Specifies an AI package and its associated information.
The second-highest level of risk posed by an AI system.
Low/no risk is posed by the AI system.
The third-highest level of risk posed by an AI system.
The highest level of risk posed by an AI system.
Class that describes a build instance of software/artifacts.
An assertion made in relation to one or more elements.
Used to store extra information about an Element which is not part of a Review (e.g. extra information provided during the creation of the Element).
Used when someone reviews the Element.
An identifier for a specific software flaw defined within the official CVE Dictionary and that conforms to the CVE specification as defined by https://csrc.nist.gov/glossary/term/cve_id.
https://www.iana.org/assignments/uri-schemes/prov/gitoid Gitoid stands for [Git Object ID](https://git-scm.com/book/en/v2/Git-Internals-Git-Objects) and a gitoid of type blob is a unique hash of a binary artifact. A gitoid may represent the software [Artifact ID](https://github.com/omnibor/spec/blob/main/spec/SPEC.md#artifact-id) or the [OmniBOR Identifier](https://github.com/omnibor/spec/blob/main/spec/SPEC.md#omnibor-identifier) for the software artifact's associated [OmniBOR Document](https://github.com/omnibor/spec/blob/main/spec/SPEC.md#omnibor-document); this ambiguity exists because the OmniBOR Document is itself an artifact, and the gitoid of that artifact is its valid identifier. Omnibor is a minimalistic schema to describe software [Artifact Dependency Graphs](https://github.com/omnibor/spec/blob/main/spec/SPEC.md#artifact-dependency-graph-adg). Gitoids calculated on software artifacts (Snippet, File, or Package Elements) should be recorded in the SPDX 3.0 SoftwareArtifact's ContentIdentifier property. Gitoids calculated on the OmniBOR Document (OmniBOR Identifiers) should be recorded in the SPDX 3.0 Element's ExternalIdentifier property.
Used when the type doesn't match any of the other options.
Used when there is a security related identifier of unspecified type.
SoftWare Hash IDentifier, persistent intrinsic identifiers for digital artifacts, such as files, trees (also known as directories or folders), commits, and other objects typically found in version control systems. The syntax of the identifiers is defined in the [SWHID specification](https://www.swhid.org/specification/v1.1/4.Syntax) and they typically look like `swh:1:cnt:94a9ed024d3859793618152ea559a168bbcbb5e2`.
the scheme used in order to locate a resource https://www.iana.org/assignments/uri-schemes/uri-schemes.xhtml
A reference to an alternative download location.
A reference to an alternative web page.
A reference to binary artifacts related to a package.
A reference to a bower package.
A reference build metadata related to a published package.
A reference build system used to create or publish the package.
A reference to a certification report for a package from an accredited/independent body.
A reference to the instant messaging system used by the maintainer for a package.
A reference to a Software Composition Analysis (SCA) report.
A reference to the documentation for a package.
A reference to a dynamic analysis report for a package.
A reference to the End Of Sale (EOS) and/or End Of Life (EOL) information related to a package.
A reference to a export control assessment for a package.
A reference to funding information related to a package.
A reference to the issue tracker for a package.
A reference to additional license information related to an artifact.
A reference to the mailing list used by the maintainer for a package.
A reference to a maven repository artifact.
A reference to metrics related to package such as OpenSSF scorecards.
A reference to an npm package.
A reference to a nuget package.
A reference to a privacy assessment for a package.
A reference to additional product metadata such as reference within organization's product catalog.
A reference to a purchase order for a package.
A reference to a quality assessment for a package.
A reference to a published list of releases for a package.
A reference to the release notes for a package.
A reference to a risk assessment for a package.
A reference to a runtime analysis report for a package.
A reference to information assuring that the software is developed using security practices as defined by [NIST SP 800-218 Secure Software Development Framework (SSDF)](https://csrc.nist.gov/publications/detail/sp/800-218/final) or [CISA Secure Software Development Attestation Form](https://www.cisa.gov/sites/default/files/2023-04/secure-software-self-attestation_common-form_508.pdf).
A reference to the security adversary model for a package.
A reference to a published security advisory (where advisory as defined per ISO 29147:2018) that may affect one or more elements, e.g., vendor advisories or specific NVD entries.
A reference to the patch or source code that fixes a vulnerability.
