Skip to content

Add example for a source level SBOM which includes a subdirectory with a different license #79

@goneall

Description

@goneall

Raised as a question on the SPDX tech email list from Oliver Fendt:

...
Sometimes you find in a package (lets assume the declared license is A) in some subdirectory (lets assume SUB-DIR-X) a README file with the following wording: “the files in this directory are licensed under license C”, but none of the files in this directory contain any license information and do not contain any reference to the README file in this directory.
...

Response in the email thread:

...
In SPDX, you can use the SPDX Package to represent a subdirectory of files within a larger package.

In [the above] scenario, one approach would be to create an SPDX package – if it doesn’t have a logical name, you could call it something like “C licensed files” with a declared license of C. Then use the “contains” relationship from the parent package to the subdirectory.
...

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions