SPDX 2.0 includes several new features such as the ability to describe relationships between packages, files, and external SPDX documents. It also allows annotations on any element, supports additional file types and checksum algorithms, and introduces a new license expression syntax. While most fields from SPDX 1.2 remain the same, some sections such as Review Information were replaced with new sections like Annotations.

1. 1Copyright Linux Foundation 2015 (CC-BY-3.0)
SPDX 2.0
summary of the changes

2. 2
SPDX® 2.0 - what’s new?
▪ Multiple packages can now be described in a single SPDX document.
▪ Relationships between packages, files, and external SPDX documents,
can now be described.
▪ Annotations can be provided on any specific element in an SPDX
document.
▪ Additional file types & checksum algorithms are now supported.
▪ Download location information has been expanded.
▪ A new license expression syntax has been introduced with improved
license matching guidelines.
▪ License exceptions are separate section in license list.

3. 3
SPDX® 2.0 - what’s changed from 1.2?
▪ Review Information section replaced by Annotations.
▪ now able to provide specific information on file, package
or document level.
▪ Document and Creation Information sections merged into a
single section.
▪ all fields from 1.2 remain, just regrouped, and some
additional ones added.

4. 4
SPDX® 2.0 - what’s the same as 1.2?
▪ Most of it!
▪ Approx 90% of the fields are basically the same as in 1.2 (42/46).
▪ The 4 deprecated fields have been replaced with more generalized support.
▪ Still can refer to licenses not on SPDX License List
▪ more licenses added to SPDX License List (from Fedora “good” list).
▪ Same basic file formats supported
▪ Tag:Value
▪ RDF/XML
▪ translation to spreadsheets

5. 5
Package Information
The SPDX Document
SPDX v1.2 File SPDX v2.0 File
Creation Information
Package Information
Other Licensing Information
Other Licensing Information
Other Licensing Information
File Information
Other Licensing Information
Review Information
Document Creation Information
Package Information
Other Licensing InformationOther Licensing Information
Other Licensing InformationFile Information
Other Licensing Information
Annotations
Other Licensing InformationRelationships

6. 6
Document and Creation Information
▪ SPDX Version (used in creation of SPDX file)
▪ Licensing of meta data
▪ SPDX Identifier for the document itself
▪ Name of this Document
▪ SPDX Document Namespace (URI)
▪ External SPDX Doc References
▪ License List Version
▪ Creator (how was the file created)
▪ Manual review (who, when)
▪ Tool (id, version, when)
▪ When was it created
▪ Comments on creator and document itself

7. 7
Package Information
▪ Identification
▪ Formal Name of Package (Full name given by originator and version information)
▪ SPDX Identifier (unique ID for referencing from elsewhere)
▪ Package File Name (Name package obtained under (.tar, .rpm, etc.))
▪ Package Supplier and Originator
▪ Package Download Location (download URL and repository information )
▪ Package Verification Code and Checksum (SHA1, MD5, SHA256)
▪ Package Homepage and Source Information
▪ Licensing for Package
▪ Declared License- License(s) that has/have been asserted for the package
▪ Concluded License- License that Creator has concluded
▪ List of file licenses
▪ Comments Field (for example, to explain conclusion)
▪ Copyright Text
▪ Description of Package (summary and detailed options) and comments about the package

8. 8
File Information
▪ Identification
▪ File Name
▪ SPDX Identifier (for referencing from elsewhere)
▪ File Type (source, binary, archive,application,audio,image,text,video,documentation,spdx)
▪ Artifact of Project Name, Homepage & URI (project it came from)
▪ File Checksum (SHA1, MD5, SHA256)
▪ Licensing for File
▪ Concluded License (license determined by SPDX file creator)
▪ License Information in File
▪ Comments on License
▪ Copyright Text
▪ File Notices
▪ File Contributor
▪ File Dependencies
▪ File Comments

9. 9
Other Licensing Information
Provides a way to identify licenses not on the SPDX License List
▪ Identifier Assigned (unique short form to this document)
▪ Extracted Text
▪ Name of License
▪ Cross References
▪ Comments

10. 10
Relationships
▪ Each SPDX Document has a
unique identifier
▪ Elements within a document
have an identifier unique to
the SPDX document (e.g.
Document itself, Package,
File & License)
▪ Elements in external
documents are referenced
using the external document
ID followed by the local
unique reference.
SPDX Document A
….
SPDXRef-DOCUMENT…
…
File Name: ./abc/def
SPDXID: SPDXRef-201
…
SPDX Document B
….
ExternalDocumentRef: DocumentRef-A …
…
...
... DocumentRef-A:SPDXRef-DOCUMENT…
...
… DocumentRef-A:SPDXRef-201...
…

11. 11
Review Information
▪ Reviewer
▪ Review Date
▪ Review Comment
REPLACED
BY Annotations

12. 12
Annotations
▪ Annotation allows for comments on any SPDX file, package
or document.
▪ Annotations can provide a changelog for any changes made
to that file, package, or document (as appropriate).
▪ Annotations contain:
▪ annotator (the person, company, or tool which provided the annotation)
▪ date the annotation made
▪ type of annotation (review or other)
▪ SPDX identifier reference (element the annotation refers to)
▪ comments

13. 13
Matching Guidelines and templates
▪ License Matching Guidelines
▪ For matching licenses and license exceptions against those included on the
SPDX License List
▪ http://spdx.org/spdx-license-list/matching-guidelines
▪ License templates
▪ Denotes text which is omittable or replaceable per the license matching
guidelines
▪ Markup included in .txt files http://git.spdx.org/?p=license-list.git;a=summary
and (will be) illustrated via colored text on spdx.org/licenses HTML pages

14. 14
License Expression Syntax
▪ Enabling more complex licensing scenarios using operators:
+ WITH AND OR
▪ Licenses with “or later” option: were listed as separate licenses; now can
use + operator
▪ License exceptions: were listed as separate licenses; now on a separate
list, enabling more combinations using WITH operator
▪ As a result, some licenses were deprecated (will be denoted on SPDX
License List and maintained for compatibility purposes)
▪ AND for conjunctive license sets; OR for disjunctive license sets
▪ Can be used with ( ) to create more complex expressions
▪ License Expression Syntax is located in Appendix to spec

15. 15
SPDX® 2.0 - Model Overview
▪ Result of merging two model proposal
▪ Designed to support all of the proposed use cases for 2.0
(and then some)
▪ Contains several new “abstractions” to allow for future
extensions
▪ Available in the spec and at http://wiki.spdx.
org/view/Technical_Team/Model_2_0

16. 16
RDF Overview
▪ What?
▪ Resource Description Framework - standard for
encoding data for the Semantic Web
▪ Why?
▪ Precise
▪ Widely adopted
▪ Web based standard
▪ Support for “reasoning”

17. 17
SPDX 2.0 RDF Changes
▪ Additional classes and properties to match the SPDX
2.0 model
▪ Use of the SPDX document namespace to uniquely
identify all SPDX elements in the document
▪ All documents will have a unique URI for a
namespace
▪ All elements will have a URI with the namespace +
#ElmentID

18. 18
RDF and Tag:Value
▪ Tools to translate both ways
▪ Common names for “most” of the properties
▪ Exceptions for enumeration values which must be
unique in RDF (e.g. annotationType_review =
REVIEW)
▪ Document Namespace tag key to URI

19. 19
Notes for Implementers
▪ Careful of the Infinite Recursion of Relationships
▪ External Document References key to building URI’s for
external documents
▪ Leverage existing implementations (git.linuxfoundation.org)
▪ The RDF schema can be found at http://spdx.
org/rdf/ontology/spdx-2-0-rev-11/

