diff options
Diffstat (limited to 'examples/sample-docs/yaml/SPDXYAMLExample-2.2.spdx.yaml')
| -rw-r--r-- | examples/sample-docs/yaml/SPDXYAMLExample-2.2.spdx.yaml | 390 |
1 files changed, 390 insertions, 0 deletions
diff --git a/examples/sample-docs/yaml/SPDXYAMLExample-2.2.spdx.yaml b/examples/sample-docs/yaml/SPDXYAMLExample-2.2.spdx.yaml new file mode 100644 index 0000000..d58cf22 --- /dev/null +++ b/examples/sample-docs/yaml/SPDXYAMLExample-2.2.spdx.yaml @@ -0,0 +1,390 @@ +--- +SPDXID: "SPDXRef-DOCUMENT" +spdxVersion: "SPDX-2.2" +creationInfo: + comment: "This package has been shipped in source and binary form.\nThe binaries\ + \ were created with gcc 4.5.1 and expect to link to\ncompatible system run time\ + \ libraries." + created: "2010-01-29T18:30:22Z" + creators: + - "Tool: LicenseFind-1.0" + - "Organization: ExampleCodeInspect ()" + - "Person: Jane Doe ()" + licenseListVersion: "3.9" +name: "SPDX-Tools-v2.0" +dataLicense: "CC0-1.0" +comment: "This document was created using SPDX 2.0 using licenses from the web site." +externalDocumentRefs: +- externalDocumentId: "DocumentRef-spdx-tool-1.2" + checksum: + algorithm: "SHA1" + checksumValue: "d6a770ba38583ed4bb4525bd96e50461655d2759" + spdxDocument: "http://spdx.org/spdxdocs/spdx-tools-v1.2-3F2504E0-4F89-41D3-9A0C-0305E82C3301" +hasExtractedLicensingInfos: +- licenseId: "LicenseRef-1" + extractedText: "/*\n * (c) Copyright 2000, 2001, 2002, 2003, 2004, 2005, 2006, 2007,\ + \ 2008, 2009 Hewlett-Packard Development Company, LP\n * All rights reserved.\n\ + \ *\n * Redistribution and use in source and binary forms, with or without\n *\ + \ modification, are permitted provided that the following conditions\n * are met:\n\ + \ * 1. Redistributions of source code must retain the above copyright\n * notice,\ + \ this list of conditions and the following disclaimer.\n * 2. Redistributions\ + \ in binary form must reproduce the above copyright\n * notice, this list of\ + \ conditions and the following disclaimer in the\n * documentation and/or other\ + \ materials provided with the distribution.\n * 3. The name of the author may\ + \ not be used to endorse or promote products\n * derived from this software\ + \ without specific prior written permission.\n *\n * THIS SOFTWARE IS PROVIDED\ + \ BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR\n * IMPLIED WARRANTIES, INCLUDING,\ + \ BUT NOT LIMITED TO, THE IMPLIED WARRANTIES\n * OF MERCHANTABILITY AND FITNESS\ + \ FOR A PARTICULAR PURPOSE ARE DISCLAIMED.\n * IN NO EVENT SHALL THE AUTHOR BE\ + \ LIABLE FOR ANY DIRECT, INDIRECT,\n * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL\ + \ DAMAGES (INCLUDING, BUT\n * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS\ + \ OR SERVICES; LOSS OF USE,\n * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER\ + \ CAUSED AND ON ANY\n * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,\ + \ OR TORT\n * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE\ + \ USE OF\n * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n\ + */" +- licenseId: "LicenseRef-2" + extractedText: "This package includes the GRDDL parser developed by Hewlett Packard\ + \ under the following license:\n� Copyright 2007 Hewlett-Packard Development Company,\ + \ LP\n\nRedistribution and use in source and binary forms, with or without modification,\ + \ are permitted provided that the following conditions are met: \n\nRedistributions\ + \ of source code must retain the above copyright notice, this list of conditions\ + \ and the following disclaimer. \nRedistributions in binary form must reproduce\ + \ the above copyright notice, this list of conditions and the following disclaimer\ + \ in the documentation and/or other materials provided with the distribution.\ + \ \nThe name of the author may not be used to endorse or promote products derived\ + \ from this software without specific prior written permission. \nTHIS SOFTWARE\ + \ IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING,\ + \ BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR\ + \ A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE\ + \ FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\ + \ (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\ + \ LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND\ + \ ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING\ + \ NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE,\ + \ EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE." +- licenseId: "LicenseRef-4" + extractedText: "/*\n * (c) Copyright 2009 University of Bristol\n * All rights reserved.\n\ + \ *\n * Redistribution and use in source and binary forms, with or without\n *\ + \ modification, are permitted provided that the following conditions\n * are met:\n\ + \ * 1. Redistributions of source code must retain the above copyright\n * notice,\ + \ this list of conditions and the following disclaimer.\n * 2. Redistributions\ + \ in binary form must reproduce the above copyright\n * notice, this list of\ + \ conditions and the following disclaimer in the\n * documentation and/or other\ + \ materials provided with the distribution.\n * 3. The name of the author may\ + \ not be used to endorse or promote products\n * derived from this software\ + \ without specific prior written permission.\n *\n * THIS SOFTWARE IS PROVIDED\ + \ BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR\n * IMPLIED WARRANTIES, INCLUDING,\ + \ BUT NOT LIMITED TO, THE IMPLIED WARRANTIES\n * OF MERCHANTABILITY AND FITNESS\ + \ FOR A PARTICULAR PURPOSE ARE DISCLAIMED.\n * IN NO EVENT SHALL THE AUTHOR BE\ + \ LIABLE FOR ANY DIRECT, INDIRECT,\n * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL\ + \ DAMAGES (INCLUDING, BUT\n * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS\ + \ OR SERVICES; LOSS OF USE,\n * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER\ + \ CAUSED AND ON ANY\n * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,\ + \ OR TORT\n * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE\ + \ USE OF\n * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n\ + */" +- licenseId: "LicenseRef-Beerware-4.2" + comment: "The beerware license has a couple of other standard variants." + extractedText: "\"THE BEER-WARE LICENSE\" (Revision 42):\nphk@FreeBSD.ORG wrote\ + \ this file. As long as you retain this notice you\ncan do whatever you want with\ + \ this stuff. If we meet some day, and you think this stuff is worth it, you can\ + \ buy me a beer in return Poul-Henning Kamp" + name: "Beer-Ware License (Version 42)" + seeAlsos: + - "http://people.freebsd.org/~phk/" +- licenseId: "LicenseRef-3" + comment: "This is tye CyperNeko License" + extractedText: "The CyberNeko Software License, Version 1.0\n\n \n(C) Copyright\ + \ 2002-2005, Andy Clark. All rights reserved.\n \nRedistribution and use in source\ + \ and binary forms, with or without\nmodification, are permitted provided that\ + \ the following conditions\nare met:\n\n1. Redistributions of source code must\ + \ retain the above copyright\n notice, this list of conditions and the following\ + \ disclaimer. \n\n2. Redistributions in binary form must reproduce the above copyright\n\ + \ notice, this list of conditions and the following disclaimer in\n the documentation\ + \ and/or other materials provided with the\n distribution.\n\n3. The end-user\ + \ documentation included with the redistribution,\n if any, must include the\ + \ following acknowledgment: \n \"This product includes software developed\ + \ by Andy Clark.\"\n Alternately, this acknowledgment may appear in the software\ + \ itself,\n if and wherever such third-party acknowledgments normally appear.\n\ + \n4. The names \"CyberNeko\" and \"NekoHTML\" must not be used to endorse\n \ + \ or promote products derived from this software without prior \n written permission.\ + \ For written permission, please contact \n andyc@cyberneko.net.