forked from spdx/tools-python
-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy pathSPDXYamlExample.yaml
More file actions
221 lines (221 loc) · 12.5 KB
/
Copy pathSPDXYamlExample.yaml
File metadata and controls
221 lines (221 loc) · 12.5 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
---
Document:
annotations:
- annotationDate: '2012-06-13T00:00:00Z'
annotationType: REVIEW
annotator: 'Person: Jim Reviewer'
comment: This is just an example. Some of the non-standard licenses look like
they are actually BSD 3 clause licenses
id: SPDXRef-45
comment: This is a sample spreadsheet
creationInfo:
comment: This is an example of an SPDX spreadsheet format
created: '2010-02-03T00:00:00Z'
creators:
- 'Tool: SourceAuditor-V1.2'
- 'Organization: Source Auditor Inc.'
- 'Person: Gary O''Neall'
licenseListVersion: '3.6'
dataLicense: CC0-1.0
documentDescribes:
- Package:
id: SPDXRef-Package
checksums:
- algorithm: checksumAlgorithm_sha1
value: 2fd4e1c67a2d28fced849ee1bb76e7391b93eb12
copyrightText: ' Copyright 2010, 2011 Source Auditor Inc.'
description: This utility translates and SPDX RDF XML document to a spreadsheet,
translates a spreadsheet to an SPDX RDF XML document and translates an SPDX
RDFa document to an SPDX RDF XML document.
downloadLocation: http://www.spdx.org/tools
files:
- File:
checksums:
- algorithm: checksumAlgorithm_sha1
value: 3ab4e1c67a2d28fced849ee1bb76e7391b93f125
comment: This file belongs to Jena
copyrightText: (c) Copyright 2000, 2001, 2002, 2003, 2004, 2005, 2006, 2007,
2008, 2009 Hewlett-Packard Development Company, LP
artifactOf:
- name: "Jena"
homePage: "http://www.openjena.org/"
projectUri: "http://subversion.apache.org/doap.rdf"
fileTypes:
- fileType_archive
id: SPDXRef-File1
licenseComments: This license is used by Jena
licenseConcluded: LicenseRef-1
licenseInfoFromFiles:
- LicenseRef-1
name: Jenna-2.6.3/jena-2.6.3-sources.jar
sha1: 3ab4e1c67a2d28fced849ee1bb76e7391b93f125
- File:
checksums:
- algorithm: checksumAlgorithm_sha1
value: 2fd4e1c67a2d28fced849ee1bb76e7391b93eb12
copyrightText: Copyright 2010, 2011 Source Auditor Inc.
fileTypes:
- fileType_source
id: SPDXRef-File2
licenseConcluded: Apache-2.0
licenseInfoFromFiles:
- Apache-2.0
name: src/org/spdx/parser/DOAPProject.java
sha1: 2fd4e1c67a2d28fced849ee1bb76e7391b93eb12
licenseComments: The declared license information can be found in the NOTICE
file at the root of the archive file
licenseConcluded: (LicenseRef-3 AND LicenseRef-1 AND MPL-1.1 AND Apache-2.0
AND LicenseRef-2 AND Apache-1.0 AND LicenseRef-4)
licenseDeclared: (MPL-1.1 AND LicenseRef-4 AND LicenseRef-2 AND LicenseRef-1
AND Apache-2.0 AND LicenseRef-3)
licenseInfoFromFiles:
- Apache-2.0
- MPL-1.1
- LicenseRef-3
- LicenseRef-1
- LicenseRef-4
- Apache-1.0
- LicenseRef-2
name: SPDX Translator
originator: 'Organization: SPDX'
packageFileName: spdxtranslator-1.0.zip
packageVerificationCode:
excludedFilesNames:
- SpdxTranslatorSpdx.txt
- SpdxTranslatorSpdx.rdf
value: 4e3211c67a2d28fced849ee1bb76e7391b93feba
sha1: 2fd4e1c67a2d28fced849ee1bb76e7391b93eb12
sourceInfo: Version 1.0 of the SPDX Translator application
summary: SPDX Translator utility
supplier: 'Organization: Linux Foundation'
versionInfo: Version 0.9.2
externalDocumentRefs:
- checksum:
algorithm: checksumAlgorithm_sha1
value: d6a770ba38583ed4bb4525bd96e50461655d2759
externalDocumentId: DocumentRef-spdx-tool-2.1
spdxDocumentNamespace: https://spdx.org/spdxdocs/spdx-tools-v2.1-3F2504E0-4F89-41D3-9A0C-0305E82C3301
extractedLicenseInfos:
- comment: This is tye CyperNeko License
extractedText: "The CyberNeko Software License, Version 1.0\n\n \n(C) Copyright\
\ 2002-2005, Andy Clark. All rights reserved.\n \nRedistribution and use in\
\ source and binary forms, with or without\nmodification, are permitted provided\
\ that the following conditions\nare met:\n\n1. Redistributions of source code\
\ must retain the above copyright\n notice, this list of conditions and the\
\ following disclaimer. \n\n2. Redistributions in binary form must reproduce\
\ the above copyright\n notice, this list of conditions and the following\
\ disclaimer in\n the documentation and/or other materials provided with the\n\
\ distribution.\n\n3. The end-user documentation included with the redistribution,\n\
\ if any, must include the following acknowledgment: \n \"This product\
\ includes software developed by Andy Clark.\"\n Alternately, this acknowledgment\
\ may appear in the software itself,\n if and wherever such third-party acknowledgments\
\ normally appear.\n\n4. The names \"CyberNeko\" and \"NekoHTML\" must not be\
\ used to endorse\n or promote products derived from this software without\
\ prior \n written permission. For written permission, please contact \n \
\ andyc@cyberneko.net.\n\n5. Products derived from this software may not be\
\ called \"CyberNeko\",\n nor may \"CyberNeko\" appear in their name, without\
\ prior written\n permission of the author.\n\nTHIS SOFTWARE IS PROVIDED ``AS\
\ IS'' AND ANY EXPRESSED OR IMPLIED\nWARRANTIES, INCLUDING, BUT NOT LIMITED\
\ TO, THE IMPLIED WARRANTIES\nOF MERCHANTABILITY AND FITNESS FOR A PARTICULAR\
\ PURPOSE ARE\nDISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR OTHER CONTRIBUTORS\n\
BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, \nOR CONSEQUENTIAL\
\ DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT \nOF SUBSTITUTE GOODS\
\ OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR \nBUSINESS INTERRUPTION) HOWEVER\
\ CAUSED AND ON ANY THEORY OF LIABILITY, \nWHETHER IN CONTRACT, STRICT LIABILITY,\
\ OR TORT (INCLUDING NEGLIGENCE \nOR OTHERWISE) ARISING IN ANY WAY OUT OF THE\
\ USE OF THIS SOFTWARE, \nEVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."
licenseId: LicenseRef-3
name: CyberNeko License
seeAlso:
- http://justasample.url.com
- http://people.apache.org/~andyc/neko/LICENSE
- extractedText: "/*\n * (c) Copyright 2000, 2001, 2002, 2003, 2004, 2005, 2006,\
\ 2007, 2008, 2009 Hewlett-Packard Development Company, LP\n * All rights reserved.\n\
\ *\n * Redistribution and use in source and binary forms, with or without\n\
\ * modification, are permitted provided that the following conditions\n * are\
\ met:\n * 1. Redistributions of source code must retain the above copyright\n\
\ * notice, this list of conditions and the following disclaimer.\n * 2.\
\ Redistributions in binary form must reproduce the above copyright\n * notice,\
\ this list of conditions and the following disclaimer in the\n * documentation\
\ and/or other materials provided with the distribution.\n * 3. The name of\
\ the author may not be used to endorse or promote products\n * derived from\
\ this software without specific prior written permission.\n *\n * THIS SOFTWARE\
\ IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR\n * IMPLIED WARRANTIES,\
\ INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES\n * OF MERCHANTABILITY\
\ AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.\n * IN NO EVENT SHALL\
\ THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,\n * INCIDENTAL, SPECIAL, EXEMPLARY,\
\ OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT\n * NOT LIMITED TO, PROCUREMENT OF\
\ SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,\n * DATA, OR PROFITS; OR BUSINESS\
\ INTERRUPTION) HOWEVER CAUSED AND ON ANY\n * THEORY OF LIABILITY, WHETHER IN\
\ CONTRACT, STRICT LIABILITY, OR TORT\n * (INCLUDING NEGLIGENCE OR OTHERWISE)\
\ ARISING IN ANY WAY OUT OF THE USE OF\n * THIS SOFTWARE, EVEN IF ADVISED OF\
\ THE POSSIBILITY OF SUCH DAMAGE.\n */"
licenseId: LicenseRef-1
- extractedText: "This package includes the GRDDL parser developed by Hewlett Packard\
\ under the following license:\n\xA9 Copyright 2007 Hewlett-Packard Development\
\ Company, LP\n\nRedistribution and use in source and binary forms, with or\
