spdx-spec
spdx-spec copied to clipboard
Add licenseDeclaredText for creator to communicate raw declared license findings
This issue proposes to add optional licenseDeclaredText field to allow exchanging declared license stings as found in package manifest (pom.xml, package.json).
Motivation:
- Enables package manager to communicate declared license information without having to having to deal with creation of SPDX expression thereby reducing the adoption hurdle of SPDX 3.0. Package managers can then export SODX with raw/unprocessed license findings and other tools can then process these to valid expressions. Better solution than receiving a "NOASSERTION" and for compliance tools to having to process package manifest data from package manager
- Having the raw data available allows for verification of license mappings (non-SPDX to SPDX)
SPDXID: "SPDXRef-DOCUMENT"
spdxVersion: "SPDX-2.2"
creationInfo:
created: "2020-07-23T18:30:22Z"
creators:
- "Organization: Example OSS project"
- "Person: Thomas Steenbergen"
licenseListVersion: "3.9"
name: "xyz-0.1.0"
dataLicense: "CC0-1.0"
documentNamespace: "http://spdx.org/spdxdocs/spdx-document-xyz"
documentDescribes:
- "SPDXRef-Package-xyz"
packages:
- SPDXID: "SPDXRef-Package-xyz"
comment: "Awesome xyz OSS project created by Example Inc."
downloadLocation: "git+ssh://gitlab.example.com:3389/projects/xyz.git@b2c358080011af6a366d2512a25a379fbe7b1f78"
filesAnalyzed: false
homepage: "https://example.com/products/xyz"
licenseConcluded: "NOASSERTION"
licenseDeclared: "NOASSERTION"
licenseDeclaredText:
- "OGC Copyright"
- "XYZ proprietary license"
- "The Apache Software License"
name: "xyz"
PackageFileName: "pom.xml"
versionInfo: "0.1.0"
Since this is a non-breaking addition, moving this to the 3.1 milestone