Skip to content

Commit 49bded2

Browse files
jkowalleckjkowalleck
committed
feat: license expression licensing and properties
Signed-off-by: Jan Kowalleck <[email protected]>
1 parent c974a3c commit 49bded2

File tree

3 files changed

+308
-279
lines changed

3 files changed

+308
-279
lines changed

‎schema/bom-1.7.proto

+9-4
Original file line numberDiff line numberDiff line change
@@ -444,12 +444,17 @@ message LicenseExpressionDetailed {
444444
// - "Apache-2.0 AND (MIT OR GPL-2.0-only)",
445445
// - "GPL-3.0-only WITH Classpath-exception-2.0"
446446
string expression = 1;
447+
// Licensing details describing the licensor/licensee, license type, renewal and expiration dates, and other important metadata
448+
// Details for parts of the `expression`.
449+
repeated ExpressionDetails details = 2;
447450
// An optional identifier which can be used to reference the license elsewhere in the BOM. Uniqueness is enforced within all elements and children of the root-level bom element.
448-
optional string bom_ref = 2;
451+
optional string bom_ref = 3;
449452
// Declared licenses and concluded licenses represent two different stages in the licensing process within software development. Declared licenses refer to the initial intention of the software authors regarding the licensing terms under which their code is released. On the other hand, concluded licenses are the result of a comprehensive analysis of the project's codebase to identify and confirm the actual licenses of the components used, which may differ from the initially declared licenses. While declared licenses provide an upfront indication of the licensing intentions, concluded licenses offer a more thorough understanding of the actual licensing within a project, facilitating proper compliance and risk management. Observed licenses are defined in `@.evidence.licenses`. Observed licenses form the evidence necessary to substantiate a concluded license.
450-
optional LicenseAcknowledgementEnumeration acknowledgement = 3;
451-
// Details for parts of the `expression`.
452-
repeated ExpressionDetails details = 4;
453+
optional LicenseAcknowledgementEnumeration acknowledgement = 4;
454+
// Licensing details describing the licensor/licensee, license type, renewal and expiration dates, and other important metadata
455+
optional Licensing licensing = 5;
456+
// Specifies optional, custom, properties
457+
repeated Property properties = 6;
453458
}
454459

455460
// Declared licenses and concluded licenses represent two different stages in the licensing process within software development. Declared licenses refer to the initial intention of the software authors regarding the licensing terms under which their code is released. On the other hand, concluded licenses are the result of a comprehensive analysis of the project's codebase to identify and confirm the actual licenses of the components used, which may differ from the initially declared licenses. While declared licenses provide an upfront indication of the licensing intentions, concluded licenses offer a more thorough understanding of the actual licensing within a project, facilitating proper compliance and risk management. Observed licenses are defined in `@.evidence.licenses`. Observed licenses form the evidence necessary to substantiate a concluded license.

‎schema/bom-1.7.schema.json

+162-155
Original file line numberDiff line numberDiff line change
@@ -1230,6 +1230,161 @@
12301230
"examples": ["3942447fac867ae5cdb3229b658f4d48"],
12311231
"pattern": "^([a-fA-F0-9]{32}|[a-fA-F0-9]{40}|[a-fA-F0-9]{64}|[a-fA-F0-9]{96}|[a-fA-F0-9]{128})$"
12321232
},
1233+
"licensing": {
1234+
"type": "object",
1235+
"title": "Licensing information",
1236+
"description": "Licensing details describing the licensor/licensee, license type, renewal and expiration dates, and other important metadata",
1237+
"additionalProperties": false,
1238+
"properties": {
1239+
"altIds": {
1240+
"type": "array",
1241+
"title": "Alternate License Identifiers",
1242+
"description": "License identifiers that may be used to manage licenses and their lifecycle",
1243+
"items": {
1244+
"type": "string"
1245+
}
1246+
},
1247+
"licensor": {
1248+
"title": "Licensor",
1249+
"description": "The individual or organization that grants a license to another individual or organization",
1250+
"type": "object",
1251+
"additionalProperties": false,
1252+
"properties": {
1253+
"organization": {
1254+
"title": "Licensor (Organization)",
1255+
"description": "The organization that granted the license",
1256+
"$ref": "#/definitions/organizationalEntity"
1257+
},
1258+
"individual": {
1259+
"title": "Licensor (Individual)",
1260+
"description": "The individual, not associated with an organization, that granted the license",
1261+
"$ref": "#/definitions/organizationalContact"
1262+
}
1263+
},
1264+
"oneOf":[
1265+
{
1266+
"required": ["organization"]
1267+
},
1268+
{
1269+
"required": ["individual"]
1270+
}
1271+
]
1272+
},
1273+
"licensee": {
1274+
"title": "Licensee",
1275+
"description": "The individual or organization for which a license was granted to",
1276+
"type": "object",
1277+
"additionalProperties": false,
1278+
"properties": {
1279+
"organization": {
1280+
"title": "Licensee (Organization)",
1281+
"description": "The organization that was granted the license",
1282+
"$ref": "#/definitions/organizationalEntity"
1283+
},
1284+
"individual": {
1285+
"title": "Licensee (Individual)",
1286+
"description": "The individual, not associated with an organization, that was granted the license",
1287+
"$ref": "#/definitions/organizationalContact"
1288+
}
1289+
},
1290+
"oneOf":[
1291+
{
1292+
"required": ["organization"]
1293+
},
1294+
{
1295+
"required": ["individual"]
1296+
}
1297+
]
1298+
},
1299+
"purchaser": {
1300+
"title": "Purchaser",
1301+
"description": "The individual or organization that purchased the license",
1302+
"type": "object",
1303+
"additionalProperties": false,
1304+
"properties": {
1305+
"organization": {
1306+
"title": "Purchaser (Organization)",
1307+
"description": "The organization that purchased the license",
1308+
"$ref": "#/definitions/organizationalEntity"
1309+
},
1310+
"individual": {
1311+
"title": "Purchaser (Individual)",
1312+
"description": "The individual, not associated with an organization, that purchased the license",
1313+
"$ref": "#/definitions/organizationalContact"
1314+
}
1315+
},
1316+
"oneOf":[
1317+
{
1318+
"required": ["organization"]
1319+
},
1320+
{
1321+
"required": ["individual"]
1322+
}
1323+
]
1324+
},
1325+
"purchaseOrder": {
1326+
"type": "string",
1327+
"title": "Purchase Order",
1328+
"description": "The purchase order identifier the purchaser sent to a supplier or vendor to authorize a purchase"
1329+
},
1330+
"licenseTypes": {
1331+
"type": "array",
1332+
"title": "License Type",
1333+
"description": "The type of license(s) that was granted to the licensee.",
1334+
"items": {
1335+
"type": "string",
1336+
"enum": [
1337+
"academic",
1338+
"appliance",
1339+
"client-access",
1340+
"concurrent-user",
1341+
"core-points",
1342+
"custom-metric",
1343+
"device",
1344+
"evaluation",
1345+
"named-user",
1346+
"node-locked",
1347+
"oem",
1348+
"perpetual",
1349+
"processor-points",
1350+
"subscription",
1351+
"user",
1352+
"other"
1353+
],
1354+
"meta:enum": {
1355+
"academic": "A license that grants use of software solely for the purpose of education or research.",
1356+
"appliance": "A license covering use of software embedded in a specific piece of hardware.",
1357+
"client-access": "A Client Access License (CAL) allows client computers to access services provided by server software.",
1358+
"concurrent-user": "A Concurrent User license (aka floating license) limits the number of licenses for a software application and licenses are shared among a larger number of users.",
1359+
"core-points": "A license where the core of a computer's processor is assigned a specific number of points.",
1360+
"custom-metric": "A license for which consumption is measured by non-standard metrics.",
1361+
"device": "A license that covers a defined number of installations on computers and other types of devices.",
1362+
"evaluation": "A license that grants permission to install and use software for trial purposes.",
1363+
"named-user": "A license that grants access to the software to one or more pre-defined users.",
1364+
"node-locked": "A license that grants access to the software on one or more pre-defined computers or devices.",
1365+
"oem": "An Original Equipment Manufacturer license that is delivered with hardware, cannot be transferred to other hardware, and is valid for the life of the hardware.",
1366+
"perpetual": "A license where the software is sold on a one-time basis and the licensee can use a copy of the software indefinitely.",
1367+
"processor-points": "A license where each installation consumes points per processor.",
1368+
"subscription": "A license where the licensee pays a fee to use the software or service.",
1369+
"user": "A license that grants access to the software or service by a specified number of users.",
1370+
"other": "Another license type."
1371+
}
1372+
}
1373+
},
1374+
"lastRenewal": {
1375+
"type": "string",
1376+
"format": "date-time",
1377+
"title": "Last Renewal",
1378+
"description": "The timestamp indicating when the license was last renewed. For new purchases, this is often the purchase or acquisition date. For non-perpetual licenses or subscriptions, this is the timestamp of when the license was last renewed."
1379+
},
1380+
"expiration": {
1381+
"type": "string",
1382+
"format": "date-time",
1383+
"title": "Expiration",
1384+
"description": "The timestamp indicating when the current license expires (if applicable)."
1385+
}
1386+
}
1387+
},
12331388
"license": {
12341389
"type": "object",
12351390
"title": "License",
@@ -1276,161 +1431,7 @@
12761431
"examples": ["https://www.apache.org/licenses/LICENSE-2.0.txt"],
12771432
"format": "iri-reference"
12781433
},
1279-
"licensing": {
1280-
"type": "object",
1281-
"title": "Licensing information",
1282-
"description": "Licensing details describing the licensor/licensee, license type, renewal and expiration dates, and other important metadata",
1283-
"additionalProperties": false,
1284-
"properties": {
1285-
"altIds": {
1286-
"type": "array",
1287-
"title": "Alternate License Identifiers",
1288-
"description": "License identifiers that may be used to manage licenses and their lifecycle",
1289-
"items": {
1290-
"type": "string"
1291-
}
1292-
},
1293-
"licensor": {
1294-
"title": "Licensor",
1295-
"description": "The individual or organization that grants a license to another individual or organization",
1296-
"type": "object",
1297-
"additionalProperties": false,
1298-
"properties": {
1299-
"organization": {
1300-
"title": "Licensor (Organization)",
1301-
"description": "The organization that granted the license",
1302-
"$ref": "#/definitions/organizationalEntity"
1303-
},
1304-
"individual": {
1305-
"title": "Licensor (Individual)",
1306-
"description": "The individual, not associated with an organization, that granted the license",
1307-
"$ref": "#/definitions/organizationalContact"
1308-
}
1309-
},
1310-
"oneOf":[
1311-
{
1312-
"required": ["organization"]
1313-
},
1314-
{
1315-
"required": ["individual"]
1316-
}
1317-
]
1318-
},
1319-
"licensee": {
1320-
"title": "Licensee",
1321-
"description": "The individual or organization for which a license was granted to",
1322-
"type": "object",
1323-
"additionalProperties": false,
1324-
"properties": {
1325-
"organization": {
1326-
"title": "Licensee (Organization)",
1327-
"description": "The organization that was granted the license",
1328-
"$ref": "#/definitions/organizationalEntity"
1329-
},
1330-
"individual": {
1331-
"title": "Licensee (Individual)",
1332-
"description": "The individual, not associated with an organization, that was granted the license",
1333-
"$ref": "#/definitions/organizationalContact"
1334-
}
1335-
},
1336-
"oneOf":[
1337-
{
1338-
"required": ["organization"]
1339-
},
1340-
{
1341-
"required": ["individual"]
1342-
}
1343-
]
1344-
},
1345-
"purchaser": {
1346-
"title": "Purchaser",
1347-
"description": "The individual or organization that purchased the license",
1348-
"type": "object",
1349-
"additionalProperties": false,
1350-
"properties": {
1351-
"organization": {
1352-
"title": "Purchaser (Organization)",
1353-
"description": "The organization that purchased the license",
1354-
"$ref": "#/definitions/organizationalEntity"
1355-
},
1356-
"individual": {
1357-
"title": "Purchaser (Individual)",
1358-
"description": "The individual, not associated with an organization, that purchased the license",
1359-
"$ref": "#/definitions/organizationalContact"
1360-
}
1361-
},
1362-
"oneOf":[
1363-
{
1364-
"required": ["organization"]
1365-
},
1366-
{
1367-
"required": ["individual"]
1368-
}
1369-
]
1370-
},
1371-
"purchaseOrder": {
1372-
"type": "string",
1373-
"title": "Purchase Order",
1374-
"description": "The purchase order identifier the purchaser sent to a supplier or vendor to authorize a purchase"
1375-
},
1376-
"licenseTypes": {
1377-
"type": "array",
1378-
"title": "License Type",
1379-
"description": "The type of license(s) that was granted to the licensee.",
1380-
"items": {
1381-
"type": "string",
1382-
"enum": [
1383-
"academic",
1384-
"appliance",
1385-
"client-access",
1386-
"concurrent-user",
1387-
"core-points",
1388-
"custom-metric",
1389-
"device",
1390-
"evaluation",
1391-
"named-user",
1392-
"node-locked",
1393-
"oem",
1394-
"perpetual",
1395-
"processor-points",
1396-
"subscription",
1397-
"user",
1398-
"other"
1399-
],
1400-
"meta:enum": {
1401-
"academic": "A license that grants use of software solely for the purpose of education or research.",
1402-
"appliance": "A license covering use of software embedded in a specific piece of hardware.",
1403-
"client-access": "A Client Access License (CAL) allows client computers to access services provided by server software.",
1404-
"concurrent-user": "A Concurrent User license (aka floating license) limits the number of licenses for a software application and licenses are shared among a larger number of users.",
1405-
"core-points": "A license where the core of a computer's processor is assigned a specific number of points.",
1406-
"custom-metric": "A license for which consumption is measured by non-standard metrics.",
1407-
"device": "A license that covers a defined number of installations on computers and other types of devices.",
1408-
"evaluation": "A license that grants permission to install and use software for trial purposes.",
1409-
"named-user": "A license that grants access to the software to one or more pre-defined users.",
1410-
"node-locked": "A license that grants access to the software on one or more pre-defined computers or devices.",
1411-
"oem": "An Original Equipment Manufacturer license that is delivered with hardware, cannot be transferred to other hardware, and is valid for the life of the hardware.",
1412-
"perpetual": "A license where the software is sold on a one-time basis and the licensee can use a copy of the software indefinitely.",
1413-
"processor-points": "A license where each installation consumes points per processor.",
1414-
"subscription": "A license where the licensee pays a fee to use the software or service.",
1415-
"user": "A license that grants access to the software or service by a specified number of users.",
1416-
"other": "Another license type."
1417-
}
1418-
}
1419-
},
1420-
"lastRenewal": {
1421-
"type": "string",
1422-
"format": "date-time",
1423-
"title": "Last Renewal",
1424-
"description": "The timestamp indicating when the license was last renewed. For new purchases, this is often the purchase or acquisition date. For non-perpetual licenses or subscriptions, this is the timestamp of when the license was last renewed."
1425-
},
1426-
"expiration": {
1427-
"type": "string",
1428-
"format": "date-time",
1429-
"title": "Expiration",
1430-
"description": "The timestamp indicating when the current license expires (if applicable)."
1431-
}
1432-
}
1433-
},
1434+
"licensing": {"$ref": "#/definitions/licensing"},
14341435
"properties": {
14351436
"type": "array",
14361437
"title": "Properties",
@@ -1543,6 +1544,12 @@
15431544
"$ref": "#/definitions/refType",
15441545
"title": "BOM Reference",
15451546
"description": "An optional identifier which can be used to reference the license elsewhere in the BOM. Every bom-ref must be unique within the BOM.\nValue SHOULD not start with the BOM-Link intro 'urn:cdx:' to avoid conflicts with BOM-Links."
1547+
},
1548+
"properties": {
1549+
"type": "array",
1550+
"title": "Properties",
1551+
"description": "Provides the ability to document properties in a name-value store. This provides flexibility to include data not officially supported in the standard without having to use additional namespaces or create extensions. Unlike key-value stores, properties support duplicate names, each potentially having different values. Property names of interest to the general public are encouraged to be registered in the [CycloneDX Property Taxonomy](https://github.com/CycloneDX/cyclonedx-property-taxonomy). Formal registration is optional.",
1552+
"items": {"$ref": "#/definitions/property"}
15461553
}
15471554
}
15481555
}]

0 commit comments

Comments
 (0)