Skip to content

refactor: license expression as defined object #1022

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
jkowalleck wants to merge 2 commits into
base: 2.0-dev
Choose a base branch
from
Open

refactor: license expression as defined object #1022

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
7fbe08e
refactor: license expression as defined object
jkowalleck Aug 14, 2026
06c67b1
docs
jkowalleck Aug 14, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
157 changes: 79 additions & 78 deletions schema/2.0/model/cyclonedx-license-2.0.schema.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,84 +24,7 @@
}
}
},
{
"title": "License Expression",
"description": "Specifies the details and attributes related to a software license.\nIt must be a valid SPDX license expression, along with additional properties such as license acknowledgment.",
"type": "object",
"additionalProperties": false,
"required": [
"expression"
],
"properties": {
"expression": {
"type": "string",
"title": "SPDX License Expression",
"description": "A valid SPDX license expression.\nRefer to https://spdx.org/specifications for syntax requirements.",
"examples": [
"Apache-2.0 AND (MIT OR GPL-2.0-only)",
"GPL-3.0-only WITH Classpath-exception-2.0"
]
},
"expressionDetails": {
"title": "Expression Details",
"description": "Details for parts of the `expression`.",
"type": "array",
"items": {
"type": "object",
"description": "This document specifies the details and attributes related to a software license identifier. An SPDX expression may be a compound of license identifiers.\nThe `license_identifier` property serves as the key that identifies each record. Note that this key is not required to be unique, as the same license identifier could apply to multiple, different but similar license details, texts, etc.",
"required": [
"licenseIdentifier"
],
"properties": {
"licenseIdentifier": {
"title": "License Identifier",
"description": "The valid SPDX license identifier. Refer to https://spdx.org/specifications for syntax requirements.\nThis property serves as the primary key, which uniquely identifies each record.",
"type": "string",
"examples": [
"Apache-2.0",
"GPL-3.0-only WITH Classpath-exception-2.0",
"LicenseRef-my-custom-license"
]
},
"bom-ref": {
"$ref": "cyclonedx-common-2.0.schema.json#/$defs/refType",
"title": "BOM Reference",
"description": "An identifier which can be used to reference the license elsewhere in the BOM. Every `bom-ref` must be unique within the BOM.\nValue SHOULD not start with the BOM-Link intro 'urn:cdx:' to avoid conflicts with BOM-Links."
},
"text": {
"title": "License texts",
"description": "A way to include the textual content of the license.",
"$ref": "cyclonedx-common-2.0.schema.json#/$defs/attachment"
},
"url": {
"type": "string",
"title": "License URL",
"description": "The URL to the license file. If specified, a 'license' externalReference should also be specified for completeness",
"examples": [
"https://www.apache.org/licenses/LICENSE-2.0.txt"
],
"format": "iri-reference"
}
},
"additionalProperties": false
}
},
"acknowledgement": {
"$ref": "#/$defs/licenseAcknowledgementEnumeration"
},
"bom-ref": {
"$ref": "cyclonedx-common-2.0.schema.json#/$defs/refType",
"title": "BOM Reference",
"description": "An identifier which can be used to reference the license elsewhere in the BOM. Every `bom-ref` must be unique within the BOM.\nValue SHOULD not start with the BOM-Link intro 'urn:cdx:' to avoid conflicts with BOM-Links."
},
"licensing": {
"$ref": "#/$defs/licensing"
},
"properties": {
"$ref": "cyclonedx-common-2.0.schema.json#/$defs/properties"
}
}
}
{ "$ref": "#/$defs/expression" }
]
}
},
Expand Down Expand Up @@ -157,6 +80,84 @@
}
}
},
"expression": {
"title": "License Expression",
"description": "Specifies the details and attributes related to a software license.\nIt must be a valid SPDX license expression.",
"type": "object",
"additionalProperties": false,
"required": [
"expression"
],
"properties": {
"expression": {
"type": "string",
"title": "SPDX License Expression",
"description": "A valid SPDX license expression.\nRefer to https://spdx.org/specifications for syntax requirements.",
"examples": [
"Apache-2.0 AND (MIT OR GPL-2.0-only)",
"GPL-3.0-only WITH Classpath-exception-2.0"
]
},
"expressionDetails": {
"title": "Expression Details",
"description": "Details for parts of the `expression`.",
"type": "array",
"items": {
"type": "object",
"description": "This specifies the details and attributes related to a software license identifier. An SPDX expression may be a compound of license identifiers.\nThe `license_identifier` property serves as the key that identifies each record. Note that this key is not required to be unique, as the same license identifier could apply to multiple, different but similar license details, texts, etc.",
"required": [
"licenseIdentifier"
],
"properties": {
"licenseIdentifier": {
"title": "License Identifier",
"description": "The valid SPDX license identifier. Refer to https://spdx.org/specifications for syntax requirements.\nThis property serves as the primary key, which uniquely identifies each record.",
"type": "string",
"examples": [
"Apache-2.0",
"GPL-3.0-only WITH Classpath-exception-2.0",
"LicenseRef-my-custom-license"
]
},
"bom-ref": {
"$ref": "cyclonedx-common-2.0.schema.json#/$defs/refType",
"title": "BOM Reference",
"description": "An identifier which can be used to reference the license elsewhere in the BOM. Every `bom-ref` must be unique within the BOM.\nValue SHOULD not start with the BOM-Link intro 'urn:cdx:' to avoid conflicts with BOM-Links."
},
"text": {
"title": "License texts",
"description": "A way to include the textual content of the license.",
"$ref": "cyclonedx-common-2.0.schema.json#/$defs/attachment"
},
"url": {
"type": "string",
"title": "License URL",
"description": "The URL to the license file. If specified, a 'license' externalReference should also be specified for completeness",
"examples": [
"https://www.apache.org/licenses/LICENSE-2.0.txt"
],
"format": "iri-reference"
}
},
"additionalProperties": false
}
},
"acknowledgement": {
"$ref": "#/$defs/licenseAcknowledgementEnumeration"
},
"bom-ref": {
"$ref": "cyclonedx-common-2.0.schema.json#/$defs/refType",
"title": "BOM Reference",
"description": "An identifier which can be used to reference the license elsewhere in the BOM. Every `bom-ref` must be unique within the BOM.\nValue SHOULD not start with the BOM-Link intro 'urn:cdx:' to avoid conflicts with BOM-Links."
},
"licensing": {
"$ref": "#/$defs/licensing"
},
"properties": {
"$ref": "cyclonedx-common-2.0.schema.json#/$defs/properties"
}
}
},
"licenseAcknowledgementEnumeration": {
"title": "License Acknowledgement",
"description": "Declared licenses and concluded licenses represent two different stages in the licensing process within software development. Declared licenses refer to the initial intention of the software authors regarding the licensing terms under which their code is released. On the other hand, concluded licenses are the result of a comprehensive analysis of the project's codebase to identify and confirm the actual licenses of the components used, which may differ from the initially declared licenses. While declared licenses provide an upfront indication of the licensing intentions, concluded licenses offer a more thorough understanding of the actual licensing within a project, facilitating proper compliance and risk management. Observed licenses are defined in `@.evidence.licenses`. Observed licenses form the evidence necessary to substantiate a concluded license.",
Expand Down
Loading