From 7fbe08edc9a24faa2dc60623e87bb9d2144fd768 Mon Sep 17 00:00:00 2001 From: Jan Kowalleck Date: Fri, 14 Aug 2026 10:23:38 +0200 Subject: [PATCH 1/2] refactor: license expression as defined object Signed-off-by: Jan Kowalleck --- .../model/cyclonedx-license-2.0.schema.json | 157 +++++++++--------- 1 file changed, 79 insertions(+), 78 deletions(-) diff --git a/schema/2.0/model/cyclonedx-license-2.0.schema.json b/schema/2.0/model/cyclonedx-license-2.0.schema.json index 04266739..2314cab7 100644 --- a/schema/2.0/model/cyclonedx-license-2.0.schema.json +++ b/schema/2.0/model/cyclonedx-license-2.0.schema.json @@ -24,84 +24,7 @@ } } }, - { - "title": "License Expression", - "description": "Specifies the details and attributes related to a software license.\nIt must be a valid SPDX license expression, along with additional properties such as license acknowledgment.", - "type": "object", - "additionalProperties": false, - "required": [ - "expression" - ], - "properties": { - "expression": { - "type": "string", - "title": "SPDX License Expression", - "description": "A valid SPDX license expression.\nRefer to https://spdx.org/specifications for syntax requirements.", - "examples": [ - "Apache-2.0 AND (MIT OR GPL-2.0-only)", - "GPL-3.0-only WITH Classpath-exception-2.0" - ] - }, - "expressionDetails": { - "title": "Expression Details", - "description": "Details for parts of the `expression`.", - "type": "array", - "items": { - "type": "object", - "description": "This document specifies the details and attributes related to a software license identifier. An SPDX expression may be a compound of license identifiers.\nThe `license_identifier` property serves as the key that identifies each record. Note that this key is not required to be unique, as the same license identifier could apply to multiple, different but similar license details, texts, etc.", - "required": [ - "licenseIdentifier" - ], - "properties": { - "licenseIdentifier": { - "title": "License Identifier", - "description": "The valid SPDX license identifier. Refer to https://spdx.org/specifications for syntax requirements.\nThis property serves as the primary key, which uniquely identifies each record.", - "type": "string", - "examples": [ - "Apache-2.0", - "GPL-3.0-only WITH Classpath-exception-2.0", - "LicenseRef-my-custom-license" - ] - }, - "bom-ref": { - "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refType", - "title": "BOM Reference", - "description": "An identifier which can be used to reference the license elsewhere in the BOM. Every `bom-ref` must be unique within the BOM.\nValue SHOULD not start with the BOM-Link intro 'urn:cdx:' to avoid conflicts with BOM-Links." - }, - "text": { - "title": "License texts", - "description": "A way to include the textual content of the license.", - "$ref": "cyclonedx-common-2.0.schema.json#/$defs/attachment" - }, - "url": { - "type": "string", - "title": "License URL", - "description": "The URL to the license file. If specified, a 'license' externalReference should also be specified for completeness", - "examples": [ - "https://www.apache.org/licenses/LICENSE-2.0.txt" - ], - "format": "iri-reference" - } - }, - "additionalProperties": false - } - }, - "acknowledgement": { - "$ref": "#/$defs/licenseAcknowledgementEnumeration" - }, - "bom-ref": { - "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refType", - "title": "BOM Reference", - "description": "An identifier which can be used to reference the license elsewhere in the BOM. Every `bom-ref` must be unique within the BOM.\nValue SHOULD not start with the BOM-Link intro 'urn:cdx:' to avoid conflicts with BOM-Links." - }, - "licensing": { - "$ref": "#/$defs/licensing" - }, - "properties": { - "$ref": "cyclonedx-common-2.0.schema.json#/$defs/properties" - } - } - } + { "$ref": "#/$defs/expression" } ] } }, @@ -157,6 +80,84 @@ } } }, + "expression": { + "title": "License Expression", + "description": "Specifies the details and attributes related to a software license.\nIt must be a valid SPDX license expression.", + "type": "object", + "additionalProperties": false, + "required": [ + "expression" + ], + "properties": { + "expression": { + "type": "string", + "title": "SPDX License Expression", + "description": "A valid SPDX license expression.\nRefer to https://spdx.org/specifications for syntax requirements.", + "examples": [ + "Apache-2.0 AND (MIT OR GPL-2.0-only)", + "GPL-3.0-only WITH Classpath-exception-2.0" + ] + }, + "expressionDetails": { + "title": "Expression Details", + "description": "Details for parts of the `expression`.", + "type": "array", + "items": { + "type": "object", + "description": "This document specifies the details and attributes related to a software license identifier. An SPDX expression may be a compound of license identifiers.\nThe `license_identifier` property serves as the key that identifies each record. Note that this key is not required to be unique, as the same license identifier could apply to multiple, different but similar license details, texts, etc.", + "required": [ + "licenseIdentifier" + ], + "properties": { + "licenseIdentifier": { + "title": "License Identifier", + "description": "The valid SPDX license identifier. Refer to https://spdx.org/specifications for syntax requirements.\nThis property serves as the primary key, which uniquely identifies each record.", + "type": "string", + "examples": [ + "Apache-2.0", + "GPL-3.0-only WITH Classpath-exception-2.0", + "LicenseRef-my-custom-license" + ] + }, + "bom-ref": { + "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refType", + "title": "BOM Reference", + "description": "An identifier which can be used to reference the license elsewhere in the BOM. Every `bom-ref` must be unique within the BOM.\nValue SHOULD not start with the BOM-Link intro 'urn:cdx:' to avoid conflicts with BOM-Links." + }, + "text": { + "title": "License texts", + "description": "A way to include the textual content of the license.", + "$ref": "cyclonedx-common-2.0.schema.json#/$defs/attachment" + }, + "url": { + "type": "string", + "title": "License URL", + "description": "The URL to the license file. If specified, a 'license' externalReference should also be specified for completeness", + "examples": [ + "https://www.apache.org/licenses/LICENSE-2.0.txt" + ], + "format": "iri-reference" + } + }, + "additionalProperties": false + } + }, + "acknowledgement": { + "$ref": "#/$defs/licenseAcknowledgementEnumeration" + }, + "bom-ref": { + "$ref": "cyclonedx-common-2.0.schema.json#/$defs/refType", + "title": "BOM Reference", + "description": "An identifier which can be used to reference the license elsewhere in the BOM. Every `bom-ref` must be unique within the BOM.\nValue SHOULD not start with the BOM-Link intro 'urn:cdx:' to avoid conflicts with BOM-Links." + }, + "licensing": { + "$ref": "#/$defs/licensing" + }, + "properties": { + "$ref": "cyclonedx-common-2.0.schema.json#/$defs/properties" + } + } + }, "licenseAcknowledgementEnumeration": { "title": "License Acknowledgement", "description": "Declared licenses and concluded licenses represent two different stages in the licensing process within software development. Declared licenses refer to the initial intention of the software authors regarding the licensing terms under which their code is released. On the other hand, concluded licenses are the result of a comprehensive analysis of the project's codebase to identify and confirm the actual licenses of the components used, which may differ from the initially declared licenses. While declared licenses provide an upfront indication of the licensing intentions, concluded licenses offer a more thorough understanding of the actual licensing within a project, facilitating proper compliance and risk management. Observed licenses are defined in `@.evidence.licenses`. Observed licenses form the evidence necessary to substantiate a concluded license.", From 06c67b173ad3c15354b49223c25b12cea54b0b13 Mon Sep 17 00:00:00 2001 From: Jan Kowalleck Date: Fri, 14 Aug 2026 10:26:34 +0200 Subject: [PATCH 2/2] docs Signed-off-by: Jan Kowalleck --- schema/2.0/model/cyclonedx-license-2.0.schema.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/schema/2.0/model/cyclonedx-license-2.0.schema.json b/schema/2.0/model/cyclonedx-license-2.0.schema.json index 2314cab7..fcbbb1ec 100644 --- a/schema/2.0/model/cyclonedx-license-2.0.schema.json +++ b/schema/2.0/model/cyclonedx-license-2.0.schema.json @@ -104,7 +104,7 @@ "type": "array", "items": { "type": "object", - "description": "This document specifies the details and attributes related to a software license identifier. An SPDX expression may be a compound of license identifiers.\nThe `license_identifier` property serves as the key that identifies each record. Note that this key is not required to be unique, as the same license identifier could apply to multiple, different but similar license details, texts, etc.", + "description": "This specifies the details and attributes related to a software license identifier. An SPDX expression may be a compound of license identifiers.\nThe `license_identifier` property serves as the key that identifies each record. Note that this key is not required to be unique, as the same license identifier could apply to multiple, different but similar license details, texts, etc.", "required": [ "licenseIdentifier" ],