20. 20
How to Provide Feedback
▪ Add a Comment or Question on the draft working document:
▪ use this for typos/format errors/etc.
▪ Open a bug on the SPDX spec
▪ https://bugs.linuxfoundation.org/enter_bug.cgi?product=spdx
▪ use this for issues that might be showstoppers and things to consider for the next
release. Set the target release to 2.0. We review these weekly.
▪ Send email to spdx-legal mail list
▪ https://lists.spdx.org/mailman/listinfo/spdx-legal
▪ use this for queries about the licenses or issues related to the SPDX License List.
▪ Send email to spdx-tech mail list
▪ https://lists.spdx.org/mailman/listinfo/spdx-tech
▪ use this for general queries about the spec that don’t fit into the other channels.

21. 21Copyright Linux Foundation 2015 (CC-BY-3.0)
QUESTIONS?
Thank you!

22. 22
Backup Slides

23. 23
SPDX® 2.0 - How?
Reworking the Underlying Model

24. 24
SPDX handles Package Relationships
MQ Apache
Jetty Web
Container
javax.servlet
Apache MQ
Jetty Web
Container
javax.servlet
Package SPDX Doc
contains
contains
cont’d
by
cont’d
by

25. 25
SPDX Elements - the fundementals

26. 26
Licenses

27. 27
The Big (and complex) Picture

28. 28
SPDX® 2.0 - Why?
Key Use Cases to Support

29. 29
Relationship Use Cases
Binary only delivery
• SPDX for the binary points to SPDX
doc for the code used to build it
(generatedFrom)
• SPDX for the binary points to SPDX
doc for a library it links with at run
time (dynamicLink)
Binary
SPDX
Source
SPDX
dynamicLink Library
SPDX
generatedFrom

30. 30
More precise
description of the
“bits”
• Instead of a single SPDX file
with “the kitchen sink” or
multiple ones that must have a
document to say what they are,
we can now be more precise
and have the docs refer to
themselves
Application
SPDX
Source
SPDX
(License:
BSD-3-
Clause)
Binary
SPDX
(License:
BSD-3-
Clause)
Documents
SPDX
(License: CC-
BY-3.0)
describes
generatedFrom
Test Sftw
SPDX
(License:
MIT)
testCaseOf
Relationship Use Cases

31. 31
Supply Chains
• Changes can be tracked as software
moves through a supply chain
• Entity A gives a library, libA, to Entity B
• Entity B makes changes to libA and
describes those changes with a new
SPDX doc that refers to the original
one.
libA
SPDX
Entity A
Entity B
descendantOf
fileAdded
fileModified
fileRemoved
New libA
SPDX
Relationship Use Cases
Package to Package
relationship
File to Package
relationship

32. 32
Resources for SPDX®
▪ Open Source Tools (hosted on SPDX Git Repo)
▪ Viewer
▪ Spreadsheet to RDF/Tag Value xlator
▪ RDF/Tag Value to Spreadsheet xlator
▪ License file generator (from Spreadsheet)
▪ Spreadsheet template
▪ FOSSology via University of Nebraska Omaha
▪ Commercial Tools
▪ Scanning tools to provide SPDX® support
▪ http://spdx.org/

33. 33
Getting involved…
▪ See:
▪ http://www.spdx.org
▪ Mailing lists, meetings, wiki
▪ Contact:
▪ Phil Odence (Chair) - podence@blackducksoftware.com
▪ Kate Stewart (Tech Team Chair) - stewart@linux.com
▪ Gary O’Neal (Tools Lead) - gary@sourceauditor.com
▪ Jilayne Lovejoy (Legal Team Co-Chair) - opensource@jilayne.com
▪ Paul Maddick, (Legal Team Co-Chair) - paul.madick@hp.com
▪ Jack Manbeck (Business Team Co-Chair) - j-manbeck2@ti.com
▪ Mikael Söderberg (Business Team Co-Chair) - mikael.soderberg@pelagicore.com