\n\n5. Products\ + \ derived from this software may not be called \"CyberNeko\",\n nor may \"CyberNeko\"\ + \ appear in their name, without prior written\n permission of the author.\n\n\ + THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESSED OR IMPLIED\nWARRANTIES,\ + \ INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES\nOF MERCHANTABILITY AND\ + \ FITNESS FOR A PARTICULAR PURPOSE ARE\nDISCLAIMED. IN NO EVENT SHALL THE AUTHOR\ + \ OR OTHER CONTRIBUTORS\nBE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,\ + \ EXEMPLARY, \nOR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT\ + \ \nOF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR \nBUSINESS\ + \ INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, \nWHETHER IN CONTRACT,\ + \ STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE \nOR OTHERWISE) ARISING IN ANY\ + \ WAY OUT OF THE USE OF THIS SOFTWARE, \nEVEN IF ADVISED OF THE POSSIBILITY OF\ + \ SUCH DAMAGE." + name: "CyberNeko License" + seeAlsos: + - "http://people.apache.org/~andyc/neko/LICENSE" + - "http://justasample.url.com" +annotations: +- annotationDate: "2010-01-29T18:30:22Z" + annotationType: "OTHER" + annotator: "Person: Jane Doe ()" + comment: "Document level annotation" +- annotationDate: "2010-02-10T00:00:00Z" + annotationType: "REVIEW" + annotator: "Person: Joe Reviewer" + comment: "This is just an example. Some of the non-standard licenses look like\ + \ they are actually BSD 3 clause licenses" +- annotationDate: "2011-03-13T00:00:00Z" + annotationType: "REVIEW" + annotator: "Person: Suzanne Reviewer" + comment: "Another example reviewer." +documentNamespace: "http://spdx.org/spdxdocs/spdx-example-444504E0-4F89-41D3-9A0C-0305E82C3301" +documentDescribes: +- "SPDXRef-File" +- "SPDXRef-Package" +packages: +- SPDXID: "SPDXRef-Package" + annotations: + - annotationDate: "2011-01-29T18:30:22Z" + annotationType: "OTHER" + annotator: "Person: Package Commenter" + comment: "Package level annotation" + attributionTexts: + - "The GNU C Library is free software. See the file COPYING.LIB for copying conditions,\ + \ and LICENSES for notices about a few contributions that require these additional\ + \ notices to be distributed. License copyright years may be listed using range\ + \ notation, e.g., 1996-2015, indicating that every year in the range, inclusive,\ + \ is a copyrightable year that would otherwise be listed individually." + checksums: + - algorithm: "MD5" + checksumValue: "624c1abb3664f4b35547e7c73864ad24" + - algorithm: "SHA1" + checksumValue: "85ed0817af83a24ad8da68c2b5094de69833983c" + - algorithm: "SHA256" + checksumValue: "11b6d3ee554eedf79299905a98f9b9a04e498210b59f15094c916c91d150efcd" + copyrightText: "Copyright 2008-2010 John Smith" + description: "The GNU C Library defines functions that are specified by the ISO\ + \ C standard, as well as additional features specific to POSIX and other derivatives\ + \ of the Unix operating system, and extensions specific to GNU systems." + downloadLocation: "http://ftp.gnu.org/gnu/glibc/glibc-ports-2.15.tar.gz" + externalRefs: + - referenceCategory: "SECURITY" + referenceLocator: "cpe:2.3:a:pivotal_software:spring_framework:4.1.0:*:*:*:*:*:*:*" + referenceType: "cpe23Type" + - comment: "This is the external ref for Acme" + referenceCategory: "OTHER" + referenceLocator: "acmecorp/acmenator/4.1.3-alpha" + referenceType: "http://spdx.org/spdxdocs/spdx-example-444504E0-4F89-41D3-9A0C-0305E82C3301#LocationRef-acmeforge" + filesAnalyzed: true + hasFiles: + - "SPDXRef-CommonsLangSrc" + - "SPDXRef-JenaLib" + - "SPDXRef-DoapSource" + homepage: "http://ftp.gnu.org/gnu/glibc" + licenseComments: "The license for this project changed with the release of version\ + \ x.y. The version of the project included here post-dates the license change." + licenseConcluded: "(LGPL-2.0-only OR LicenseRef-3)" + licenseDeclared: "(LGPL-2.0-only AND LicenseRef-3)" + licenseInfoFromFiles: + - "GPL-2.0-only" + - "LicenseRef-2" + - "LicenseRef-1" + name: "glibc" + originator: "Organization: ExampleCodeInspect (contact@example.com)" + packageFileName: "glibc-2.11.1.tar.gz" + packageVerificationCode: + packageVerificationCodeExcludedFiles: + - "./package.spdx" + packageVerificationCodeValue: "d6a770ba38583ed4bb4525bd96e50461655d2758" + sourceInfo: "uses glibc-2_11-branch from git://sourceware.org/git/glibc.git." + summary: "GNU C library." + supplier: "Person: Jane Doe (jane.doe@example.com)" + versionInfo: "2.11.1" +- SPDXID: "SPDXRef-fromDoap-1" + copyrightText: "NOASSERTION" + downloadLocation: "NOASSERTION" + filesAnalyzed: false + homepage: "http://commons.apache.org/proper/commons-lang/" + licenseConcluded: "NOASSERTION" + licenseDeclared: "NOASSERTION" + name: "Apache Commons Lang" +- SPDXID: "SPDXRef-fromDoap-0" + copyrightText: "NOASSERTION" + downloadLocation: "https://search.maven.org/remotecontent?filepath=org/apache/jena/apache-jena/3.12.0/apache-jena-3.12.0.tar.gz" + externalRefs: + - referenceCategory: "PACKAGE_MANAGER" + referenceLocator: "pkg:maven/org.apache.jena/apache-jena@3.12.0" + referenceType: "purl" + filesAnalyzed: false + homepage: "http://www.openjena.org/" + licenseConcluded: "NOASSERTION" + licenseDeclared: "NOASSERTION" + name: "Jena" + versionInfo: "3.12.0" +- SPDXID: "SPDXRef-Saxon" + checksums: + - algorithm: "SHA1" + checksumValue: "85ed0817af83a24ad8da68c2b5094de69833983c" + copyrightText: "Copyright Saxonica Ltd" + description: "The Saxon package is a collection of tools for processing XML documents." + downloadLocation: "https://sourceforge.net/projects/saxon/files/Saxon-B/8.8.0.7/saxonb8-8-0-7j.zip/download" + filesAnalyzed: false + homepage: "http://saxon.sourceforge.net/" + licenseComments: "Other versions available for a commercial license" + licenseConcluded: "MPL-1.0" + licenseDeclared: "MPL-1.0" + name: "Saxon" + packageFileName: "saxonB-8.8.zip" + versionInfo: "8.8" +files: +- SPDXID: "SPDXRef-DoapSource" + checksums: + - algorithm: "SHA1" + checksumValue: "2fd4e1c67a2d28fced849ee1bb76e7391b93eb12" + copyrightText: "Copyright 2010, 2011 Source Auditor Inc." + fileContributors: + - "Protecode Inc." + - "SPDX Technical Team Members" + - "Open Logic Inc." + - "Source Auditor Inc." + - "Black Duck Software In.c" + fileName: "./src/org/spdx/parser/DOAPProject.java" + fileTypes: + - "SOURCE" + licenseConcluded: "Apache-2.0" + licenseInfoInFiles: + - "Apache-2.0" +- SPDXID: "SPDXRef-CommonsLangSrc" + checksums: + - algorithm: "SHA1" + checksumValue: "c2b4e1c67a2d28fced849ee1bb76e7391b93f125" + comment: "This file is used by Jena" + copyrightText: "Copyright 2001-2011 The Apache Software Foundation" + fileContributors: + - "Apache Software Foundation" + fileName: "./lib-source/commons-lang3-3.1-sources.jar" + fileTypes: + - "ARCHIVE" + licenseConcluded: "Apache-2.0" + licenseInfoInFiles: + - "Apache-2.0" + noticeText: "Apache Commons Lang\nCopyright 2001-2011 The Apache Software Foundation\n\ + \nThis product includes software developed by\nThe Apache Software Foundation\ + \ (http://www.apache.org/).\n\nThis product includes software from the Spring\ + \ Framework,\nunder the Apache License 2.0 (see: StringUtils.containsWhitespace())" +- SPDXID: "SPDXRef-JenaLib" + checksums: + - algorithm: "SHA1" + checksumValue: "3ab4e1c67a2d28fced849ee1bb76e7391b93f125" + comment: "This file belongs to Jena" + copyrightText: "(c) Copyright 2000, 2001, 2002, 2003, 2004, 2005, 2006, 2007, 2008,\ + \ 2009 Hewlett-Packard Development Company, LP" + fileContributors: + - "Apache Software Foundation" + - "Hewlett Packard Inc." + fileName: "./lib-source/jena-2.6.3-sources.jar" + fileTypes: + - "ARCHIVE" + licenseComments: "This license is used by Jena" + licenseConcluded: "LicenseRef-1" + licenseInfoInFiles: + - "LicenseRef-1" +- SPDXID: "SPDXRef-File" + annotations: + - annotationDate: "2011-01-29T18:30:22Z" + annotationType: "OTHER" + annotator: "Person: File Commenter" + comment: "File level annotation" + checksums: + - algorithm: "SHA1" + checksumValue: "d6a770ba38583ed4bb4525bd96e50461655d2758" + - algorithm: "MD5" + checksumValue: "624c1abb3664f4b35547e7c73864ad24" + comment: "The concluded license was taken from the package level that the file was\ + \ included in.