\ without modification, are permitted provided that the following conditions\
\ are met: \n\nRedistributions of source code must retain the above copyright\
\ notice, this list of conditions and the following disclaimer. \nRedistributions\
\ in binary form must reproduce the above copyright notice, this list of conditions\
\ and the following disclaimer in the documentation and/or other materials provided\
\ with the distribution. \nThe name of the author may not be used to endorse\
\ or promote products derived from this software without specific prior written\
\ permission. \nTHIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS\
\ OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES\
\ OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN\
\ NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,\
\ SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,\
\ PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS;\
\ OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER\
\ IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)\
\ ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE\
\ POSSIBILITY OF SUCH DAMAGE. "
licenseId: LicenseRef-2
- extractedText: "/*\n * (c) Copyright 2009 University of Bristol\n * All rights\
\ reserved.\n *\n * Redistribution and use in source and binary forms, with\
\ or without\n * modification, are permitted provided that the following conditions\n\
\ * are met:\n * 1. Redistributions of source code must retain the above copyright\n\
\ * notice, this list of conditions and the following disclaimer.\n * 2.\
\ Redistributions in binary form must reproduce the above copyright\n * notice,\
\ this list of conditions and the following disclaimer in the\n * documentation\
\ and/or other materials provided with the distribution.\n * 3. The name of\
\ the author may not be used to endorse or promote products\n * derived from\
\ this software without specific prior written permission.\n *\n * THIS SOFTWARE\
\ IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR\n * IMPLIED WARRANTIES,\
\ INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES\n * OF MERCHANTABILITY\
\ AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.\n * IN NO EVENT SHALL\
\ THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,\n * INCIDENTAL, SPECIAL, EXEMPLARY,\
\ OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT\n * NOT LIMITED TO, PROCUREMENT OF\
\ SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,\n * DATA, OR PROFITS; OR BUSINESS\
\ INTERRUPTION) HOWEVER CAUSED AND ON ANY\n * THEORY OF LIABILITY, WHETHER IN\
\ CONTRACT, STRICT LIABILITY, OR TORT\n * (INCLUDING NEGLIGENCE OR OTHERWISE)\
\ ARISING IN ANY WAY OUT OF THE USE OF\n * THIS SOFTWARE, EVEN IF ADVISED OF\
\ THE POSSIBILITY OF SUCH DAMAGE.\n */ "
licenseId: LicenseRef-4
id: SPDXRef-DOCUMENT
name: Sample_Document-V2.1
namespace: https://spdx.org/spdxdocs/spdx-example-444504E0-4F89-41D3-9A0C-0305E82C3301
reviewers:
- comment: Another example reviewer.
reviewDate: '2011-03-13T00:00:00Z'
reviewer: 'Person: Suzanne Reviewer'
- comment: This is just an example. Some of the non-standard licenses look like
they are actually BSD 3 clause licenses
reviewDate: '2010-02-10T00:00:00Z'
reviewer: 'Person: Joe Reviewer'
snippets:
- comment: This snippet was identified as significant and highlighted in this Apache-2.0
file, when a commercial scanner identified it as being derived from file foo.c
in package xyz which is licensed under GPL-2.0-or-later.
copyrightText: Copyright 2008-2010 John Smith
fileId: SPDXRef-DoapSource
id: SPDXRef-Snippet
licenseComments: The concluded license was taken from package xyz, from which
the snippet was copied into the current file. The concluded license information
was found in the COPYING.txt file in package xyz.
licenseConcluded: Apache-2.0
licenseInfoFromSnippet:
- Apache-2.0
name: from linux kernel
specVersion: SPDX-2.1