Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add example for a source level SBOM which includes a subdirectory with a different license #79

Open
goneall opened this issue May 2, 2024 · 0 comments

Comments

@goneall
Copy link
Member

goneall commented May 2, 2024

Raised as a question on the SPDX tech email list from Oliver Fendt:

...
Sometimes you find in a package (lets assume the declared license is A) in some subdirectory (lets assume SUB-DIR-X) a README file with the following wording: “the files in this directory are licensed under license C”, but none of the files in this directory contain any license information and do not contain any reference to the README file in this directory.
...

Response in the email thread:

...
In SPDX, you can use the SPDX Package to represent a subdirectory of files within a larger package.

In [the above] scenario, one approach would be to create an SPDX package – if it doesn’t have a logical name, you could call it something like “C licensed files” with a declared license of C. Then use the “contains” relationship from the parent package to the subdirectory.
...

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant