add Lite profile examples by NorioKobota · Pull Request #91 · spdx/spdx-examples

NorioKobota · 2024-07-06T03:19:15Z

We implemented three samples that show how to use Lite Profile.
We would appriciate your review.

Signed-off-by: notanaka <No.Tanaka@sony.com>

Signed-off-by: Nobuyuki Tanaka <No.Tanaka@sony.com>

…examples into merge-lite-example-1

JPEWdev

The CI with likely find many more problems once it runs. I'll admit that the output of the checks, while very through, can be difficult to interpret. If you run into trouble getting these to pass CI, let me know and I can help interpret the errors.

Overall, the structure of these documents seems fine, they just need to conform to the JSON schema and SHACL model (which is done by CI) and they should be OK

JPEWdev · 2024-07-09T00:30:26Z

@@ -0,0 +1,189 @@
+{
+    "@context": "https://raw.githubusercontent.com/spdx/spdx-3-serialization-prototype-playground/main/jsonld/spdx-3.0-context.json-ld",


This is the example context URL, the actual URL needs to be used now, which is:

"@context": "https://spdx.github.io/spdx-spec/v3.0/model/spdx-context.jsonld"

JPEWdev · 2024-07-09T00:35:47Z

+    "@graph": [
+        {
+            "type": "SpdxDocument",
+            "spdxId": "http://spdx.example.com/Document/1",


http://spdx.example.com/Document/1 is not a good example spdxId. An SPDX ID needs some universally unique identifier, and SPDX has a defined URL prefix of https://spdx.org/spdxdocs/ for the case where the producer doesn't have their own domain. Thus, your spdx ID should probably look something like:

"spdxId": "https://spdx.org/spdxdocs/08f113e9-a0b0-4482-a0ed-c4e18e5136be/Document/1"

The https://spdx.org/spdxdocs/08f113e9-a0b0-4482-a0ed-c4e18e5136be/ prefix can be reused for all the other objects in this document keeping the existing scheme of appending the type and an index if you desire.

See "Best practices for creating spdxIds for SPDX documents (and their Elements)" at https://spdx.github.io/spdx-spec/v3.1-dev/model/Core/Properties/spdxId/ (borrowed from SPDX 2.x and to be in SPDX 3.1)

JPEWdev · 2024-07-09T00:37:24Z

+                "type": "NamespaceMap",
+                "prefix": "lite-example",
+                "namespace": "http://spdx.example.com/Lite/1"
+            }],


This namespace map is not used in the document, so please remove it for clarity

This pattern still exists in

lite/example1-with-VEX/spdx3.0/Lite-example-1-1-with-VEX.spdx.json

lite/example1-with-VEX/spdx3.0/Lite-example-1-3-with-VEX.spdx.json

JPEWdev · 2024-07-09T00:42:48Z

+                "http://spdx.example.com/Relationship/2",
+                "http://spdx.example.com/Relationship/3"
+            ],
+            "sbomType": "build"


Property names are always prefix by their namespace (e.g. profile) unless they are from core, so this needs to be:

"software_sbomType": [ "build" ],

Also be aware that SPDX 3.0 JSON doesn't allow array eliding, so if a property has any max ordinality other than 1, it must be an array in JSON, even if it only contains one item.

Some of these are fixed but there are still 3 instances of "software_sbomType" that is not an array.

Signed-off-by: Nobuyuki Tanaka <No.Tanaka@sony.com>

…examples into merge-lite-example-1

Signed-off-by: Nobuyuki Tanaka <No.Tanaka@sony.com>

…examples into merge-lite-example-1

Signed-off-by: Nobuyuki Tanaka <No.Tanaka@sony.com>

…examples into merge-lite-example-1

Signed-off-by: Nobuyuki Tanaka <No.Tanaka@sony.com>

…examples into merge-lite-example-1

Signed-off-by: Nobuyuki Tanaka <No.Tanaka@sony.com>

…examples into merge-lite-example-1

Signed-off-by: Nobuyuki Tanaka <No.Tanaka@sony.com>

…examples into merge-lite-example-1

Signed-off-by: Nobuyuki Tanaka <No.Tanaka@sony.com>

…examples into merge-lite-example-1

Signed-off-by: Nobuyuki Tanaka <No.Tanaka@sony.com>

…examples into merge-lite-example-1

Signed-off-by: Norio Kobota <norio.kobota@sony.com>

Merge lite example 1

Signed-off-by: Norio Kobota <norio.kobota@sony.com>

Signed-off-by: Nobuyuki Tanaka <No.Tanaka@sony.com>

…examples into merge-lite-example-1

…endedBy to meet specification Signed-off-by: Nobuyuki Tanaka <No.Tanaka@sony.com>

…examples into merge-lite-example-1

….json Co-authored-by: Arthit Suriyawongkul <arthit@gmail.com> Signed-off-by: Norio Kobota <norio.kobota@sony.com>

Co-authored-by: Arthit Suriyawongkul <arthit@gmail.com> Signed-off-by: Norio Kobota <norio.kobota@sony.com>

bact · 2025-01-09T10:06:01Z

@NorioKobota do you mind to move all SPDX JSON files from spdx-3.0/ folder to spdx3.0/ folder please? Thank you

The current workflow is now looking for files in spdx3.0/ (to make is consistent with previous spdx2.0/).

spdx-examples/.github/workflows/pull_request.yml

Line 74 in 6a5d3a0

for f in $(find . -type f -path '*/spdx3.0/*.json'); do

NorioKobota · 2025-01-09T10:10:36Z

@bact Sure.
I will do it and the rest of the change request. Sorry for the late reply.
Thanks!

json and png: amends of relationshipType in VEX relationship is modified to amendedBy to meet specification

Signed-off-by: Norio Kobota <norio.kobota@sony.com>

NorioKobota · 2025-01-28T07:08:17Z

@bact
I believe I have fixed everything except dataLicense, could you please review it?
Also, is there an example of how to write dataLicense somewhere?

bact

Thank you. Few minor changes suggested. After this I think we are good to go.

Co-authored-by: Arthit Suriyawongkul <arthit@gmail.com> Signed-off-by: Norio Kobota <norio.kobota@sony.com>

NorioKobota · 2025-01-28T07:54:57Z

Thank you so much for the review.
I confirmed and committed your suggestions.

bact · 2025-01-28T08:01:01Z

Thank you @NorioKobota and @no-ta . I think it's pretty much all good.

Now we need a maintainer to approve the validation workflow - to let it pass the validation before merge.

(Note that I have removed all my suggestions that are already resolved, since they are too long, to make this PR easier to read)

bact · 2025-01-28T08:02:01Z

@zvr @goneall if you have some time to approve the workflow (for PR validation ), thank you.

NorioKobota · 2025-01-28T12:47:37Z

@bact Ah, sorry.
#91 (comment)
I believe I have fixed everything **except dataLicense**.
Could someone teach me how to implement?

bact · 2025-07-22T08:17:51Z

As there were changes in validation workflow/dependencies in April 2025 (and probably also after that), we may like to rerun the check to see if it pass now.

bobmartin3000

LGTM

bact

software_sbomType has to be an array

bact · 2026-07-14T01:56:07Z

+                "https://spdx.org/spdxdocs/08f113e9-a0b0-4482-a0ed-c4e18e5136be/Relationship/2",
+                "https://spdx.org/spdxdocs/08f113e9-a0b0-4482-a0ed-c4e18e5136be/Relationship/3"
+            ],
+            "software_sbomType": "build"


Suggested change

"software_sbomType": "build"

"software_sbomType": [

"build"

]

bact · 2026-07-14T01:56:52Z

+                "https://spdx.org/spdxdocs/08f113e9-a0b0-4482-a0ed-c4e18e5136be/Relationship/2",
+                "https://spdx.org/spdxdocs/08f113e9-a0b0-4482-a0ed-c4e18e5136be/Relationship/3"
+            ],
+            "software_sbomType": "build"


Suggested change

"software_sbomType": "build"

"software_sbomType": [

"build"

]

no-ta added 3 commits July 1, 2024 21:28

Initial example1-with-VEX

94d44aa

Signed-off-by: notanaka <No.Tanaka@sony.com>

change user.name

d14f88e

Signed-off-by: Nobuyuki Tanaka <No.Tanaka@sony.com>

Merge branch 'merge-lite-example-1' of https://github.com/no-ta/spdx-…

396caba

…examples into merge-lite-example-1

JPEWdev reviewed Jul 9, 2024

View reviewed changes

no-ta added 16 commits July 10, 2024 17:46

Apply spdx#91

ea55dc8

Signed-off-by: Nobuyuki Tanaka <No.Tanaka@sony.com>

Merge branch 'merge-lite-example-1' of https://github.com/no-ta/spdx-…

bddcddb

…examples into merge-lite-example-1

Apply spdx#91

07d0403

Signed-off-by: Nobuyuki Tanaka <No.Tanaka@sony.com>

Merge branch 'merge-lite-example-1' of https://github.com/no-ta/spdx-…

79aed87

…examples into merge-lite-example-1

Change file suffix from .jsonld to .json

c941fa5

Signed-off-by: Nobuyuki Tanaka <No.Tanaka@sony.com>

Merge branch 'merge-lite-example-1' of https://github.com/no-ta/spdx-…

c10db29

…examples into merge-lite-example-1

Change spdxId in sotware_Sbom and packageVersion in software_Pacakge

9c95165

Signed-off-by: Nobuyuki Tanaka <No.Tanaka@sony.com>

Merge branch 'merge-lite-example-1' of https://github.com/no-ta/spdx-…

cf9eb4e

…examples into merge-lite-example-1

Change spdxId in sotware_Sbom and packageVersion in software_Pacakge

1f83d0a

Signed-off-by: Nobuyuki Tanaka <No.Tanaka@sony.com>

Merge branch 'merge-lite-example-1' of https://github.com/no-ta/spdx-…

03c5ebe

…examples into merge-lite-example-1

Change spdxId in sotware_Sbom and packageVersion in software_Pacakge

ae7eb1e

Signed-off-by: Nobuyuki Tanaka <No.Tanaka@sony.com>

Merge branch 'merge-lite-example-1' of https://github.com/no-ta/spdx-…

1091965

…examples into merge-lite-example-1

Update png files for spdx#91

db80bdd

Signed-off-by: Nobuyuki Tanaka <No.Tanaka@sony.com>

Merge branch 'merge-lite-example-1' of https://github.com/no-ta/spdx-…

62bcac5

…examples into merge-lite-example-1

Update png files for spdx#91

54fcef8

Signed-off-by: Nobuyuki Tanaka <No.Tanaka@sony.com>

Merge branch 'merge-lite-example-1' of https://github.com/no-ta/spdx-…

c64a58f

…examples into merge-lite-example-1

NorioKobota mentioned this pull request Jul 11, 2024

Bug fixes for Lite profile annex spdx/spdx-spec#991

Merged

Add lite profile examples

552d82e

Signed-off-by: Norio Kobota <norio.kobota@sony.com>

NorioKobota force-pushed the lite-profile branch from 3b13c8f to 552d82e Compare July 12, 2024 07:47

NorioKobota added 3 commits July 20, 2024 10:31

modify to follow suggested at spdx#91

b15cde1

Signed-off-by: Norio Kobota <norio.kobota@sony.com>

rename fname and move into spdx-3.0 dir to follow suggestions at spdx#91

8a584c7

Signed-off-by: Norio Kobota <norio.kobota@sony.com>

applied the same modifications to sample2

b04d429

Signed-off-by: Norio Kobota <norio.kobota@sony.com>

no-ta mentioned this pull request Jul 20, 2024

Merge lite example 1 NorioKobota/spdx-examples#3

Merged

NorioKobota and others added 3 commits July 20, 2024 22:24

Merge pull request #3 from no-ta/merge-lite-example-1

8612d57

Merge lite example 1

rename sample2.spdx.json

d55f3a0

Signed-off-by: Norio Kobota <norio.kobota@sony.com>

Rename json file name .json to .spdx.json

e92743b

Signed-off-by: Nobuyuki Tanaka <No.Tanaka@sony.com>

no-ta added 3 commits July 31, 2024 18:00

Merge branch 'merge-lite-example-1' of https://github.com/no-ta/spdx-…

3a0747d

…examples into merge-lite-example-1

PNG: amends of relationshipType in VEX relationship is modified to am…

138100c

…endedBy to meet specification Signed-off-by: Nobuyuki Tanaka <No.Tanaka@sony.com>

Merge branch 'merge-lite-example-1' of https://github.com/no-ta/spdx-…

c0e2a4a

…examples into merge-lite-example-1

kestewart requested a review from JPEWdev August 20, 2024 16:13

This comment was marked as resolved.

Sign in to view

NorioKobota and others added 5 commits January 9, 2025 18:49

Update lite/example1-with-VEX/spdx-3.0/Lite-example-1-1-with-VEX.spdx…

9adf9e9

….json Co-authored-by: Arthit Suriyawongkul <arthit@gmail.com> Signed-off-by: Norio Kobota <norio.kobota@sony.com>

Update lite/example1-with-VEX/spdx-3.0/Lite-example-1-3-with-VEX.spdx…

7af0bd9

….json Co-authored-by: Arthit Suriyawongkul <arthit@gmail.com> Signed-off-by: Norio Kobota <norio.kobota@sony.com>

Update lite/example1-with-VEX/spdx-3.0/Lite-example-1-2-with-VEX.spdx…

2f66ffa

….json Co-authored-by: Arthit Suriyawongkul <arthit@gmail.com> Signed-off-by: Norio Kobota <norio.kobota@sony.com>

Update lite/example1/spdx-3.0/lite-example-1.spdx.json

522fe0c

Co-authored-by: Arthit Suriyawongkul <arthit@gmail.com> Signed-off-by: Norio Kobota <norio.kobota@sony.com>

Update lite/example2/spdx-3.0/lite-example-2.spdx.json

62bbc76

Co-authored-by: Arthit Suriyawongkul <arthit@gmail.com> Signed-off-by: Norio Kobota <norio.kobota@sony.com>

bact requested changes Jan 9, 2025

View reviewed changes

NorioKobota added 3 commits January 27, 2025 09:39

Merge pull request #6 from no-ta/merge-lite-example-1

31c6bc4

json and png: amends of relationshipType in VEX relationship is modified to amendedBy to meet specification

Merge branch 'spdx:master' into lite-profile

ec20065

fix several items mentioned in spdx#91

4589227

Signed-off-by: Norio Kobota <norio.kobota@sony.com>

bact requested changes Jan 28, 2025

View reviewed changes

NorioKobota and others added 3 commits January 28, 2025 16:51

Update lite/example2/README.md

b83298d

Co-authored-by: Arthit Suriyawongkul <arthit@gmail.com> Signed-off-by: Norio Kobota <norio.kobota@sony.com>

Update lite/example1-with-VEX/spdx3.0/README.md

f5c995b

Co-authored-by: Arthit Suriyawongkul <arthit@gmail.com> Signed-off-by: Norio Kobota <norio.kobota@sony.com>

Update lite/example1-with-VEX/spdx3.0/README.md

8084dca

Co-authored-by: Arthit Suriyawongkul <arthit@gmail.com> Signed-off-by: Norio Kobota <norio.kobota@sony.com>

bact approved these changes Jan 28, 2025

View reviewed changes

bobmartin3000 approved these changes May 5, 2026

View reviewed changes

bact added the profile:Lite label Jun 12, 2026

bact requested changes Jul 14, 2026

View reviewed changes

		@@ -0,0 +1,189 @@
		{
		"@context": "https://raw.githubusercontent.com/spdx/spdx-3-serialization-prototype-playground/main/jsonld/spdx-3.0-context.json-ld",

Uh oh!

Conversation

NorioKobota commented Jul 6, 2024

Uh oh!

JPEWdev left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

This comment was marked as resolved.

Uh oh!

bact commented Jan 9, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

NorioKobota commented Jan 9, 2025

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

NorioKobota commented Jan 28, 2025

Uh oh!

bact left a comment

Choose a reason for hiding this comment

Uh oh!

NorioKobota commented Jan 28, 2025

Uh oh!

bact commented Jan 28, 2025

Uh oh!

bact commented Jan 28, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

NorioKobota commented Jan 28, 2025

Uh oh!

bact commented Jul 22, 2025

Uh oh!

bobmartin3000 left a comment

Choose a reason for hiding this comment

Uh oh!

bact left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

bact commented Jan 9, 2025 •

edited

Loading

bact commented Jan 28, 2025 •

edited

Loading