INTERNATIONAL ISO/IEC 5962 STANDARD First edition 2021-08 Information technology - SPDX? Specification V2.2.1 Technologies de I'information - Specification SPDX? V2.2.1 Reference number IEC IS0/IEC 5962:2021(E) oS1 @IS0/IEC2021 IS0/IEC 5962:2021(E) COPYRIGHT PROTECTED DOCUMENT @IS0/IEC2021 All rights reserved. Unless otherwise specified, or required in the context of its implementation, no part of this publication may be reproduced or utilized otherwise in any form or by any means, electronic or mechanical, including photocopying, or posting on the internet or an intranet, without prior written permission. Permission can be requested from either Iso at the address below or ISO's member body in the country of the requester. ISO copyright office CP 40i : Ch. de Blandonnet 8 CH-1214 Vernier, Geneva Phone:+4122 749 0111 Email: [email protected] Website:www.iso.org Published in Switzerland ii @ IS0/IEC 2021 - All rights reserved IS0/IEC 5962:2021(E) Contents Foreword xiii Introduction xiii 1 Scope.. 2 Normative references.... 3 Terms and definitions... 2 4.1 SPDX Current and Previous Versions .... 4.2 Obsolete features... 4.3 Alternate notation for some conformance requirements.. 4.4 Standard data format requirements.... 4.5 Trademark Compliance. 4.6 The SPDX Lite profile... 5 Composition of an SPDX document . h 5.1 What this specification covers 5.2 Sections... 5.2.1 SPDX document creation information section... 5.2.2 Package information section..... 5.2.3 File information section... 5.2.4 Snippet information section .. .8 5.2.5 Other licensing information detected section.... 5.2.6 Relationships between SPDX elements information section.. 5.2.7 Annotations information section... 5.2.8 5.3 What this specification does not cover ... 10 5 SPDX document creation information section .... .10 . SPDX version field.... 10 6.1.1 Description... 10 6.1.2 Intent. .10 6.1.3 10 6.2 Data license field... 11 6.2.1 Description.. .11 6.2.2 Intent.... 11 6.2.3 Examples. 11 6.3 SPDX identifier field... 6.3.1 Description.... 12 6.3.2 Intent.. 12 6.3.3 Examples 6.4 Document name field... 12 6.4.1 Description.. 12 6.4.2 Intent.. 6.4.3 13 6.5 SPDX document namespace field..... 13 6.5.1 Description... 13 6.5.2 Intent...... 14 6.5.3 Examples.. 15 6.6 External document references field.. 15 6.6.1 Description.. 15 6.6.2 Intent.. 15 @ IS0/IEC 2021 - All rights reserved iii IS0/IEC 5962:2021(E) 6.6.3 Examples... ..16 .7 License list version field... 6.7.1 Description.... 6.7.2 Intent. .7 6.7.3 Examples..... 6.8 Creator field.. .7 6.8.1 Description .. 6.8.2 Intent.... 6.8.3 6.9 Created field .. 18 6.9.1 Description ... 6.9.2 Intent, 19 6.9.3 Examples. 19 6.10 Creator comment field..... 6.10.2 Intent . .20 6.10.3 Examples .20 6.11 Document comment field. 6.11.1 Description .... 6.11.2 Intent .. .11.3 Examples.... 7 Package information section.... 7.1.1 Description.. 7.1.2 Intent.. 7.1.3 7.2 Package SPDX identifier field... 7.2.1 Description.... .22 7.2.2 7.2.3 Examples.. 7.3 Package version field... ..23 7.3.1 Description..... 7.3.2 Intent .... 7.3.3 Examples ... 23 7.4 Package file name field..... 7.4.1 7.4.2 Intent. ..24 7.4.3 Examples ... 7.5.1 Description... .24 7.5.2 Intent. 7.5.3 7.6 Package originator field... ..25 7.6.1 Description.. ..25 7.6.2 Intent .... 7.6.3 Examples .. .26 7.7 Package download location field. 7.7.1 7.7.2 Intent. ..28 7.7.3 Examples, 7.8.1 Description... 32 7.8.2 Intent, 7.8.3 iv @ IS0/IEC 2021 - All rights reserved IS0/IEC 5962:2021(E) 7.9 Package verification code field.. 33 7.9.1 7.9.2 .34 7.9.3 Examples... .34 7.10 Package checksum field .... 7.10.1 Description.... .35 7.10.2 Intent... 35 7.10.3 Examples.. 7.11 7.11.1 Description... .36 7.11.2 Intent.. .37 7.11.3 Examples.. 7.12 Source information field ... 37 7.12.1 Description... .37 7.12.2 Intent... 7.12.3 Examples... 38 7.13 Concluded license field.. .38 .7.13..1 Description.... 7.13.2 Intent... 39 7.13.3 Examples.. .39 7.14 7.14.1 Description.... .40 7.14.2 Intent.. .40 7.