. It is an alternative in VexNotAffectedVulnAssessmentRelationship to the machine-readable justification label.
When a VEX product element is related with a VexNotAffectedVulnAssessmentRelationship and a machine readable justification label is not provided, then an impactStatement that further explains how or why the product(s) are not affected by the vulnerability shall be provided.
impactStatementTime
Timestamp of impact statement.
Specifies the time when the impact statement was recorded.
justificationType
Impact justification label to be used when linking a vulnerability to an element representing a VEX product with a VexNotAffectedVulnAssessmentRelationship relationship.
When stating that an element is not affected by a vulnerability, the VexNotAffectedVulnAssessmentRelationship shall include a justification from the machine-readable labels catalog informing the reason the element is not impacted. impactStatement which is a string with English prose can be used instead or as complementary to the justification label, but one of both shall be defined.
Provides the location of an exploit catalog.
A locator provides the location of an exploit catalog.
percentile
The percentile of the current probability score.
The percentile between 0 and 1 (0 and 100%) of the current probability score, the proportion of all scored vulnerabilities with the same or a lower probability score. The definition follows "percentile" in EPSS Data <https://www.first.org/epss/data_stats>.
probability
A probability score between 0 and 1 of a vulnerability being exploited.
The probability score between 0 and 1 (0 and 100%) estimating the likelihood of exploitation in the wild in the next 30 days (following score publication). The definition follows "epss" in EPSS Data <https://www.first.org/epss/data_stats>.
statusNotes
Conveys information about how VEX status was determined.
A VEX statement may convey information about how status was determined and may reference other VEX information.
vexVersion
Specifies the version of a VEX statement.
The statement version default value is zero. When any VEX-related content changes, the version shall be incremented.
crl
Certificate Revocation List, or CRL, is a list of revoked certificates that is downloaded from the Certificate Authority (CA).
ocsp
Online Certificate Status Protocol, or OCSP, is a common scheme used to maintain the security of a server and other network resources.
An authentication protocol not covered by one of the other AuthenticationProtocolTypes.
tls
Transport Layer Security, or TLS, is a widely adopted security protocol designed to facilitate privacy and data security for communications over the Internet.
serverAuthenticationProtocol
Authentication protocol used by a server.
Authentication protocols used by a server or a software service to authenticate the server to the consumer.
serviceHostingCountry
Specifies a country code where a software service is hosted.
Specifies a country or territory where a software service is located. This includes indirect locations (e.g., where the data may be hosted). The string shall be in the ISO 3166-1 alpha-3 <https://www.iso.org/obp/ui/#iso:std:iso:3166:-1> three-letter format. See the ISO 3166-1 alpha-3 Wikipedia page <https://en.wikipedia.org/wiki/ISO_3166-1_alpha-3> for more information.
customIdToLicense
Maps a "LicenseRef-" string for a custom license or a "AdditionRef-" string for a custom license addition to a CustomLicense, a CustomLicenseAddition, or a SimpleLicensingText.
Within a license expression, references can be made to a custom license or a custom license addition. The License Expression syntax dictates any reference starting with a "LicenseRef-" or "AdditionRef-" refers to license or addition text not found in the official SPDX License List <https://spdx.org/licenses/>. The key for the ElementMap is the string used in the license expression and the elementValue is the target Element, which must be a CustomLicense, CustomLicenseAddition, or SimpleLicensingText. The key for the ElementMap shall be matched against the license expression in a case-insensitive manner. This is required because the entire license expression string is itself case-insensitive.
customIdToUri
**DEPRECATED in SPDX 3.1.** Use customIdToLicense instead. Maps a "LicenseRef-" string for a custom license or a "AdditionRef-" string for a custom license addition to its URI identifier. **NOTE:** This property is deprecated and only included for backward compatibility. New documents should use customIdToLicense instead.
Within a License Expression, references can be made to a Custom License or a Custom License Addition. The License Expression syntax dictates any reference starting with a "LicenseRef-" or "AdditionRef-" refers to license or addition text not found in the official SPDX License List <https://spdx.org/licenses/>. These custom licenses shall be a CustomLicense, a CustomLicenseAddition, or a SimpleLicensingText which are identified with a unique URI identifier. The key for the DictionaryEntry is the string used in the license expression and the value is the URI for the corresponding CustomLicense, CustomLicenseAddition, or SimpleLicensingText.
licenseExpression
A string in the license expression format.
A licenseExpression enables the representation, in a single string, of a combination of one or more licenses, together with additions such as license exceptions. The syntax for a licenseExpression string is set forth in the corresponding Annex of this document ("SPDX license expressions"). A licenseExpression string is not valid if it does not conform to the grammar set forth in that Annex. The ExpandedLicensing profile can be used to represent the complete parsed license expression as a combination of license objects.
licenseListVersion
The version of the SPDX License List used in the license expression.
Recognizing that licenses are added to the SPDX License List <https://spdx.org/licenses/> with each subsequent version, the intent is to provide consumers with the version of the SPDX License List used. This anticipates that in the future, license expression can used a version of the SPDX License List that is older than the then current one. The specified version of the SPDX License List shall include all listed licenses and exceptions referenced in the expression.
directory
The file represents a directory and all content stored in that directory.
file
The file represents a single file (default).
symlink
This file represents a symbolic link (soft link).
Sbom
A collection of SPDX Elements describing a single package.
A Software Bill of Materials (SBOM) is a collection of SPDX Elements describing a single package. This could include details of the content and composition of the product, provenance details of the product and/or its composition, licensing information, known quality or security issues, etc.
analyzed
SBOM generated through analysis of artifacts (e.g., executables, packages, containers, and virtual machine images) after its build. Such analysis generally requires a variety of heuristics. In some contexts, this may also be referred to as a "3rd party" SBOM.
SBOM generated as part of the process of building the software to create a releasable artifact (e.g., executable or package) from data such as source files, dependencies, built components, build process ephemeral data, and other SBOMs.
deployed
SBOM provides an inventory of software that is present on a system. This may be an assembly of other SBOMs that combines analysis of configuration options, and examination of execution behavior in a (potentially simulated) deployment environment.
design
SBOM of intended, planned software project or product with included components (some of which may not yet exist) for a new software artifact.
runtime
SBOM generated through instrumenting the system running the software, to capture only components present in the system, as well as external call-outs or dynamically loaded components. In some contexts, this may also be referred to as an "Instrumented" or "Dynamic" SBOM.
source
SBOM created directly from the development environment, source files, and included dependencies used to build a product artifact.
additionalPurpose
Provides additional purpose information of the software artifact.
An additionalPurpose provides information about the additional purpose of the software artifact in addition to the primaryPurpose.
artifactSize
Identifies the size of a software Artifact, in bytes.
attributionText
Provides a place for the SPDX data creator to record acknowledgement text for a software Package, File or Snippet.
An attributionText for a software Package, File or Snippet provides a consumer of SPDX data with acknowledgement content, to assist redistributors of the Package, File or Snippet with reproducing those acknowledgements. For example, this field may include a statement that is required by a particular license to be reproduced in end-user documentation, advertising materials, or another form. This field may describe where, or in which contexts, the acknowledgements need to be reproduced, but it is not required to do so. The SPDX data creator may also explain elsewhere (such as in a comment field) how they intend for data in this field to be used. An attributionText is not meant to include the software Package, File or Snippet's actual complete license text. Use hasConcludedLicense to identify the corresponding license.
byteRange
Defines the byte range in the original host file that the snippet information applies to.
This field defines the byte range in the original host file that the snippet information applies to. A range of bytes is independent of various formatting concerns, and the most accurate way of referring to the differences. The choice was made to start the numbering of the byte range at 1 to be consistent with the W3C pointer method vocabulary.
contentIdentifier
A canonical, unique, immutable identifier of the artifact content, that may be used for verifying its identity and/or integrity.
A contentIdentifier is a canonical, unique, immutable identifier of the content of a software artifact, such as a package, a file, or a snippet. It may be used for verifying its identity and/or integrity.
contentIdentifierType
Specifies the type of the content identifier.
A contentIdentifierType specifies the type of the content identifier.
contentIdentifierValue
Specifies the value of the content identifier.
A contentIdentifierValue specifies the value of a content identifier.
copyrightText
Identifies the text of one or more copyright notices for a software Package, File or Snippet, if any.
A copyrightText consists of the text(s) of the copyright notice(s) found for a software Package, File or Snippet, if any. If a copyrightText contains text, then it may contain any text related to one or more copyright notices (even if not complete) for that software Package, File or Snippet. If a copyrightText has a "NONE" value, this indicates that the software Package, File or Snippet contains no copyright notice whatsoever. If a copyrightText has a "NOASSERTION" value, this indicates that one of the following applies: - the SPDX data creator has attempted to but cannot reach a reasonable objective determination; - the SPDX data creator has made no attempt to determine this field; or - the SPDX data creator has intentionally provided no information (no meaning shall be implied by doing so). If a copyrightText is present, but consists of solely an empty string or a string with no substantive content (e.g., a string that contains only whitespace), then this shall be interpreted as equivalent to a "NOASSERTION" value as described above.
downloadLocation
Identifies the download Uniform Resource Identifier for the package at the time that the document was created.
A downloadLocation identifies the download Uniform Resource Identifier for the package at the time that the document was created. Where and how to download the exact package being referenced is critical for verification and tracking data.
fileKind
Describes if a given file is a directory or non-directory kind of file.
An SPDX file may represent a specific file or a directory of files. In the future, this may be extended to other kinds (e.g. network based files).
homePage
A place for the SPDX document creator to record a website that serves as the package's home page.
A homePage is a place for the SPDX document creator to record a website that serves as the package's home page. This saves the recipient of the SPDX document who is looking for more info from having to search for and verify a match between the package and the associated project home page. This link can also be used to reference further information about the package referenced by the SPDX document creator.
lineRange
Defines the line range in the original host file that the snippet information applies to.
This field defines the line range in the original host file that the snippet information applies to. If there is a disagreement between the byte range and line range, the byte range values will take precedence. A range of lines is a convenient reference for those files where there is a known line delimiter. The choice was made to start the numbering of the lines at 1 to be consistent with the W3C pointer method vocabulary.
Provides a place for the SPDX data creator to record the Package-URL for a software Package.
A packageUrl property specifies a Package-URL (PURL). The PURL shall be a valid Uniform Resource Identifier (URI) and Uniform Resource Locator (URL) that identifies a software package independent of its ecosystem or distribution channel, in accordance with ECMA-427 <https://ecma-international.org/publications-and-standards/standards/ecma-427/>. The PURL contains a type component that defines the ecosystem-specific structure and semantics for the remaining PURL components. The registered PURL type definitions are maintained in the Package-URL type registry available at https://packageurl.org/docs/purl/purl-types.
packageVersion
**DEPRECATED in SPDX 3.1.** Use /Core/version instead. Identify the version of a package.
**NOTE:** This property is deprecated and only included for backward compatibility. New documents should use /Core/version instead. A packageVersion is useful for identification purposes and for indicating later changes of the package version.
primaryPurpose
Provides information about the primary purpose of the software artifact.
primaryPurpose provides information about the primary purpose of the software artifact.
sbomType
Provides information about the type of an SBOM.
This field is a reasonable estimation of the type of SBOM created from a creator perspective. It is intended to be used to give guidance on the elements that may be contained within it. Aligning with the guidance produced in Types of Software Bill of Material (SBOM) Documents <https://www.cisa.gov/sites/default/files/2023-04/sbom-types-document-508c.pdf>.
snippetFromFile
Defines the original host file that the snippet information applies to.
The field identifies the file which contains the snippet.
sourceInfo
Records any relevant background information or additional comments about the origin of the package.
A sourceInfo records any relevant background information or additional comments about the origin of the package. For example, this field can include comments indicating whether the package was pulled from a source code management system or has been repackaged. The creator can provide additional information to describe any anomalies or discoveries in the determination of the origin of the package.
boundaryParameter
The boundary parameters define the area or region needed to describe a boundary.
A boundary parameter refers to a limiting condition, constraint, or predefined value that determines area or region boundaries.
current
This is the individual, business, or organization who currently manages goods, services, or assets.
currentState
This is the state of an affected Element.
The state of an object refers to a string assigned to its attributes (or properties) at a given moment in time. The state describes the current condition or behavior of the object.
decisionProcess
This is how the currentState of an affected Element is found.
destructionPerformedBy
This is the agent that performed the act of destroying the item.
dropoffLocation
A location where a package or an item is being dropped off or delivered.
A specific location where a package or an item was dropped off or delivered. For a location that is being designated for dropping off, see forDropoffLocation.
forDropoffLocation
A location where a package or an item will be dropped off or delivered.
A designated location for dropping off or delivering a package or an item. For a location where an item was dropped off, see dropoffLocation.
forPickupLocation
A location where a package or an item will be picked up.
A designated location for picking up a package or an item. For a location where an item was picked up, see pickupLocation.
pickupLocation
A location where a package or an item is being picked up.
A specific location where a package or an item was picked up. For a location that is being designated for picking up, see forPickupLocation.
plannedCurrent
This is the planned individual, business, or organization who currently manages goods, services, or assets.
plannedInspectionLocation
A planned location where a good, product, or material is inspected.
A planned location related to the inspection of a good, product, or material.
plannedPrevious
This is the planned individual, business, or organization who was previously managing goods, services, or assets.
plannedProductOfResponsibilityChange
This is the planned product associated with the change of responsibility.
The planned product or service related to a responsibility change is identified in this field.
plannedStorageLocation
A planned location where a good, product, or material is stored.
A planned location related to the storage of a good, product, or material.
plannedTransportRoute
A planned path used to move people, goods, data, or resources from one location to another.
A planned path or network taken by people, products, goods, data, or resources. The route varies depending on product type, safety requirements, business constraints, or other factors.
previous
This is the individual, business, or organization who was previously managing goods, services, or assets.
responsibilityChangedOn
The element that has its responsibility changed.
The element that has its responsibility changed. For example, "This product is associated with the change of ownership."
transportRoute
A transport route refers to the specific path or network used to move people, goods, data, or resources from one location to another.
A transport route is the path taken by people, products, goods, data or resources. Transport routes vary by product type, safety requirements, business constraints or other factors.
validState
The valid state for DefinedStateProcess.
This individual element was defined by the spec.
Annotation
An assertion made in relation to one or more elements.
An Annotation is an assertion made in relation to one or more elements. The contentType property describes the format of the statement property.
Bom
A container for a grouping of SPDX 3 content characterizing details (provenance, composition, licensing, etc.) about a product.
A Bill of Materials (BOM) is a container for a grouping of SPDX 3 content characterizing details about a product. This could include details of the content and composition of the product, provenance details of the product and/or its composition, licensing information, known quality or security issues, etc.
ContactPointRelationship
A contact point from an Artifact to an Agent.
Specifies a point of contact specific to an Artifact. For example, a software package may have a security contact point that researchers should use for reporting security vulnerabilities. This relationship is restricted to using the hasContactPoint relationship type.
adler32
Adler-32 checksum is part of the widely used zlib compression library as defined in RFC 1950 <https://datatracker.ietf.org/doc/rfc1950/> Section 2.3.
blake2b256
BLAKE2b algorithm with a digest size of 256, as defined in RFC 7693 <https://datatracker.ietf.org/doc/rfc7693/> Section 4.
blake2b384
BLAKE2b algorithm with a digest size of 384, as defined in RFC 7693 <https://datatracker.ietf.org/doc/rfc7693/> Section 4.
blake2b512
BLAKE2b algorithm with a digest size of 512, as defined in RFC 7693 <https://datatracker.ietf.org/doc/rfc7693/> Section 4.
blake3
BLAKE3 <https://github.com/BLAKE3-team/BLAKE3-specs/blob/master/blake3.pdf>
crystalsDilithium
Dilithium <https://pq-crystals.org/dilithium/>
crystalsKyber
Kyber <https://pq-crystals.org/kyber/>
falcon
FALCON <https://falcon-sign.info/falcon.pdf>
md2
MD2 message-digest algorithm, as defined in RFC 1319 <https://datatracker.ietf.org/doc/rfc1319/>.
md4
MD4 message-digest algorithm, as defined in RFC 1186 <https://datatracker.ietf.org/doc/rfc1186/>.
md5
MD5 message-digest algorithm, as defined in RFC 1321 <https://datatracker.ietf.org/doc/rfc1321/>.
md6
MD6 hash function <https://people.csail.mit.edu/rivest/pubs/RABCx08.pdf>
any hashing algorithm that does not exist in this list of entries
sha1
SHA-1, a secure hashing algorithm, as defined in RFC 3174 <https://datatracker.ietf.org/doc/rfc3174/>.
sha224
SHA-2 with a digest length of 224, as defined in RFC 3874 <https://datatracker.ietf.org/doc/rfc3874/>.
sha256
SHA-2 with a digest length of 256, as defined in RFC 6234 <https://datatracker.ietf.org/doc/rfc6234/>.
sha384
SHA-2 with a digest length of 384, as defined in RFC 6234 <https://datatracker.ietf.org/doc/rfc6234/>.
sha3_224
SHA-3 with a digest length of 224, as defined in FIPS 202 <https://csrc.nist.gov/pubs/fips/202/final>.
sha3_256
SHA-3 with a digest length of 256, as defined in FIPS 202 <https://csrc.nist.gov/pubs/fips/202/final>.
sha3_384
SHA-3 with a digest length of 384, as defined in FIPS 202 <https://csrc.nist.gov/pubs/fips/202/final>.
sha3_512
SHA-3 with a digest length of 512, as defined in FIPS 202 <https://csrc.nist.gov/pubs/fips/202/final>.
sha512
SHA-2 with a digest length of 512, as defined in RFC 6234 <https://datatracker.ietf.org/doc/rfc6234/>.
A relationship has specific context implications during an element's build phase, during development.
decommission
A relationship has specific context implications for a product's retirement and/or decommissioning.
A relationship has specific context implications during an element's design.
development
A relationship has specific context implications during development phase of an element.
A relationship has other specific context information necessary to capture that the above set of enumerations does not handle.
A relationship has specific context implications during the execution phase of an element.
A relationship has specific context implications during an element's testing phase, during development.
update
A relationship has specific context implications for a product update.
Organization
A group of people who work together in an organized way for a shared purpose.
An Organization is a group of people who work together in an organized way for a shared purpose.
PackageVerificationCode
An SPDX version 2.X compatible verification method for software packages.
This verification method is provided for compatibility with SPDX 2.X. Use of this verification code method is discouraged except for scenarios where the contentIdentifier property on Artifact can not be used. This verification method provides an independently reproducible mechanism identifying specific contents of a package based on the actual files (except the SPDX document itself, if it is included in the package) that make up each package and that correlates to the data in this SPDX document. This identifier enables a recipient to determine if any file in the original package (that the analysis was done on) has been changed and permits inclusion of an SPDX document as part of a package. Algorithm: templist = "" for all files in the package { if file is a packageVerificationCodeExcludedFile skip it /* exclude SPDX analysis file */ else append "algorithm(file)/n" to templist } sort templist in ascending order by value /* remove separators from ordered sequence */ valueslist = remove "/n"s from templist if valueslist is empty hashValue = 0 else hashValue = algorithm(valueslist) where algorithm(string) applies a hash algorithm on a string and returns the result in lowercase hexadecimal digits. Required sort order: '0', '1', '2', '3', '4', '5', '6', '7', '8', '9', 'a', 'b', 'c', 'd', 'e', 'f' (ASCII order)
PhysicalLocation
A physical location is a tangible, geographically identifiable place where objects, people, or assets exist or operate.
affects
The from /Security/Vulnerability, Action or DefinedProcess affects each to Element.
assumes
The from Element assumes each to /FunctionalSafety/Assumption.
configures
The from Element is a configuration applied to each to Element, during a LifecycleScopeType period.
conformsTo
The from Element conforms to each to /FunctionalSafety/Assumption or Specification.
coordinatedBy
The from /Security/Vulnerability is coordinatedBy the to Agent(s) (vendor, researcher, or consumer agent).
The from Action or DefinedProcess is createdBy to Agent(s).
delegatedTo
The from Agent is delegating an action to the Agent of the to Relationship (which shall be of type invokedBy), during a LifecycleScopeType period (e.g. the to invokedBy Relationship is being done on behalf of from).
dependsOn
The from Element depends on each to Element, during a LifecycleScopeType period.
doesNotAffect
The from /Security/Vulnerability has no impact on each to Element. The use of the doesNotAffect is constrained to /Security/VexNotAffectedVulnAssessmentRelationship classed relationships.
exploitCreatedBy
The from /Security/Vulnerability has had an exploit created against it by each to Agent.
fixedBy
Designates a from /Security/Vulnerability has been fixed by the to Agent(s).
fixedIn
A from /Security/Vulnerability has been fixed in each to Element. The use of the fixedIn type is constrained to /Security/VexFixedVulnAssessmentRelationship classed relationships.
foundBy
Designates a from /Security/Vulnerability was originally discovered by the to Agent(s).
hasAssessmentFor
Relates a from /Security/Vulnerability and each to Element with a security assessment. The use of the hasAssessmentFor type is constrained to /Security/VulnAssessmentRelationship classed relationships.
hasAssociatedVulnerability
Used to associate a from Artifact with each to /Security/Vulnerability.
hasConcludedLicense
The from Artifact is concluded by the SPDX data creator to be governed by each to /SimpleLicensing/AnyLicenseInfo. If the to of an Artifact's hasConcludedLicense is not the same as the to of its hasDeclaredLicense, a written explanation should be provided in the comment field of the hasConcludedLicense relationship.
hasContactPoint
The from Artifact has each to Agent as a contact point. The use of the hasContactPoint type is constrained to ContactPointRelationship classed relationships. The type of contact (i.e. security) may be specified using a ContactPointRelationship element.
hasDeclaredLicense
The from Artifact was discovered to actually contain each to /SimpleLicensing/AnyLicenseInfo (for example, as detected by automated tooling).
hasDynamicLink
The from Element dynamically links in each to Element, during a LifecycleScopeType period.
hasHost
The from /Build/Build was run on the to Element during a LifecycleScopeType period (e.g. the host that the build runs on).
hasInput
The from /Build/Build, DefinedProcess or Action element has each to Element as an input.
hasOptionalDependency
The from Element optionally depends on each to Element, during a LifecycleScopeType period.
hasOutput
The from /Build/Build, DefinedProcess or Action element generates each to Element as an output.
hasPrerequisite
The from Element has a prerequisite on each to Element, during a LifecycleScopeType period.
hasProvidedDependency
The from Element has a dependency on each to Element, dependency is not in the distributed artifact, but assumed to be provided, during a LifecycleScopeType period.
hasRequirement
The from Element has a requirement on each to Element, during a LifecycleScopeType period.
hasResolution
The from /SupplyChain/ResolutionAction points to the to /SupplyChain/OutOfSpecAction that is addressed.
hasRoleIn
The from Element has a role in the to Element. The use of the hasRoleIn is constrained to RoleRelationship classed relationships.
hasSpecification
Every to Element is a specification for the from Element (from hasSpecification to), during a LifecycleScopeType period.
hasStaticLink
The from Element statically links in each to Element, during a LifecycleScopeType period.
hasTest
Every to Element is a test artifact for the from Element (from hasTest to), during a LifecycleScopeType period.
implementedBy
The from Requirement is implemented in the to Element(s).
invokedBy
The from Element was invoked by the to Agent, during a LifecycleScopeType period (for example, a /Build/Build element that describes a build step).
locatedAt
from Element located at a specific to Location. A time period is optional.
performedBy
Every from Action is performedBy to Agent.
providesSupportFor
The from Agent provides support for each to Artifact. The use of the providesSupportFor type is constrained to SupportRelationship classed relationships.
publishedBy
Designates a from /Security/Vulnerability was made available for public use or reference by each to Agent.
reportedBy
Designates a from /Security/Vulnerability was first reported to a project, vendor, or tracking database for formal identification by each to Agent.
runsOn
The from Element (the instructions) runs on each to /Hardware/Hardware (processing element), during a LifecycleScopeType period.
serializedInArtifact
The from SpdxDocument can be found in a serialized form in each to Artifact.
tracedToDetail
The from Requirement is refined and further elaborated by each to Requirement, which contains more detailed implementation information.
underInvestigationFor
The from /Security/Vulnerability impact is being investigated for each to Element. The use of the underInvestigationFor type is constrained to /Security/VexUnderInvestigationVulnAssessmentRelationship classed relationships.
usesTool
The from Element uses each to Element as a tool, during a LifecycleScopeType period.
verifiedBy
The from Requirement that has verification (test, review, analysis etc.) details defined in the to /FunctionalSafety/RequirementVerification.
RoleRelationship
RoleRelationship represents a relationship between an entity holding a role and the scope or context in which that role applies. The givenRole property specifies the role assigned.
RoleRelationship is a concrete subclass of Relationship that captures the connection between an entities (such as a person, organization, tool, or component) and the specific position, function, or responsibility it fulfills. This relationship type is used when documenting roles that are not implicitly defined by the SPDX document structure, allowing explicit modeling of organizational responsibilities, tooling involvement, or component functions across systems or contexts. RoleRelationship inherits the from and to properties from Relationship, where: - relationshipType = hasRoleIn. - from: The element to which the role is assigned (the role recipient). - to: The context, system, element or domain within which the role exists.
SupportRelationship
Describes how an Agent provides support for an Artifact.
Specifies how an Agent supports a given Artifact. The relationship type shall be providesSupportFor. The from of the relationship is the Agent providing support, and the to are the Artifact for which support is being provided. startTime and endTime are mandatory when using this class.
In addition to being supported by the supplier, the software is known to have been deployed and is in use. For a software as a service provider, this implies the software is now available as a service.
The artifact is in active development and is not considered ready for formal support from the supplier.
endOfSupport
There is a defined end of support for the artifact from the supplier. This may also be referred to as end of life. There is a validUntilDate that can be used to signal when support ends for the artifact.
limitedSupport
The artifact has been released, and there is limited support available from the supplier. There is a validUntilDate that can provide additional information about the duration of support.
No assertion about the type of support is made. This is considered the default if no other support type is used.
noSupport
There is no support for the artifact from the supplier, consumer assumes any support obligations.
The artifact has been released, and is supported from the supplier. There is a validUntilDate that can provide additional information about the duration of support.
algorithm
Specifies the algorithm used for calculating the hash value.
An algorithm specifies the algorithm that was used for calculating the hash value.
Specifies an Extension characterization of some aspect of an Element.
extension specifies an Extension-based characterization of a particular aspect of an Element.
hashValue
The result of applying a hash algorithm to an Element.
A hashValue is the result of applying a hash algorithm to an Element.
key
A key used in a generic key-value pair.
A key used in generic a key-value pair. A key-value pair can be used to implement a dictionary which associates a key with a value.
suppliedBy
Identifies who or what supplied the artifact or VulnAssessmentRelationship referenced by the Element.
Identify the actual distribution source for the artifact (e.g., snippet, file, package, vulnerability) or VulnAssessmentRelationship being referenced. This may or may not be different from the originating distribution source for the artifact (e.g., snippet, file, package, vulnerability) or VulnAssessmentRelationship.
supportLevel
Specifies the level of support associated with an artifact.
supportLevel provides an indication of what support expectations that the supplier of an artifact is providing to the user.
verifiedUsing
Provides an IntegrityMethod with which the integrity of an Element can be asserted.
A verifiedUsing provides an IntegrityMethod with which the integrity of an Element can be asserted. Please note that different profiles may also provide additional methods for verifying the integrity of specific subclasses of Elements.
ConjunctiveLicenseSet
Portion of an AnyLicenseInfo representing a set of licensing information where all elements apply.
A ConjunctiveLicenseSet indicates that _each_ of its subsidiary AnyLicenseInfos apply. In other words, a ConjunctiveLicenseSet of two or more licenses represents a licensing situation where _all_ of the specified licenses are to be complied with. It is represented in the SPDX License Expression Syntax by the AND operator. It is syntactically correct to specify a ConjunctiveLicenseSet where the subsidiary AnyLicenseInfos may be "incompatible" according to a particular interpretation of the corresponding Licenses. The SPDX License Expression Syntax does not take into account interpretation of license texts, which is left to the consumer of SPDX data to determine for themselves.
CustomLicense
A license that is not listed on the SPDX License List.
A CustomLicense represents a License that is not listed on the SPDX License List <https://spdx.org/licenses>, and is therefore defined by an SPDX data creator.
CustomLicenseAddition
A license addition that is not listed on the SPDX Exceptions List.
A CustomLicenseAddition represents an addition to a License that is not listed on the SPDX License Exceptions <https://spdx.org/licenses/exceptions-index.html>, and is therefore defined by an SPDX data creator. It is intended to represent additional language which is meant to be added to a License, but which is not itself a standalone License.
DisjunctiveLicenseSet
Portion of an AnyLicenseInfo representing a set of licensing information where only one of the elements applies.
A DisjunctiveLicenseSet indicates that _only one_ of its subsidiary AnyLicenseInfos is required to apply. In other words, a DisjunctiveLicenseSet of two or more licenses represents a licensing situation where _only one_ of the specified licenses are to be complied with. A consumer of SPDX data would typically understand this to permit the recipient of the licensed content to choose which of the corresponding license they would prefer to use. It is represented in the SPDX License Expression Syntax by the OR operator.
ListedLicense
A license that is listed on the SPDX License List.
A ListedLicense represents a License that is listed on the SPDX License List <https://spdx.org/licenses>.
ListedLicenseException
A license exception that is listed on the SPDX Exceptions list.
A ListedLicenseException represents an exception to a License (in other words, an exception to a license condition or an additional permission beyond those granted in a License) which is listed on the SPDX License Exceptions <https://spdx.org/licenses/exceptions-index.html>.
OrLaterOperator
Portion of an AnyLicenseInfo representing this version, or any later version, of the indicated License.
An OrLaterOperator indicates that this portion of the AnyLicenseInfo represents either (1) the specified version of the corresponding License, or (2) any later version of that License. It is represented in the SPDX License Expression Syntax by the + operator. It is context-dependent, and unspecified by SPDX, as to what constitutes a "later version" of any particular License. Some Licenses may not be versioned, or may not have clearly-defined ordering for versions. The consumer of SPDX data will need to determine for themselves what meaning to attribute to a "later version" operator for a particular License.
WithAdditionOperator
Portion of an AnyLicenseInfo representing a License which has additional text applied to it.
A WithAdditionOperator indicates that the designated License is subject to the designated LicenseAddition, which can be a license exception on the SPDX License Exceptions <https://spdx.org/licenses/exceptions-index.html> (ListedLicenseException) or may be other additional text (CustomLicenseAddition). It is represented in the SPDX License Expression Syntax by the WITH operator.
deprecatedVersion
Specifies the SPDX License List version in which this license or exception identifier was deprecated.
A deprecatedVersion, for a ListedLicense on the SPDX License List <https://spdx.org/licenses/> or a ListedLicenseException on the SPDX License Exceptions <https://spdx.org/licenses/exceptions-index.html>, specifies which version release of the License List was the first one in which it was marked as deprecated.
licenseXml
Identifies all the text and metadata associated with a license in the license XML format.
The license XML format is defined and used by the SPDX legal team. The formal schema definition is available at SPDX License List XML Schema <https://github.com/spdx/license-list-XML/blob/v3.25.0/schema/ListedLicense.xsd>. For a text description of the XML fields, see XML template fields <https://github.com/spdx/license-list-XML/blob/v3.25.0/DOCS/xml-fields.md>.
listVersionAdded
Specifies the SPDX License List version in which this ListedLicense or ListedLicenseException identifier was first added.
A listVersionAdded for a ListedLicense or ListedLicenseException on the SPDX License List <https://spdx.org/licenses/> specifies which version release of the License List was the first one in which it was included.
member
A license expression participating in a license set.
A member is a license expression participating in a conjunctive (of type ConjunctiveLicenseSet) or a disjunctive (of type DisjunctiveLicenseSet) license set.
obsoletedBy
Specifies the licenseId that is preferred to be used in place of a deprecated License or LicenseAddition.
An obsoletedBy value for a deprecated License or LicenseAddition specifies the licenseId of the replacement License or LicenseAddition that is preferred to be used in its place. It shall use the same format as specified for a licenseId. The License's or LicenseAddition's comment value may include more information about the reason why the licenseId specified in the obsoletedBy value is preferred.
seeAlso
Contains a URL where the License or LicenseAddition can be found in use.
A seeAlso defines a cross-reference with a URL where the License or LicenseAddition can be found in use by one or a few projects. If applicable, it should include a URL where the license text is posted by the license steward, particularly if the license steward has made available a "canonical" primary URL for the license text. If the license is OSI approved, a seeAlso should be included with the URL for the license's listing on the OSI website. The seeAlso URL may refer to a previously-available URL for the License or LicenseAddition which is no longer active. Where applicable, the seeAlso URL should include the license text in its native language. seeAlso URLs to English or other translations may be included where multiple, equivalent official translations exist.
EvaluationResult
EvaluationResult is the result of an evaluation.
EvaluationResult represents the documented outcome of assessing a work product, like a requirement, system, component, or process against specified criteria. It records whether the evaluated subject has met, failed, or yielded an inconclusive result based on the applied EvaluationResultType. The EvaluationResult captures the rationale behind the conclusion, providing necessary context and justification while referencing the specific RequirementVerification upon which the evaluation was based. This structure ensures clear traceability and supports compliance with standards for rigorous verification and validation processes. An EvaluationResult with an evaluation value of "inconclusive" should have a value in its comment property. A rationale is a detailed explanation or reasoning that supports the EvaluationResult. It provides the underlying justification for why an evaluation was deemed to have passed, failed, or been inconclusive. This clarifies the decision-making process, citing evidence, criteria, analysis methods, and any considerations of uncertainties or risks.
BulkHardware
Products or commodities produced as a bulk unit are called bulk products. Commodities are often sold in bulk.
Products or commodities produced as a bulk unit are called bulk products. Commodities are often sold in bulk based on a batch or bulk ID number associated with the bulk unit. Bulk units defined in the QUDT Units standards.
PhysicalHardware
Class that describes a physical instance of Hardware.
A PhysicalHardware artifact describes a distinct physical unit.
VirtualHardware
Class that describes an instance of VirtualHardware.
A VirtualHardware is a distinct article related to simulation or emulation hardware. This is used to assist in recording "Digital Twinning". An FPGA simulation of hardware is a VirtualHardware. Virtual hardware requires instantiation involving specific hardware and software.
hazard
Hazards are potential sources of harm, danger, or adverse effects to people, property, the environment, or systems within or related to a specific piece of hardware.
Hazards are potential sources of harm, danger, or adverse effects to people, property, the environment, or systems within or related to a specific piece of hardware. For example, a lithium battery is a hazardous hardware item.
partNumber
Product Part Number as defined by OEM.
Product Part Number as defined by manufacturer. Can be used for an SKU.
ExportControlClassificationAssessment
Assessment of an Element for export control classification.
Assessment of an Element for export control classification according to the classification schema of one or multiple countries.
critical
When a CVSS score is between 9.0 - 10.0.
When a CVSS score is between 7.0 - 8.9.
When a CVSS score is between 0.1 - 3.9.
When a CVSS score is between 4.0 - 6.9.
none
When a CVSS score is 0.0.
CvssV2VulnAssessmentRelationship
Provides a CVSS version 2.0 assessment for a vulnerability.
A CvssV2VulnAssessmentRelationship relationship describes the determined score and vector of a vulnerability as defined in A Complete Guide to the Common Vulnerability Scoring System Version 2.0 <https://www.first.org/cvss/v2/guide>. It is intended to communicate the results of using a CVSS calculator. *Constraints* - The relationship type shall be set to hasAssessmentFor. *Example* { "type": "security_CvssV2VulnAssessmentRelationship", "spdxId": "urn:spdx.dev:cvssv2-cve-2020-28498", "relationshipType": "hasAssessmentFor", "security_score": "4.3", "security_vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "from": "urn:spdx.dev:vuln-cve-2020-28498", "to": ["urn:product-acme-application-1.3"], "security_assessedElement": "urn:npm-elliptic-6.5.2", "externalRef": [ { "type": "ExternalRef", "externalRefType": "securityAdvisory", "locator": "https://nvd.nist.gov/vuln/detail/CVE-2020-28498" }, { "type": "ExternalRef", "externalRefType": "securityAdvisory", "locator": "https://snyk.io/vuln/SNYK-JS-ELLIPTIC-1064899" }, { "type": "ExternalRef", "externalRefType": "securityFix", "locator": "https://github.com/indutny/elliptic/commit/441b742" } ], "suppliedBy": "urn:spdx.dev:agent-my-security-vendor", "security_publishedTime": "2023-05-06T10:06:13Z" }, { "type": "Relationship", "spdxId": "urn:spdx.dev:vulnAgentRel-1", "relationshipType": "publishedBy", "from": "urn:spdx.dev:cvssv2-cve-2020-28498", "to": ["urn:spdx.dev:agent-snyk"], "startTime": "2021-03-08T16:06:50Z" }
CvssV3VulnAssessmentRelationship
Provides a CVSS version 3 assessment for a vulnerability.
A CvssV3VulnAssessmentRelationship relationship describes the determined score, severity, and vector of a vulnerability as defined in Common Vulnerability Scoring System v3.0: Specification Document <https://www.first.org/cvss/v3.0/specification-document> or Common Vulnerability Scoring System v3.1: Specification Document <https://www.first.org/cvss/v3.1/specification-document>. It is intended to communicate the results of using a CVSS calculator. *Constraints* - The relationship type shall be set to hasAssessmentFor. *Example* { "type": "security_CvssV3VulnAssessmentRelationship", "spdxId": "urn:spdx.dev:cvssv3-cve-2020-28498", "relationshipType": "hasAssessmentFor", "security_score": "6.8", "security_severity": "medium", "security_vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N", "from": "urn:spdx.dev:vuln-cve-2020-28498", "to": ["urn:product-acme-application-1.3"], "security_assessedElement": "urn:npm-elliptic-6.5.2", "externalRef": [ { "type": "ExternalRef", "externalRefType": "securityAdvisory", "locator": "https://nvd.nist.gov/vuln/detail/CVE-2020-28498" }, { "type": "ExternalRef", "externalRefType": "securityAdvisory", "locator": "https://snyk.io/vuln/SNYK-JS-ELLIPTIC-1064899" }, { "type": "ExternalRef", "externalRefType": "securityFix", "locator": "https://github.com/indutny/elliptic/commit/441b742" } ], "suppliedBy": "urn:spdx.dev:agent-my-security-vendor", "security_publishedTime": "2023-05-06T10:06:13Z" }, { "type": "Relationship", "spdxId": "urn:spdx.dev:vulnAgentRel-1", "relationshipType": "publishedBy", "from": "urn:spdx.dev:cvssv3-cve-2020-28498", "to": ["urn:spdx.dev:agent-snyk"], "startTime": "2021-03-08T16:06:50Z" }
CvssV4VulnAssessmentRelationship
Provides a CVSS version 4 assessment for a vulnerability.
A CvssV4VulnAssessmentRelationship relationship describes the determined score, severity, and vector of a vulnerability as defined in Common Vulnerability Scoring System version 4.0: Specification Document <https://www.first.org/cvss/v4.0/specification-document>. It is intended to communicate the results of using a CVSS calculator. *Constraints* - The relationship type shall be set to hasAssessmentFor. *Example* { "type": "security_CvssV4VulnAssessmentRelationship", "spdxId": "urn:spdx.dev:cvssv4-cve-2021-44228", "relationshipType": "hasAssessmentFor", "security_severity": "critical", "security_score": "10.0", "security_vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N", "from": "urn:spdx.dev:vuln-cve-2021-44228", "to": ["urn:product-acme-application-1.3"], "security_assessedElement": "urn:apache-log4j-2.14.1", "externalRef": [ { "type": "ExternalRef", "externalRefType": "securityAdvisory", "locator": "https://nvd.nist.gov/vuln/detail/CVE-2021-44228" }, { "type": "ExternalRef", "externalRefType": "securityAdvisory", "locator": "https://logging.apache.org/log4j/2.x/security.html" }, { "type": "ExternalRef", "externalRefType": "securityOther", "locator": "https://www.first.org/cvss/v4.0/examples#Apache-log4j-Vulnerability-CVE-2021-44228" }, ], "suppliedBy": "urn:spdx.dev:agent-my-security-vendor", "security_publishedTime": "2023-10-05T23:09:13Z" }, { "type": "Relationship", "spdxId": "urn:spdx.dev:vulnAgentRel-1", "relationshipType": "publishedBy", "from": "urn:spdx.dev:cvssv4-cve-2021-44228", "to": ["urn:spdx.dev:agent-apache.org"], "startTime": "2021-12-11T18:39:00Z" }
EpssVulnAssessmentRelationship
Provides an EPSS assessment for a vulnerability.
An EpssVulnAssessmentRelationship relationship describes the likelihood or probability that a vulnerability will be exploited in the wild, and the percentile ranking of probability relative to all other vulnerabilities' EPSS scores, using the Exploit Prediction Scoring System (EPSS) as defined at The EPSS Model <https://www.first.org/epss/model>. *Constraints* - The relationship type shall be set to hasAssessmentFor. - The probability shall be between 0 and 1. - The percentile shall be between 0 and 1. *Example* { "type": "security_EpssVulnAssessmentRelationship", "spdxId": "urn:spdx.dev:epss-CVE-2020-28498", "relationshipType": "hasAssessmentFor", "security_probability": "0.00105", "security_percentile": "0.42356", "from": "urn:spdx.dev:vuln-cve-2020-28498", "to": ["urn:product-acme-application-1.3"], "suppliedBy": "urn:spdx.dev:agent-jane-doe", "security_publishedTime": "2023-10-05T00:00:30Z" }
ExploitCatalogVulnAssessmentRelationship
Provides an exploit assessment of a vulnerability.
An ExploitCatalogVulnAssessmentRelationship describes if a vulnerability is listed in any exploit catalog such as the CISA Known Exploited Vulnerabilities (KEV) Catalog <https://www.cisa.gov/known-exploited-vulnerabilities-catalog>. *Constraints* - The relationship type shall be set to hasAssessmentFor. *Example* { "type": "security_ExploitCatalogVulnAssessmentRelationship", "spdxId": "urn:spdx.dev:exploit-catalog-1", "relationshipType": "hasAssessmentFor", "security_catalogType": "kev", "locator": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "security_exploited": "true", "from": "urn:spdx.dev:vuln-cve-2023-2136", "to": ["urn:product-google-chrome-112.0.5615.136"], "suppliedBy": "urn:spdx.dev:agent-jane-doe", "security_publishedTime": "2021-03-09T11:04:53Z" }
SsvcVulnAssessmentRelationship
Provides an SSVC assessment for a vulnerability.
An SsvcVulnAssessmentRelationship describes the decision made using the Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree as defined by CISA Stakeholder-Specific Vulnerability Categorization Guide <https://www.cisa.gov/stakeholder-specific-vulnerability-categorization-ssvc>. It is intended to communicate the results of using the CISA SSVC Calculator. *Constraints* - The relationship type shall be set to hasAssessmentFor. *Example* { "type": "security_SsvcVulnAssessmentRelationship", "spdxId": "urn:spdx.dev:ssvc-1", "relationshipType": "hasAssessmentFor", "security_decisionType": "act", "from": "urn:spdx.dev:vuln-cve-2020-28498", "to": ["urn:product-acme-application-1.3"], "security_assessedElement": "urn:npm-elliptic-6.5.2", "suppliedBy": "urn:spdx.dev:agent-jane-doe", "security_publishedTime": "2021-03-09T11:04:53Z" }
VexAffectedVulnAssessmentRelationship
Connects a vulnerability and an element designating the element as a product affected by the vulnerability.
VexAffectedVulnAssessmentRelationship connects a vulnerability and a number of elements. The relationship marks these elements as products affected by the vulnerability. This relationship corresponds to the VEX affected status. *Constraints* When linking elements using a VexAffectedVulnAssessmentRelationship, the following requirements shall be observed: - Elements linked with a VulnVexAffectedAssessmentRelationship are constrained to the affects relationship type. *Example* { "type": "security_VexAffectedVulnAssessmentRelationship", "spdxId": "urn:spdx.dev:vex-affected-1", "relationshipType": "affects", "from": "urn:spdx.dev:vuln-cve-2020-28498", "to": ["urn:product-acme-application-1.3"], "security_assessedElement": "urn:npm-elliptic-6.5.2", "security_actionStatement": "Upgrade to version 1.4 of ACME application.", "suppliedBy": "urn:spdx.dev:agent-jane-doe", "security_publishedTime": "2021-03-09T11:04:53Z" }
modifiedTime
Specifies a time when a vulnerability assessment was modified
Specifies a time when a vulnerability assessment was last modified.
publishedTime
Specifies the time when a vulnerability was published.
Specifies the time when a vulnerability was first published.
severity
Specifies the CVSS qualitative severity rating of a vulnerability in relation to a piece of software.
The severity field provides a human readable string of the resulting numerical CVSS score.
withdrawnTime
Specified the time and date when a vulnerability was withdrawn.
SoftwareService
Software provided as a service over a network.
SoftwareService represents a service based on software components offered for access online over a network. The primary provider of the SoftwareService is the /Core/suppliedBy. Any additional providers can use a relationship of relationship type availableFrom.
LicenseExpression
An SPDX Element containing an SPDX license expression string.
A LicenseExpression enables the representation, in a single string, of a combination of one or more licenses, together with additions such as license exceptions. The syntax for a licenseExpression string is set forth in the corresponding Annex of this document ("SPDX license expressions"). A licenseExpression string is not valid if it does not conform to the grammar set forth in that Annex. The ExpandedLicensing profile can be used to represent the complete parsed license expression as a combination of license objects. customIdToUri is deprecated. Migrate to customIdToLicense. customIdToUri will be removed in a future release.
SimpleLicensingText
A license or a license addition that is not listed on the SPDX License List.
A SimpleLicensingText represents a license or a license addition that is not listed on the SPDX License List <https://spdx.org/licenses>, and is therefore defined by an SPDX data creator.
licenseText
The full plain text of a license or a license addition.
The full plain text of a license or a license addition, without templating or other similar markup. Users of the licenseText for a license can apply the SPDX License List Matching Guidelines when comparing it to another text for matching purposes.
Snippet
Describes a certain part of a file.
A Snippet describes a certain part of a file and can be used when the file is known to have some content that has been included from another original source. Snippets are useful for denoting when part of a file may have been originally created under another license or copied from a place with a known vulnerability.
application
The Element is a software application.
archive
The Element is an archived collection of one or more files (.tar, .zip, etc.).
The Element is a bill of materials.
configuration
The Element is configuration data.
container
The Element is a container image which can be used by a container runtime application.
data
The Element is data.
device
The Element refers to a chipset, processor, or electronic board.
deviceDriver
The Element represents software that controls hardware devices.
diskImage
The Element refers to a disk image that can be written to a disk, booted in a VM, etc. A disk image typically contains most or all of the components necessary to boot, such as bootloaders, kernels, firmware, userspace, etc.
The Element is documentation.
evidence
The Element is the evidence that a specification or requirement has been fulfilled.
executable
The Element is an Artifact that can be run on a computer.
The Element is a single file which can be independently distributed (configuration file, statically linked binary, Kubernetes deployment, etc.).
filesystemImage
The Element is a file system image that can be written to a disk (or virtual) partition.
firmware
The Element provides low level control over a device's hardware.
framework
The Element is a software framework.
install
The Element is used to install software on disk.
library
The Element is a software library.
manifest
The Element is a software manifest.
model
The Element is a machine learning or artificial intelligence model.
module
The Element is a module of a piece of software.
operatingSystem
The Element is an operating system.
The Element doesn't fit into any of the other categories.
patch
The Element contains a set of changes to update, fix, or improve another Element.
platform
The Element represents a runtime environment.
requirement
The Element provides a requirement needed as input for another Element.
The Element is a single or a collection of source files.
The Element is a plan, guideline or strategy how to create, perform or analyze an application.
The Element is a test used to verify functionality on a software element.
AssemblyAction
AssemblyAction represents the event of creating a product by assembling individual components.
AssemblyAction refers to the process of constructing a product by putting together various components. These actions can vary depending on the purpose and requirements. In this context, the assembled product is typically designed to allow for disassembly.
AssemblyProcess
The AssemblyProcess represents the process of creating a product by assembling a set of components, potentially in a way that allows for at disassembly (at least partially).
The AssemblyProcess refers to the systematic method of putting together different components to create a finished product. The process of assembly is part of the manufacturing process used in industries such as automotive, electronics, aerospace, and consumer goods. Assembled products may be designed to be disassembled into components.
BoundaryCrossingAction
An action of crossing a boundary is defined in this class.
Boundary crossing occurs when an individual, object, or system moves between different defined areas, domains, or disciplines. It can apply to various fields, including education, psychology, business, logistics, and technology.
BoundaryDefinitionAction
The boundary definition is used to define boundaries.
Boundaries can be physical or abstract. This is the act of defining the boundaries. Relationship: For each BoundaryDefinitionAction there is one and only one /Core/Relationship class or subclass with the relationshipType of createdBy on the to and a /Core/Agent class or subclass on the from.
BoundaryDefinitionProcess
The Boundary Definition Process refers to the process class used to produce boundaries.
This is the process of defining boundaries for the creation of a region.
ChangeAction
An actual change to a product.
A ChangeAction represents an alteration made to a product. Such alterations may include intentional adjustments or repairs. A repair is a corrective modification that restores a product to a functional or acceptable state following a defect, failure, or damage. Common examples of repairs are replacing worn components, correcting misalignments, sealing leaks, or reestablishing intended performance characteristics. Firmware updates performed are included, as they may correct software defects, or improve performance, or add new capabilities.
ChangeProcess
A prescribed change to a product.
A ChangeProcess is a planned process causing an intentional change to a product, such as an adjustment.
DestroyAction
The record of destruction is entered in this action.
The action of destroying an element is recorded as part of the DestroyAction. To destroy refers to the act of completely eliminating, or rendering something unusable or irretrievable.
DestroyProcess
The destruction process is defined in this process.
Destroyed means to render an item useless. The destroyed process defines the method used to destroy an item.
HarvestAction
HarvestAction represents the act of creating a product by directly extracting goods or materials from nature.
HarvestAction refers to an event where goods or products are obtained directly from natural sources. This includes activities such as mining, and fishing. In such cases, there may be no associated hasInput relationships, as the products are not assembled from other components but sourced directly.
HarvestProcess
Harvest is the process of extracting goods or products from nature.
Harvest is the process of extracting goods or products from nature. This includes mining, fishing and husbandry.
InspectionAction
An inspection action refers to a specific activity or set of activities performed during an inspection to examine, verify, or evaluate an item, process, or system.
An inspection action refers to a specific activity or set of activities performed during an inspection to examine, verify, or evaluate an item, process, or system. These actions are typically intended to identify whether the subject being inspected meets required standards, regulations, or specifications.
InspectionProcess
Inspection Process defines specific various processes needed to satisfy the inspection requirements for a specific product or service.
Different types of products and services require different types of inspection processes. Your specific inspection process is defined in this process. You can define multiple inspection processes for goods based on requirements.
InstantiateVirtualHardwareProcess
Class that describes an InstantiateVirtualHardwareProcess that is used to define VirtualHardware and its source.
InstantiateVirtualHardwareProcess is a class defining the process needed to instantiate a 'VirtualHardware' defined by running software package(s).
ManufactureAction
ManufactureAction represents the act of creating a product by a manufacturing process.
ManufactureAction refers to an event where goods are created using materials or ingredients, typically resulting in a product that cannot be easily disassembled.
ManufactureProcess
This class represents the process involved in manufacturing products.
The manufacturing process encompasses the series of steps required to transform materials into finished goods. It is a fundamental operation across various industries, including automotive, electronics, pharmaceuticals, textiles, and food production.
PlanAction
A PlanAction involves the execution of a plan in relation to a PlanProcess.
A PlanAction involves the execution of a plan in relation to a PlanProcess. The description of the PlanAction is a mandatory property. Relationship: For each PlanAction there is at least one /Core/Relationship class or subclass with the relationshipType of 'generates’ on the to and a PlanProcess class or subclass on the from.
PlanProcess
Process plans outline the stages of implementation or use related to a process.
Complex processes require plans, therefore a process plan outlines procedures required to deliver a specified requirement.
ReproduceAction
Reproduction is the biological process by which organisms generate new individuals of the same species.
Reproduction involves the act of replicating or reproducing a product. This includes producing new products related to husbandry, agriculture, and fishing. Relationship: For each ReproduceAction there is at least one /Core/Relationship class or subclass with the relationshipType of 'hasInput’ on the from and a /Core/Element class or subclass on the to.
ReproduceProcess
Reproduction is the biological process by which living organisms produce offspring.
Reproduction is the biological process by which living organisms produce offspring. It occurs in plants, animals, and microorganisms.
ResponsibilityChangeAction
ResponsibilityChangeAction refers to the transfer of responsibility from one party to another.
Changes of responsibility are recorded in this process. Responsibility Change refers to the transfer of rights, responsibilities, and/or control of an asset, property, business, or entity from one party to another. This change can occur in various contexts, including real estate, business acquisitions, intellectual property, and assets. The startTime and endTime can be the same time.
ResponsibilityChangeProcess
ResponsibilityChangeProcess refers to the process of transferring responsibility from one party to another.
The process changes of responsibility are recorded in this process. Responsibility Change refers to the transfer of rights, responsibilities, and/or control of an asset, property, business, or entity from one party to another.
custody
Custody refers to the responsibility, control, and safekeeping of an asset, person, or legal entity. It involves both physical possession and legal authority over something or someone.
ownership
Ownership refers to the legal right to control, manage, and benefit from an asset, resource, or responsibility. It establishes authority, accountability, and entitlements over something, whether it's property, a business, intellectual property, or responsibilities.
StateAction
This is the state of an affected Element at a specific moment in time.
The state of a specific Element is defined, measured or observed in this class at a specific moment in time. The StateAction is defined by the method used by the DefinedStateProcess to produce an outcome.
StorageAction
Records the storage of a product.
A StorageAction expresses the actual storage of product in a specific location.
StorageProcess
Prescribes the storage of a product.
A StorageProcess expresses the planned storage of product in an optionally-specified location.
TestAction
A test action is a specific action associated with a test.
A test action is a specific action associated with a test. The execution of a test is a test action.
TestProcess
Test Process defines the testing process for an element.
Tests are processes based on requirements. The process's requirements are met by the test process. Relationship: For each TestProcess there is at least one /Core/Relationship class or subclass with the relationshipType of 'contains’ on the from and a Requirements class or subclass on the to.
TransportAction
An actual change to a product's location.
A TransportAction expresses the change in location of a product, such as a component being moved from an assembly plant to a warehouse.
TransportProcess
A prescribed change to a product's location.
A TransportProcess is a process that will result in a change in location of a product, such as a component being moved from an assembly plant to a warehouse.
responsibilityCategory
responsibilityCategory classifies the nature or domain of a responsibility transfer.
This property categorizes responsibility changes based on the type of rights, responsibilities, or control being transferred.
EnergyConsumption
A class for describing the energy consumption incurred by an AI model in different stages of its lifecycle.
A class to denote the known or estimated energy consumption of an AI model during its training, fine-tuning, and inference stages. *Example* { "type": "ai_EnergyConsumption", "ai_trainingEnergyConsumption": [ { "type": "ai_EnergyConsumptionDescription", "ai_energyQuantity": "36.5", "ai_energyUnit": "kilowattHour" } ], "ai_inferenceEnergyConsumption": [ { "type": "ai_EnergyConsumptionDescription", "ai_energyQuantity": "0.042", "ai_energyUnit": "kilowattHour" } ] }
AnnotationType
Specifies the type of an annotation.
ElementMap
A key with an Element.
The class used for implementing mapping a string key to an Element. Each ElementMap contains a key-value pair which maps the key to its associated Element. To implement a dictionary, this class is to be used in a collection with unique keys.
ExternalMap
A map of Element identifiers that are used within an SpdxDocument but defined external to that SpdxDocument.
An external map is a map of Element identifiers that are used within an SpdxDocument but defined external to that SpdxDocument. The external map provides details about the externally-defined Element such as its provenance, where to retrieve it, and how to verify its integrity.
ExternalRef
A reference to a resource outside the scope of SPDX 3 content related to an Element.
An External Reference points to a general resource outside the scope of the SPDX 3 content that provides additional context, characteristics or related information about an Element.
MeasureOfMass
The measure of mass refers to the quantity of matter in an object or substance.
The measure of mass refers to the quantity of matter in an object or substance. Mass is a fundamental property of matter and is typically measured in various units depending on the system of measurement being used.
NamespaceMap
A mapping between prefixes and namespace partial URIs.
A namespace map allows the creator of a collection of serializable Elements to suggest shorter identifiers ("prefixes") for specific namespace portions of Element IDs. This map is used in SPDX content serialization to provide a more human-readable and smaller serialized representation of the Elements. For details of how NamespaceMap content is to be serialized please refer to the Model and serializations clause and the various serialization format-specific files within the spdx-3-model repository <https://github.com/spdx/spdx-3-model/tree/main/serialization>. Namespace maps support a variety of relevant use cases such as: 1. An SPDX content producer wishing to provide clarity of their serialization of an SPDX 2.X simple style collection where all content is newly minted and a single prefix-namespace is used. The consumer of SPDX content wishes to preserve the name space mapping provided by such a producer. In this case, the consumer would record the namespace map prefixes in the NamespaceMap such that subsequent serializations could reproduce the prefixes / namespaces in the native serialization format. 2. An SPDX content producer wishing to maintain consistent prefix use and understanding across multiple different serialization formats of the produced content. For example, an SBOM producer wishes to share/publish the SBOM as JSON-LD and XML. The producer can specify the preferred prefix mappings in the native serialization format using information from a single NamespaceMap accessible local to the producer. 3. An SPDX content consumer/producer wishing to maintain consistent prefix use while round tripping from SPDX content received, deserialized, modified/extended in some way, and then reserialized in the same serialization form. In this case the prefix-namespace mappings utilized in the content are transformed from the original native namespace/prefix into the in memory NamespaceMap then transformed from the NamespaceMap back into the resultant serialization native namespace / prefix format.
Indicates absence of the field.
Makes no assertion about the field.
yes
Indicates presence of the field.
SpdxDocument
A collection of SPDX Elements that could potentially be serialized.
The SpdxDocument provides a convenient way to express information about collections of SPDX Elements that could potentially be serialized as complete units (e.g., all in-scope SPDX data within a single JSON-LD file). SpdxDocument is independent of any particular serialization format or instance. Information we wish to preserve about a specific instance of serialization of this SPDX content is NOT expressed using the SpdxDocument but rather using an associated Artifact representing a particular instance of SPDX data physical serialization. Any instance of serialization of SPDX data shall not contain more than one SpdxDocument element definition.
contentType
Provides information about the content type of an Element or a property.
This field is a reasonable estimation of the content type of the Element or the property, from a creator perspective. Content type is intrinsic to the Element or the property, independent of how it is being used.
CdxPropertyEntry
A property name with an associated value.
Each CdxPropertyEntry contains a name-value pair which maps the name to its associated value. Unlike key-value stores, properties in CdxPropertiesExtension support duplicate names, each potentially having different values. This class can be used to implement CycloneDX compatible properties.
Extension
A characterization of some aspect of an Element that is associated with the Element in a generalized fashion.
An Extension is a characterization of some aspect of an Element that is associated with the Element in a generalized fashion. Rather than being associated with a particular Element through the typical use of a purpose-specific object property an Extension is associated with the Element it characterizes using a single common generalized object property. This approach serves multiple purposes: 1. Support profile-based extended characterization of Elements. Enables specification and expression of Element characterization extensions within any profile and namespace of SPDX without requiring changes to other profiles or namespaces and without requiring local subclassing of remote classes (which could inhibit ecosystem interoperability in some cases). 2. Support extension of SPDX by adopting individuals or communities with Element characterization details uniquely specialized to their particular context. Enables adopting individuals or communities to utilize SPDX expressive capabilities along with expressing more arcane Element characterization details specific to them and not appropriate for standardization across SPDX. 3. Support structured capture of expressive solutions for gaps in SPDX coverage from real-world use. Enables adopting individuals or communities to express Element characterization details they require that are not currently defined in SPDX but likely should be. Enables a practical pipeline that: - identifies gaps in SPDX that should be filled, - expresses solutions to those gaps in a way that allows the identifying adopters to use the extended solutions with SPDX and does not conflict with current SPDX, - can be clearly detected among the SPDX content exchange ecosystem, - provides a clear and structured definition of gap solution that can be used as submission for revision to SPDX standard
https://spdx.org/rdf/3/terms/Extension/Extension is abstract and must not be instantiated directly.
Project
Temporary endeavor with a beginning and an end and that must be used to create a unique product, service or result.
Temporary endeavor with a beginning and an end and that must be used to create a unique product, service or result. Based on the Project Management Body of Knowledge (PMBOK), 3rd edition. startTime is the time at which a project starts or is planned to start. endTime is the time at which a project ends or is planned to end.
ExploitCatalogType
VexFixedVulnAssessmentRelationship
Links a vulnerability and elements representing products (in the VEX sense) where a fix has been applied and are no longer affected.
VexFixedVulnAssessmentRelationship links a vulnerability to a number of elements representing VEX products where a vulnerability has been fixed and are no longer affected. It represents the VEX fixed status. *Constraints* When linking elements using a VexFixedVulnAssessmentRelationship, the following requirements shall be observed: - Elements linked with a VulnVexFixedAssessmentRelationship are constrained to using the fixedIn relationship type. *Example* { "type": "security_VexFixedVulnAssessmentRelationship", "spdxId": "urn:spdx.dev:vex-fixed-in-1", "relationshipType": "fixedIn", "from": "urn:spdx.dev:vuln-cve-2020-28498", "to": ["urn:product-acme-application-1.3"], "security_assessedElement": "urn:npm-elliptic-6.5.4", "suppliedBy": "urn:spdx.dev:agent-jane-doe", "security_publishedTime": "2021-03-09T11:04:53Z" }
VexNotAffectedVulnAssessmentRelationship
Links a vulnerability and one or more elements designating the latter as products not affected by the vulnerability.
VexNotAffectedVulnAssessmentRelationship connects a vulnerability and a number of elements designating them as products not affected by the vulnerability. This relationship corresponds to the VEX not_affected status. *Constraints* When linking elements using a VexNotVulnAffectedAssessmentRelationship, the following requirements shall be observed: - Relating elements with a VexNotAffectedVulnAssessmentRelationship is restricted to the doesNotAffect relationship type. - Both impactStatement and justificationType properties have a cardinality of 0..1 making them optional. Nevertheless, to produce a valid VEX not_affected statement, one of them shall be defined. This is specified in the Minimum Elements for VEX. *Example* { "type": "security_VexNotAffectedVulnAssessmentRelationship", "spdxId": "urn:spdx.dev:vex-not-affected-1", "relationshipType": "doesNotAffect", "from": "urn:spdx.dev:vuln-cve-2020-28498", "to": ["urn:product-acme-application-1.3"], "security_assessedElement": "urn:npm-elliptic-6.5.2", "security_justificationType": "componentNotPresent", "security_impactStatement": "Not using this vulnerable part of this library.", "suppliedBy": "urn:spdx.dev:agent-jane-doe", "security_publishedTime": "2021-03-09T11:04:53Z" }
VexUnderInvestigationVulnAssessmentRelationship
Designates elements as products where the impact of a vulnerability is being investigated.
VexUnderInvestigationVulnAssessmentRelationship links a vulnerability to a number of products stating the vulnerability's impact on them is being investigated. It represents the VEX under_investigation status. *Constraints* When linking elements using a VexUnderInvestigationVulnAssessmentRelationship the following requirements shall be observed: - Elements linked with a VexUnderInvestigationVulnAssessmentRelationship are constrained to using the underInvestigationFor relationship type. *Example* { "type": "security_VexUnderInvestigationVulnAssessmentRelationship", "spdxId": "urn:spdx.dev:vex-underInvestigation-1", "relationshipType": "underInvestigationFor", "from": "urn:spdx.dev:vuln-cve-2020-28498", "to": ["urn:product-acme-application-1.3"], "security_assessedElement": "urn:npm-elliptic-6.5.2", "suppliedBy": "urn:spdx.dev:agent-jane-doe", "security_publishedTime": "2021-03-09T11:04:53Z" }
score
Provides a numerical (0-10) representation of the severity of a vulnerability.
The score provides information on the severity of a vulnerability per the Common Vulnerability Scoring System as defined by Forum of Incident Response and Security Teams <https://www.first.org/cvss/>.
vectorString
Specifies the CVSS vector string for a vulnerability.
Specifies any combination of the CVSS Base, Temporal, Threat, Environmental, and/or Supplemental vector string values for a vulnerability. Supports vectorStrings specified in all CVSS versions. *Constraints* String values for the vectorString range shall only include the abbreviated form of metric names specified in CVSS specifications, e.g. Common Vulnerability Scoring System Vector String <https://www.first.org/cvss/v4.0/specification-document#Vector-String>.
ContentIdentifierType
Specifies the type of a content identifier.
OutOfSpecAction
An out of specification action is defined in this class.
OutOfSpecAction refers to a situation where a product, material, environment, or process fails to meet the established standards or predefined specifications or exceeds specification parameters. Any result or condition that goes beyond these predefined parameters or thresholds is considered "out of specification," indicating a non-conformance or deviation that must be investigated and addressed to maintain product quality and regulatory compliance. This term is often used in industries like manufacturing, pharmaceuticals, quality control, and regulatory compliance
ResolutionAction
Products out of specification require a resolution action. This is the action of resolution.
Products out of specification require a resolution action. This is the action of resolution. Relationship: For each ResolutionAction there is at least one /Core/Relationship class or subclass with the relationshipType of 'resolved’ on the from and an OutOfSpecAction class or subclass on the to.
ResponsibilityType
Specifies the type of responsibility held over an asset, property, or entity.
EnergyUnitType
Unit of energy consumption.
Bundle
A collection of Elements that have a shared context.
A bundle is a collection of Elements that have a shared context.
ElementCollection
A collection of Elements, not necessarily with unifying context.
An ElementCollection is a collection of Elements, not necessarily with unifying context. All ElementCollections shall conform to the Core profile even if the Core profile is not specified in the profileConformance property. If the profileConformance property is not provided, it shall be evaluated as a list containing the "core" profile identifier. The inclusion of a profile identifier within the profileConformance property shall constitute a declaration that all constituent elements conform to the restrictions specified by that profile. *Constraints* - If the ElementCollection has at least 1 element, it shall also have at least 1 rootElement. - The element shall not be of type SpdxDocument. - The rootElement shall not be of type SpdxDocument.
https://spdx.org/rdf/3/terms/Core/ElementCollection is abstract and must not be instantiated directly.
Hash
A mathematically calculated representation of a grouping of data.
A hash is a grouping of characteristics unique to the result of applying a mathematical algorithm that maps data of arbitrary size to a bit string (the hash) and is a one-way function, that is, a function which is practically infeasible to invert. This is commonly used for integrity checking of data. Please note that different profiles may also provide additional methods for verifying the integrity of specific subclasses of Elements.
IndividualElement
A concrete subclass of Element used by Individuals in the Core profile.
Individuals, such as NoneElement and NoAssertionElement, need to reference a concrete subclass of Element. This class provides the type used by the individuals defined in the Core profile.
RelationshipCompleteness
Indicates whether a relationship is known to be complete, incomplete, or if no assertion is made with respect to relationship completeness.
Role
A Role defines a specific position, function, or capacity that an entity may assume within any relevant context.
A Role defines a specific position, function, or capacity that an entity may assume within any relevant context. This context is intentionally broad and adaptable, capable of representing environments including, but not limited to, software builds, system architectures, project management structures, distribution channels, supply chain operations, lifecycle stages, or any other domain where entities perform specific functions. The Role class provides a structured mechanism to model these functional assignments independently of the entities themselves, allowing for reusable and standardized definitions of responsibilities and privileges across different SPDX documents and ecosystems.
Tool
An element of hardware and/or software utilized to carry out a particular function.
A Tool is an element of hardware and/or software utilized to carry out a particular function.
endTime
The point in time when an element or an action ends, becomes no longer applicable, or becomes no longer valid.
A timestamp marking the conclusion of an action, the ending of an element's relevance, or the intended or unintended termination of either. It encompasses the moment of completion or cessation of processes, such as build finishes, service shutdowns, or system failures, as well as the point in time when an element or a relationship between elements becomes deprecated, expired, terminated, or inactive.
startTime
The point in time when an element or an action starts, becomes applicable, or becomes valid.
A timestamp marking the commencement of an action, the beginning of an element's relevance, or the intended start of either. It encompasses the moment of triggering processes, such as build executions or service instantiations, as well as the point in time when an element or a relationship between elements becomes effective or active.
IndividualLicensingInfo
A concrete subclass of AnyLicenseInfo used by Individuals in the ExpandedLicensing profile.
Individuals, such as NoneLicense and NoAssertionLicense, need to reference a concrete subclass of AnyLicenseInfo. This class provides the type used by the individuals.
Assumption
A distinct unit representing a constraint associated with an item's use in a system.
An assumption element is a distinct unit that defines a design constraint. This constraint is imposed by the intended design, the requirement context, or the operational context. It ensures the item operates correctly within a system context.
EvaluationResultType
Specifies the outcome of an evaluation or verification process.
VirtualHardwareModelType
Specifies the type of simulation model used to represent virtual hardware.
ExportControlClassification
ContentIdentifier
A canonical, unique, immutable identifier.
A ContentIdentifier is a canonical, unique, immutable identifier of the content of a software artifact, such as a package, a file, or a snippet. It can be used for verifying its identity and integrity.
File
Refers to any object that stores content on a computer.
Refers to any object that stores content on a computer. The type of content can optionally be provided in the contentType property. The fileKind property can be set to directory to indicate the file represents a directory and all content stored in that directory. The fileKind property can be set to symlink to indicate the file represents a link to another file or directory, it does not represent the file or directory referenced by the symlink.
FileKindType
Enumeration of the different kinds of SPDX file.
Package
Refers to any unit of content that can be associated with a distribution of software.
A package refers to any unit of content that can be associated with a distribution of software. Typically, a package is composed of one or more files. Any of the following non-limiting examples may be (but are not required to be) represented in SPDX as a package: - a tarball, zip file or other archive - a directory or sub-directory - a separately distributed piece of software which another Package or File uses or depends upon (e.g., a Python package, a Go module, ...) - a container image, and/or each image layer within a container image - a collection of one or more sub-packages - a Git repository snapshot from a particular point in time Note that some of these could be represented in SPDX as a file as well.
DefinedStateProcess
This process is used to determine the state of an affected Element.
This process is used to determine the state of an affected Element. The DefinedStateProcess is used to define a list of valid states of an affected Element. A DefinedStateProcess may describe the steps or conditions required to move an entity from one state to another.
SafetyRiskAssessmentType
Safety risk level.
Build
Class that describes a build instance of software/artifacts.
A build is a representation of the process in which a piece of software or artifact is built. It encapsulates information related to a build process and provides an element from which relationships can be created to describe the build's inputs, outputs, and related entities (e.g. builders, identities, etc.). ExternalIdentifier of type "urlScheme" may be used to identify build logs. In this case, the comment of the ExternalIdentifier shall be "LogReference". Note that startTime and endTime are optional, and may be omitted to simplify creating reproducible builds. buildStartTime and buildEndTime are deprecated. Migrate to startTime and endTime buildStartTime and buildEndTime will be removed in a future release.
ContactPointRelationshipType
Information about the type of contact point for ContactPointRelationships.
PositiveIntegerRange
A tuple of two positive integers that define a range.
PositiveIntegerRange is a tuple of two positive integers that define a range. "beginIntegerRange" shall be less than or equal to "endIntegerRange".
ProcessReadinessType
The ProcessReadinessType is defined by the enumeration.
An Organization representing the SPDX Project.
SpecificationType
UnitOfMeasure
UnitOfMeasure specify information structures through industry standards for Units of Measure, Quantity Kinds, Dimensions and Data Types.
The QUDT, or "Quantity, Unit, Dimension and Type" schema defines the base classes properties, and restrictions used for modeling physical quantities, units of measure, and their dimensions in various measurement systems.
rationale
A rationale is supporting information that provides the underlying justification or reasoning for an associated element, decision, or process.
A rationale is a detailed explanation that documents the logic and intent behind a specific element, decision, or process. It provides the justification for why an item exists or why a particular conclusion was reached, often citing evidence, criteria, or analysis methods. This context ensures transparency in the decision-making process by accounting for the considerations, risks, or motivations that inform the primary statement.
version
Version string for an Element.
Describes the specific version of an Element.
RequirementVerification
RequirementVerification class defines the base properties of a verification.
RequirementVerification class describes the method of verification. With this class it is possible to identify verification items, such as testcases, checklists or analysis frameworks, etc. It allows to add information for the verification preconditions (what needs to be present before even starting a verification task, run the test case etc.) and what are the postconditions (what has to have happened, what is the state of the item under verification, to be confident the verification task is completed). Verification typically checks if a requirement has been implemented or refined by more details correctly by a subsequent work product (like a technical specification needs to be verified if it correctly refines a functional specification, or that code correctly implements the state machine defined in a software component design requirement). A rationale is supporting information that adds more context on how verification needs to be performed, justifies the chosen verification method, etc.
Dimensions
Dimensions generally refer to measurable extents or attributes that define the size, shape, or scale of an object, system, or concept.
Dimensions generally refer to measurable extents or attributes that define the size, shape, or scale of an object, system, or concept. The Z axis is the height of the object.
SsvcDecisionType
Specifies the SSVC decision type.
AuthenticationProtocolType
Protocols which support authentication.
SoftwareArtifact
A distinct article or unit related to Software.
A software artifact is a distinct article or unit related to software such as a package, a file, or a snippet.
https://spdx.org/rdf/3/terms/Software/SoftwareArtifact is abstract and must not be instantiated directly.
ModifyAction
An actual alteration of a product.
A ModifyAction is an action that alters a product, such as a change to its configuration or its location. Relationship: For each ModifyAction there is at least one /Core/Relationship class or subclass with the relationshipType of hasOutput on the from and a /Core/Element subclass on the to. For each ModifyAction there is at least one /Core/Relationship class or subclass with the relationshipType of performedBy on the from and a /Core/Element subclass on the to.
https://spdx.org/rdf/3/terms/SupplyChain/ModifyAction is abstract and must not be instantiated directly.
ModifyProcess
A prescribed alteration of a product.
A ModifyProcess is a process that will result in the alteration of a product, such as a change to its configuration or its location. Relationship: For each ModifyProcess there is at least one /Core/Relationship class or subclass with the relationshipType of 'hasOutput’ on the from and a /Core/Element subclass on the to. For each ModifyProcess there is at least one /Core/Relationship class or subclass with the relationshipType of 'hasInput’ on the from and a /Core/Element subclass on the to.
https://spdx.org/rdf/3/terms/SupplyChain/ModifyProcess is abstract and must not be instantiated directly.
PresenceType
Categories of presence or absence.
RequirementStatusType
Provide an enumerated set of requirement statuses that can provide state to a requirement.
comment
Provide consumers with comments by the creator of the Element about the Element.
A comment is an optional field for creators of the Element to provide comments to the readers/reviewers of the document.
ConfidentialityLevelType
Confidentiality level.
DatasetAvailabilityType
Availability of dataset.
ExtendableLicense
Abstract class representing a License or an OrLaterOperator.
The WithAdditionOperator can have a License or an OrLaterOperator as the license property value. This class is used for the value.
https://spdx.org/rdf/3/terms/ExpandedLicensing/ExtendableLicense is abstract and must not be instantiated directly.
License
Abstract class for the portion of an AnyLicenseInfo representing a license.
A License represents a license text, whether listed on the SPDX License List <https://spdx.org/licenses/> (ListedLicense) or defined by an SPDX data creator (CustomLicense).
https://spdx.org/rdf/3/terms/ExpandedLicensing/License is abstract and must not be instantiated directly.
LicenseAddition
Abstract class for additional text intended to be added to a License, but which is not itself a standalone License.
A LicenseAddition represents text which is intended to be added to a License as additional text, but which is not itself intended to be a standalone License. It may be an exception which is listed on the SPDX License Exceptions <https://spdx.org/licenses/exceptions-index.html> (ListedLicenseException), or may be any other additional text (as an exception or otherwise) which is defined by an SPDX data creator (CustomLicenseAddition).
https://spdx.org/rdf/3/terms/ExpandedLicensing/LicenseAddition is abstract and must not be instantiated directly.
EvidenceType
EvidenceType refers to categories of documented or observable proof used to verify compliance, qualification, or performance
Hardware
Class that describes an instance of Hardware.
A hardware artifact is a distinct unit related to hardware.
https://spdx.org/rdf/3/terms/Hardware/Hardware is abstract and must not be instantiated directly.
CvssSeverityType
Specifies the CVSS base, temporal, threat, or environmental severity type.
VexJustificationType
Specifies the VEX justification type.
VexVulnAssessmentRelationship
Abstract ancestor class for all VEX relationships.
VexVulnAssessmentRelationship is an abstract subclass that defined the common properties shared by all the SPDX-VEX status relationships. *Constraints* When linking elements using a VexVulnAssessmentRelationship, the following requirements shall be observed: - The to: end shall point to elements representing the VEX *products*. To specify a different element where the vulnerability was detected, the VEX relationship can optionally specify *subcomponents* using the assessedElement property. VEX inherits information from the document level down to its statements. When a statement is missing information it can be completed by reading the equivalent field from the containing document. For example, if a VEX relationship is missing data in its createdBy property, tools shall consider the entity listed in the CreationInfo section of the document as the VEX author. In the same way, when a VEX relationship does not have a created property, the document's date shall be considered as authoritative.
https://spdx.org/rdf/3/terms/Security/VexVulnAssessmentRelationship is abstract and must not be instantiated directly.
CreateAction
CreationAction represents an event of product creation.
CreationAction represents the lifecycle event of Product creation. A product could be manufactured, assembled, mined/extracted directly from the nature etc. Relationship: For each CreateAction there is at least one /Core/Relationship class or subclass with the relationshipType of 'hasOutput’ on the from and a /Core/Element class or subclass on the to.
https://spdx.org/rdf/3/terms/SupplyChain/CreateAction is abstract and must not be instantiated directly.
State
A state is an instance that describes what a system, component, subsystem, process, or project has achieved at any given time.
A state is an instance that describes what a system, component, subsystem, process, or project has achieved at any given time. States are used to describe different conditions within a system and provide information about its current status. They help us understand the behavior of systems or product by showing their progression through various states over time. States describe what a project has achieved (or not) as opposed to describing actions taken by people involved with the project, or activities performed during development of that project.
UseProcess
Use Process defines actions used by elements.
The UseProcess is an abstract class used to define processes that interact with key elements. Plan, state, and inspection processes plus managing boundaries are critical processes used by elements. Relationship: For each UseProcess or subclass except the PlanProcess there is at least one /Core/Relationship class or subclass with the relationshipType of 'affects’ on the from and a /Core/Element class or subclass on the to.
https://spdx.org/rdf/3/terms/SupplyChain/UseProcess is abstract and must not be instantiated directly.
EnergyConsumptionDescription
The class that helps note down the quantity of energy consumption and the unit used for measurement.
This class is designed to store energy consumption data, including the quantity and the unit of measurement. The energyQuantity property stores the amount of energy consumed, and the energyUnit property stores the unit used for measurement. For example, 0.042 kilowatt-hour of energy will have 0.042 as a value for property energyQuantity, and "kilowattHour" as a value for property energyUnit. *Example* { "type": "ai_EnergyConsumptionDescription", "ai_energyQuantity": "0.042", "ai_energyUnit": "kilowattHour" }
IntegrityMethod
Provides an independently reproducible mechanism that permits verification of a specific Element.
An IntegrityMethod provides an independently reproducible mechanism that permits verification of a specific Element that correlates to the data in this SPDX document. This identifier enables a recipient to determine if anything in the original Element has been changed and eliminates confusion over which version or modification of a specific Element is referenced. Please note that different profiles may also provide additional methods for verifying the integrity of specific subclasses of Elements.
https://spdx.org/rdf/3/terms/Core/IntegrityMethod is abstract and must not be instantiated directly.
MeasureOfLength
The measure of length refers to the dimension of an object or space that describes how long it is, typically expressed in various units depending on the system of measurement being used.
SbomType
Provides a set of values to be used to describe the common types of SBOMs that tools may create.
CreateProcess
The CreateProcess refers to the abstract process class that can be used to represent the process of creation of a product.
The creation process refers to the systematic steps involved in bringing something new into existence. This can apply to products, ideas, businesses, art, software, and even life itself. Relationship: For every CreateProcess, there exists at least one /Core/Relationship class or subclass with a relationshipType of 'hasOutput', connecting the CreateProcess (from) to a /Core/Element class or subclass (to).
https://spdx.org/rdf/3/terms/SupplyChain/CreateProcess is abstract and must not be instantiated directly.
CreationInfo
The CreationInfo provides information about who created the Element, and when and how it was created. The dateTime created is often the date of last change (e.g., a git commit date), not the date when the SPDX data was created, as doing so supports reproducible builds.
DefinedType
The DefinedType class associates a specific type with its defined source.
The DefinedType class associates a specific type with its defined source. It provides a structured way to represent defined types, holds information about the type's identity and the source specification that defines its structure and semantics.
IsoAutomationLevel
Defines the level of automation a system possesses.
SupportType
Type of support that is associated with an artifact.
Relationship
Describes a relationship between one or more elements.
A Relationship is a grouping of characteristics unique to an assertion that one Element is related to one or more other Elements in some way. To explicitly assert that no such relationships exist, the to property shall contain the NoneElement individual and no other elements. A relationship that contains NoneElement and additional elements in the to property is not valid. To explicitly assert that no assertions are being made regarding the existence of such relationships, the to property shall contain the NoAssertionElement individual.
VerificationType
Enumeration of verification types.
VulnAssessmentRelationship
Abstract ancestor class for all vulnerability assessments.
VulnAssessmentRelationship is the ancestor class common to all vulnerability assessment relationships. It factors out the common properties shared by them.
https://spdx.org/rdf/3/terms/Security/VulnAssessmentRelationship is abstract and must not be instantiated directly.
UseAction
The action of product use.
This is the specific action of product use. Relationship: For each UseAction there is at least one /Core/Relationship class or subclass with the relationshipType of 'performedBy’ on the from and a /Core/Agent class or subclass on the to. For each UseAction there is at least one /Core/Relationship class or subclass with the relationshipType of 'affects’ on the from and a /Core/Element class or subclass on the to.
https://spdx.org/rdf/3/terms/SupplyChain/UseAction is abstract and must not be instantiated directly.
LifecycleScopeType
Provide an enumerated set of lifecycle phases that can provide context to relationships.
Requirement
A distinct unit representing a requirement, as used in systems, software, and hardware engineering.
A requirement element is a distinct unit that defines an expectation, need, behavior, or design intent of an item that either already exists or is to be created in accordance with this requirement. A rationale is an additional detail used to define the reason or justification for the existence of the requirement. The rationale is usually less formal than the wording of the requirement statement itself.
ExternalIdentifier
A reference to a resource identifier defined outside the scope of SPDX 3 content that uniquely identifies an Element.
An ExternalIdentifier is a reference to a resource outside the scope of SPDX 3 content that provides a unique key within an established domain that can uniquely identify an Element.
Specification
A specification is a detailed description of the design, requirements, or features of a product, process, or system.
A specification (spec) is a detailed document that outlines the design, requirements, or features for a product, process, or system. Requirements, standards, specifications and processes can be referenced in this class.
DefinedProcess
Class that describes a process.
Processes are composed of systematic task(s) required to achieve a goal.
https://spdx.org/rdf/3/terms/Core/DefinedProcess is abstract and must not be instantiated directly.
Action
Class that describes an action that has occurred.
Action defines an event that has occurred. This is an Abstract Action. startTime is the time at which an action starts or triggered. endTime is the time at which an action stops or finishes.
https://spdx.org/rdf/3/terms/Core/Action is abstract and must not be instantiated directly.
Vulnerability
Specifies a vulnerability and its associated information.
Specifies a vulnerability and its associated information. *Example* { "type": "security_Vulnerability", "spdxId": "urn:spdx.dev:vuln-1", "summary": "Use of a Broken or Risky Cryptographic Algorithm", "description": "The package elliptic before version 6.5.4 are vulnerable to ...", "security_modifiedTime": "2021-03-08T16:06:43Z", "security_publishedTime": "2021-03-08T16:02:50Z", "externalIdentifier": [ { "type": "ExternalIdentifier", "externalIdentifierType": "cve", "identifier": "CVE-2020-28498", "identifierLocator": [ "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28498", "https://www.cve.org/CVERecord?id=CVE-2020-28498" ], "issuingAuthority": "urn:spdx.dev:agent-cve.org" }, { "type": "ExternalIdentifier", "externalIdentifierType": "securityOther", "identifier": "GHSA-r9p9-mrjm-926w", "identifierLocator": [ "https://github.com/advisories/GHSA-r9p9-mrjm-926w" ] }, { "type": "ExternalIdentifier", "externalIdentifierType": "securityOther", "identifier": "SNYK-JS-ELLIPTIC-1064899", "identifierLocator": [ "https://security.snyk.io/vuln/SNYK-JS-ELLIPTIC-1064899" ] } ], "externalRef": [ { "type": "ExternalRef", "externalRefType": "securityAdvisory", "locator": [ "https://nvd.nist.gov/vuln/detail/CVE-2020-28498" ] }, { "type": "ExternalRef", "externalRefType": "securityAdvisory", "locator": [ "https://ubuntu.com/security/CVE-2020-28498" ] }, { "type": "ExternalRef", "externalRefType": "securityOther", "locator": [ "https://github.com/indutny/elliptic/pull/244/commits" ] }, { "type": "ExternalRef", "externalRefType": "securityOther", "locator": [ "https://github.com/christianlundkvist/blog/2020_05_26_secp256k1_twist_attacks.md" ] } ] }, { "type": "Relationship", "spdxId": "urn:spdx.dev:vulnRelationship-1", "relationshipType": "hasAssociatedVulnerability", "from": "urn:npm-elliptic-6.5.2", "to": [ "urn:spdx.dev:vuln-1" ], "startTime": "2021-03-08T16:06:50Z" }, { "type": "Relationship", "spdxId": "urn:spdx.dev:vulnAgentRel-1", "relationshipType": "publishedBy", "from": "urn:spdx.dev:vuln-1", "to": [ "urn:spdx.dev:agent-snyk" ], "startTime": "2021-03-08T16:06:50Z" }
DatasetType
Enumeration of dataset types.
AnyLicenseInfo
Abstract class representing a license combination consisting of one or more licenses.
AnyLicenseInfo is an abstract class representing a license combination consisting of one or more licenses (optionally including additional text), which may be combined according to the SPDX license expression syntax. An AnyLicenseInfo is used by licensing properties of software artifacts. It can be: - a NoneLicense; - a NoAssertionLicense; - a single license (either on the SPDX License List <https://spdx.org/licenses/> or a custom-defined license); - a single license with an "or later" operator applied; - the foregoing with additional text applied; or - a set of licenses combined by applying "AND" and "OR" operators recursively.
https://spdx.org/rdf/3/terms/SimpleLicensing/AnyLicenseInfo is abstract and must not be instantiated directly.
LifecycleScopedRelationship
Provide context for a relationship that occurs in the lifecycle.
Certain relationships are sensitive to where they occur in the lifecycle. This parameter lets us avoid a proliferation of relationships, by parameterizing this context information for a relationship.
ProfileIdentifierType
Enumeration of valid profile identifiers.
Location
Location is used to define the location, address or coordinates of a place.
Location is used to define the location, address or coordinates of a place. Location data may include latitude and longitude (for geographical locations), IP addresses for network locations, MAC addresses for computer networks, or other identifiers that specify where something exists within a system. There is often a need to provide context about where each one is located in relation to other things around it (e.g., which city, country).
https://spdx.org/rdf/3/terms/Core/Location is abstract and must not be instantiated directly.
Artifact
A distinct article or unit within the domain.
An artifact is a distinct article or unit within the domain, such as an electronic file, a software package, a software service, a device or an element of data.
https://spdx.org/rdf/3/terms/Core/Artifact is abstract and must not be instantiated directly.
DictionaryEntry
A key with an associated value.
The class used for implementing a generic string mapping (also known as associative array, dictionary, or hash map) in SPDX. Each DictionaryEntry contains a key-value pair which maps the key to its associated value. To implement a dictionary, this class is to be used in a collection with unique keys.
HashAlgorithm
A mathematical algorithm that maps data of arbitrary size to a bit string.
References an Element on the right-hand side of a relationship.
This field references an Element on the right-hand side of a relationship. If it is not provided, it indicates that there are no known relationships of the given type.
from
References the Element on the left-hand side of a relationship.
This field references the Element on the left-hand side of a relationship.
SoftwarePurpose
Provides information about the primary purpose of an Element.
Element
Base domain class from which all other SPDX 3 domain classes derive.
An Element is a representation of a fundamental concept either directly inherent to the Bill of Materials (BOM) domain or indirectly related to the BOM domain and necessary for contextually characterizing BOM concepts and relationships. Within SPDX 3 structure this is the base class acting as a consistent, unifying, and interoperable foundation for all explicit and inter-relatable content objects.
Class is known to not derive from Extension and cannot be used
https://spdx.org/rdf/3/terms/Core/Element is abstract and must not be instantiated directly.
Agent
Agent represents anything with the potential to act on a system.
The Agent class represents anything that has the potential to act on a system. This could be a person, organization, software agent, etc. This is not to be confused with tools that are used to perform tasks.
relationshipType
Information about the relationship between two Elements.
This field provides information about the relationship between two Elements. For example, you can represent a relationship between two different Files, between a Package and a File, between two Packages, or between one SpdxDocument and another SpdxDocument.
ExternalIdentifierType
Specifies the type of an external identifier.
ExternalRefType
The type of external reference.
RelationshipType