\nThis information was found in the COPYING.txt file in the xyz\ + \ directory." + copyrightText: "Copyright 2008-2010 John Smith" + fileContributors: + - "The Regents of the University of California" + - "Modified by Paul Mundt lethal@linux-sh.org" + - "IBM Corporation" + fileName: "./package/foo.c" + fileTypes: + - "SOURCE" + licenseComments: "The concluded license was taken from the package level that the\ + \ file was included in." + licenseConcluded: "(LGPL-2.0-only OR LicenseRef-2)" + licenseInfoInFiles: + - "GPL-2.0-only" + - "LicenseRef-2" + noticeText: "Copyright (c) 2001 Aaron Lehmann aaroni@vitelus.com\n\nPermission is\ + \ hereby granted, free of charge, to any person obtaining a copy of this software\ + \ and associated documentation files (the �Software�), to deal in the Software\ + \ without restriction, including without limitation the rights to use, copy, modify,\ + \ merge, publish, distribute, sublicense, and/or sell copies of the Software,\ + \ and to permit persons to whom the Software is furnished to do so, subject to\ + \ the following conditions: \nThe above copyright notice and this permission notice\ + \ shall be included in all copies or substantial portions of the Software.\n\n\ + THE SOFTWARE IS PROVIDED �AS IS', WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED,\ + \ INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR\ + \ A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR\ + \ COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER\ + \ IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION\ + \ WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE." +snippets: +- SPDXID: "SPDXRef-Snippet" + comment: "This snippet was identified as significant and highlighted in this Apache-2.0\ + \ file, when a commercial scanner identified it as being derived from file foo.c\ + \ in package xyz which is licensed under GPL-2.0." + copyrightText: "Copyright 2008-2010 John Smith" + licenseComments: "The concluded license was taken from package xyz, from which the\ + \ snippet was copied into the current file. The concluded license information\ + \ was found in the COPYING.txt file in package xyz." + licenseConcluded: "GPL-2.0-only" + licenseInfoInSnippets: + - "GPL-2.0-only" + name: "from linux kernel" + ranges: + - endPointer: + offset: 420 + reference: "SPDXRef-DoapSource" + startPointer: + offset: 310 + reference: "SPDXRef-DoapSource" + - endPointer: + lineNumber: 23 + reference: "SPDXRef-DoapSource" + startPointer: + lineNumber: 5 + reference: "SPDXRef-DoapSource" + snippetFromFile: "SPDXRef-DoapSource" +relationships: +- spdxElementId: "SPDXRef-DOCUMENT" + relatedSpdxElement: "SPDXRef-Package" + relationshipType: "CONTAINS" +- spdxElementId: "SPDXRef-DOCUMENT" + relatedSpdxElement: "DocumentRef-spdx-tool-1.2:SPDXRef-ToolsElement" + relationshipType: "COPY_OF" +- spdxElementId: "SPDXRef-DOCUMENT" + relatedSpdxElement: "SPDXRef-File" + relationshipType: "DESCRIBES" +- spdxElementId: "SPDXRef-DOCUMENT" + relatedSpdxElement: "SPDXRef-Package" + relationshipType: "DESCRIBES" +- spdxElementId: "SPDXRef-Package" + relatedSpdxElement: "SPDXRef-JenaLib" + relationshipType: "CONTAINS" +- spdxElementId: "SPDXRef-Package" + relatedSpdxElement: "SPDXRef-Saxon" + relationshipType: "DYNAMIC_LINK" +- spdxElementId: "SPDXRef-CommonsLangSrc" + relatedSpdxElement: "NOASSERTION" + relationshipType: "GENERATED_FROM" +- spdxElementId: "SPDXRef-JenaLib" + relatedSpdxElement: "SPDXRef-Package" + relationshipType: "CONTAINS" +- spdxElementId: "SPDXRef-File" + relatedSpdxElement: "SPDXRef-fromDoap-0" + relationshipType: "GENERATED_FROM" |