A reference to related security information of unspecified type.
A reference to a [penetration test](https://en.wikipedia.org/wiki/Penetration_test) report for a package.
A reference to instructions for reporting newly discovered security vulnerabilities for a package.
A reference the [security threat model](https://en.wikipedia.org/wiki/Threat_model) for a package.
A reference to a social media channel for a package.
A reference to an artifact containing the sources for a package.
A reference to a static analysis report for a package.
A reference to the software support channel or other support information for a package.
A reference to a version control system related to a software artifact.
A reference to a Vulnerability Disclosure Report (VDR) which provides the software supplier's analysis and findings describing the impact (or lack of impact) that reported vulnerabilities have on packages or products in the supplier's SBOM as defined in [NIST SP 800-161](https://csrc.nist.gov/publications/detail/sp/800-161/rev-1/final).
A reference to a Vulnerability Exploitability eXchange (VEX) statement which provides information on whether a product is impacted by a specific vulnerability in an included package and, if affected, whether there are actions recommended to remediate. See also [NTIA VEX one-page](https://ntia.gov/files/ntia/publications/vex_one-page_summary.pdf).
blake2b algorithm with a digest size of 256 https://datatracker.ietf.org/doc/html/rfc7693#section-4
blake2b algorithm with a digest size of 384 https://datatracker.ietf.org/doc/html/rfc7693#section-4
blake2b algorithm with a digest size of 512 https://datatracker.ietf.org/doc/html/rfc7693#section-4
any hashing algorithm that does not exist in this list of entries
secure hashing algorithm with a digest length of 224 https://datatracker.ietf.org/doc/html/draft-ietf-pkix-sha224-01
secure hashing algorithm with a digest length of 256 https://www.rfc-editor.org/rfc/rfc4634
secure hashing algorithm with a digest length of 384 https://www.rfc-editor.org/rfc/rfc4634
sha3 with a digest length of 224 https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.202.pdf
sha3 with a digest length of 256 https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.202.pdf
sha3 with a digest length of 384 https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.202.pdf
sha3 with a digest length of 512 https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.202.pdf
secure hashing algorithm with a digest length of 512 https://www.rfc-editor.org/rfc/rfc4634
A relationship has specific context implications during an element's build phase, during development.
A relationship has specific context implications during an element's design.
A relationship has specific context implications during development phase of an element.
A relationship has other specific context information necessary to capture that the above set of enumerations does not handle.
A relationship has specific context implications during the execution phase of an element.
A relationship has specific context implications during an element's testing phase, during development.
Provide context for a relationship that occurs in the lifecycle.
A group of people who work together in an organized way for a shared purpose.
An SPDX version 2.X compatible verification method for software packages.
An individual human being.
Indicates absence of the field.
Makes no assertion about the field.
Indicates presence of the field.
the element follows the AI profile specification
the element follows the Build profile specification
the element follows the Core profile specification
the element follows the Dataset profile specification
the element follows the expanded Licensing profile specification
the element follows the Extension profile specification
the element follows the Security profile specification
the element follows the simple Licensing profile specification
the element follows the Software profile specification
the element follows the Usage profile specification
The relationship is known to be exhaustive.
The relationship is known not to be exhaustive.
No assertion can be made about the completeness of the relationship.
(Security/VEX) The `from` vulnerability affect each `to` Element
The `from` Element is amended by each `to` Element
The `from` Element is an ancestor of each `to` Element
The `from` Element is available from the additional supplier described by each `to` Element
The `from` Element is a configuration applied to each `to` Element during a LifecycleScopeType period
The `from` Element contains each `to` Element
(Security) The `from` Vulnerability is coordinatedBy the `to` Agent(s) (vendor, researcher, or consumer agent)
The `from` Element has been copied to each `to` Element
The `from` Agent is delegating an action to the Agent of the `to` Relationship (which must be of type invokedBy) during a LifecycleScopeType. (e.g. the `to` invokedBy Relationship is being done on behalf of `from`)
The `from` Element depends on each `to` Element during a LifecycleScopeType period.
The `from` Element is a descendant of each `to` Element
The `from` Element describes each `to` Element. To denote the root(s) of a tree of elements in a collection, the rootElement property should be used.
(Security/VEX) The `from` Vulnerability has no impact on each `to` Element
The `from` archive expands out as an artifact described by each `to` Element
(Security) The `from` Vulnerability has had an exploit created against it by each `to` Agent
(Security) Designates a `from` Vulnerability has been fixed by the `to` Agent(s)
(Security/VEX) A `from` Vulnerability has been fixed in each of the `to` Element(s)
(Security) Designates a `from` Vulnerability was originally discovered by the `to` Agent(s)
The `from` Element generates each `to` Element
Every `to` Element is is a file added to the `from` Element (`from` hasAddedFile `to`)
(Security) Relates a `from` Vulnerability and each `to` Element(s) with a security assessment. To be used with `VulnAssessmentRelationship` types
(Security) Used to associate a `from` Artifact with each `to` Vulnerability
The `from` Software Artifact is concluded by the SPDX data creator to be governed by each `to` license
The `from` Element treats each `to` Element as a data file
The `from` Software Artifact was discovered to actually contain each `to` license, for example as detected by use of automated tooling.
Every `to` Element is a file deleted from the `from` Element (`from` hasDeletedFile `to`)
The `from` Element has manifest files that contain dependency information in each `to` Element
The `from` Element is distributed as an artifact in each Element `to`, (e.g. an RPM or archive file)
The `from` Element is documented by each `to` Element
The `from` Element dynamically links in each `to` Element, during a LifecycleScopeType period.
(Dataset) Every `to` Element is considered as evidence for the `from` Element (`from` hasEvidence `to`)
Every `to` Element is an example for the `from` Element (`from` hasExample `to`)
The `from` Build was run on the `to` Element during a LifecycleScopeType period (e.g. The host that the build runs on)
The `from` Build has each `to` Elements as an input during a LifecycleScopeType period.
Every `to` Element is metadata about the `from` Element (`from` hasMetadata `to`)
Every `to` Element is an optional component of the `from` Element (`from` hasOptionalComponent` `to`)
The `from` Element optionally depends on each `to` Element during a LifecycleScopeType period
The `from` Build element generates each `to` Element as an output during a LifecycleScopeType period.
The `from` Element has a prerequsite on each `to` Element, during a LifecycleScopeType period
The `from` Element has a dependency on each `to` Element, but dependency is not in the distributed artifact, but assumed to be provided, during a LifecycleScopeType period
The `from` Element has a requirement on each `to` Element, during a LifecycleScopeType period
Every `to` Element is a specification for the `from` Element (`from` hasSpecification `to`), during a LifecycleScopeType period
The `from` Element statically links in each `to` Element, during a LifecycleScopeType period
Every `to` Element is a test artifact for the `from` Element (`from` hasTest `to`), during a LifecycleScopeType period
Every `to` Element is a test case for the `from` Element (`from` hasTestCase `to`)
Every `to` Element is a variant the `from` Element (`from` hasVariant `to`)
The `from` Element was invoked by the `to` Agent during a LifecycleScopeType period (for example, a Build element that describes a build step)
The `from` Element is modified by each `to` Element
Every `to` Element is related to the `from` Element where the relationship type is not described by any of the SPDX relationhip types (this relationship is directionless)
Every `to` Element is a packaged instance of the `from` Element (`from` packagedBy `to`)
Every `to` Element is a patch for the `from` Element (`from` patchedBy `to`)
(Security) Designates a `from` Vulnerability was made available for public use or reference by each `to` Agent
(Security) Designates a `from` Vulnerability was first reported to a project, vendor, or tracking database for formal identification by each `to` Agent
(Security) Designates a `from` Vulnerability's details were tracked, aggregated, and/or enriched to improve context (i.e. NVD) by a `to` Agent(s)
The `from` SPDXDocument can be found in a serialized form in each `to` Artifact
(AI, Dataset) The `from` Element has been tested on the `to` Element
(AI, Dataset) The `from` Element has been trained by the `to` Element(s)
(Security/VEX) The `from` Vulnerability impact is being investigated for each `to` Element
The `from` Element uses each `to` Element as a tool during a LifecycleScopeType period.
A software agent.
A collection of SPDX Elements that could potentially be serialized.
in addition to being supported by the supplier, the software is known to have been deployed and is in use. For a software as a service provider, this implies the software is now available as a service.
the artifact is in active development and is not considered ready for formal support from the supplier.
there is a defined end of support for the artifact from the supplier. This may also be referred to as end of life. There is a validUntilDate that can be used to signal when support ends for the artifact.
the artifact has been released, and there is limited support available from the supplier. There is a validUntilDate that can provide additional information about the duration of support.
no assertion about the type of support is made. This is considered the default if no other support type is used.
there is no support for the artifact from the supplier, consumer assumes any support obligations.
the artifact has been released, and is supported from the supplier. There is a validUntilDate that can provide additional information about the duration of support.
Data points in the dataset can be shared only with specific organizations and their clients on a need to know basis.
Dataset may be distributed freely, without restriction.
Dataset can be shared within a community of peers and partners.
Data points in the dataset are highly confidential and can only be shared with named recipients.
the dataset is not publicly available and can only be accessed after affirmatively accepting terms on a clickthrough webpage.
the dataset is publicly available and can be downloaded directly.
the dataset is publicly available, but not all at once, and can only be accessed through queries which return parts of the dataset.
the dataset is not publicly available and an email registration is required before accessing the dataset, although without an affirmative acceptance of terms.
the dataset provider is not making available the underlying data and the dataset must be reassembled, typically using the provided script for scraping the data.
Specifies a data package and its associated information.
data is audio based, such as a collection of music from the 80s.
data that is classified into a discrete number of categories, such as the eye color of a population of people.
data is in the form of a graph where entries are somehow related to each other through edges, such a social network of friends.
data is a collection of images such as pictures of animals.
data type is not known.
data consists only of numeric entries.
data is of a type not included in this list.
data is recorded from a physical sensor, such as a thermometer reading or biometric device.
data is stored in tabular format or retrieved from a relational database.
data describes the syntax or semantics of a language or text, such as a parse tree used for natural language processing.
data consists of unstructured text, such as a book, wikipedia article (without images), or transcript.
data is recorded in an ordered sequence of timestamped entries, such as the price of a stock over the course of a day.
data is recorded with a timestamp for each entry, but not necessarily ordered or at specific intervals, such as when a taxi ride starts and ends.
data is video based, such as a collection of movie clips featuring Tom Hanks.
Portion of an AnyLicenseInfo representing a set of licensing information where all elements apply.
A license that is not listed on the SPDX License List.
A license addition that is not listed on the SPDX Exceptions List.
Portion of an AnyLicenseInfo representing a set of licensing information where only one of the elements applies.
A license that is listed on the SPDX License List.
A license exception that is listed on the SPDX Exceptions list.
An Individual Value for License when no assertion can be made about its actual value.
An Individual Value for License where the SPDX data creator determines that no license is present.
Portion of an AnyLicenseInfo representing this version, or any later version, of the indicated License.
Portion of an AnyLicenseInfo representing a License which has additional text applied to it.
When a CVSS score is between 9.0 - 10.0
When a CVSS score is between 7.0 - 8.9
When a CVSS score is between 0 - 3.9
When a CVSS score is between 4 - 6.9
When a CVSS score is 0
Provides a CVSS version 2.0 assessment for a vulnerability.
Provides a CVSS version 3 assessment for a vulnerability.
Provides a CVSS version 4 assessment for a vulnerability.
Provides an EPSS assessment for a vulnerability.
CISA's Known Exploited Vulnerability (KEV) Catalog
Other exploit catalogs
Provides an exploit assessment of a vulnerability.
The vulnerability requires attention from the organization's internal, supervisory-level and leadership-level individuals. Necessary actions include requesting assistance or information about the vulnerability, as well as publishing a notification either internally and/or externally. Typically, internal groups would meet to determine the overall response and then execute agreed upon actions. CISA recommends remediating Act vulnerabilities as soon as possible.
The vulnerability requires attention from the organization's internal, supervisory-level individuals. Necessary actions include requesting assistance or information about the vulnerability, and may involve publishing a notification either internally and/or externally. CISA recommends remediating Attend vulnerabilities sooner than standard update timelines.
The vulnerability does not require action at this time. The organization would continue to track the vulnerability and reassess it if new information becomes available. CISA recommends remediating Track vulnerabilities within standard update timelines.
(Track* in the SSVC spec) The vulnerability contains specific characteristics that may require closer monitoring for changes. CISA recommends remediating Track* vulnerabilities within standard update timelines.
Provides an SSVC assessment for a vulnerability.
Connects a vulnerability and an element designating the element as a product affected by the vulnerability.
Links a vulnerability and elements representing products (in the VEX sense) where a fix has been applied and are no longer affected.
The software is not affected because the vulnerable component is not in the product.
Built-in inline controls or mitigations prevent an adversary from leveraging the vulnerability.
The vulnerable component is present, and the component contains the vulnerable code. However, vulnerable code is used in such a way that an attacker cannot mount any anticipated attack.
The affected code is not reachable through the execution of the code, including non-anticipated states of the product.
The product is not affected because the code underlying the vulnerability is not present in the product.
Links a vulnerability and one or more elements designating the latter as products not affected by the vulnerability.
Designates elements as products where the impact of a vulnerability is being investigated.
Specifies a vulnerability and its associated information.
An SPDX Element containing an SPDX license expression string.
A license or addition that is not listed on the SPDX License List.
The file represents a directory and all content stored in that directory.
The file represents a single file (default).
A collection of SPDX Elements describing a single package.
SBOM generated through analysis of artifacts (e.g., executables, packages, containers, and virtual machine images) after its build. Such analysis generally requires a variety of heuristics. In some contexts, this may also be referred to as a “3rd party” SBOM.
SBOM generated as part of the process of building the software to create a releasable artifact (e.g., executable or package) from data such as source files, dependencies, built components, build process ephemeral data, and other SBOMs.
SBOM provides an inventory of software that is present on a system. This may be an assembly of other SBOMs that combines analysis of configuration options, and examination of execution behavior in a (potentially simulated) deployment environment.
SBOM of intended, planned software project or product with included components (some of which may not yet exist) for a new software artifact.
SBOM generated through instrumenting the system running the software, to capture only components present in the system, as well as external call-outs or dynamically loaded components. In some contexts, this may also be referred to as an “Instrumented” or “Dynamic” SBOM.
SBOM created directly from the development environment, source files, and included dependencies used to build an product artifact.
Describes a certain part of a file.
the Element is a software application
the Element is an archived collection of one or more files (.tar, .zip, etc)
Element is a bill of materials
Element is configuration data
the Element is a container image which can be used by a container runtime application
Element is data
the Element refers to a chipset, processor, or electronic board
Element represents software that controls hardware devices
the Element refers to a disk image that can be written to a disk, booted in a VM, etc. A disk image typically contains most or all of the components necessary to boot, such as bootloaders, kernels, firmware, userspace, etc.
Element is documentation
the Element is the evidence that a specification or requirement has been fulfilled
Element is an Artifact that can be run on a computer
the Element is a single file which can be independently distributed (configuration file, statically linked binary, Kubernetes deployment, etc)
the Element is a file system image that can be written to a disk (or virtual) partition
the Element provides low level control over a device's hardware
the Element is a software framework
the Element is used to install software on disk
the Element is a software library
the Element is a software manifest
the Element is a machine learning or artificial intelligence model
the Element is a module of a piece of software
the Element is an operating system
the Element doesn't fit into any of the other categories
Element contains a set of changes to update, fix, or improve another Element
Element represents a runtime environment
the Element provides a requirement needed as input for another Element
the Element is a single or a collection of source files
the Element is a plan, guideline or strategy how to create, perform or analyse an application
The Element is a test used to verify functionality on an software element
States if a human is involved in the decisions of the AI software.
Captures the domain in which the AI package can be used.
Indicates the amount of energy consumed to train the AI model.
Records a hyperparameter used to build the AI model contained in the AI package.
Provides relevant information about the AI software, not including the model description.
Describes relevant information about different steps of the training process.
Captures a limitation of the AI software.
Records the measurement of prediction quality of the AI model.
Captures the threshold that was used for computation of a metric described in the metric field.
Describes all the preprocessing steps applied to the training data before the model training.
Describes methods that can be used to explain the model.
Categorizes general safety risk assessment of the AI system.
Captures a standard that is being complied with.
Records the type of the model used in the AI software.
Records if sensitive personal information is used during model training or could be used during the inference.
Property that describes the time at which a build stops.
A buildId is a locally unique identifier used by a builder to identify a unique instance of a build produced by it.
Property describing the start time of a build.
A buildType is a hint that is used to indicate the toolchain, platform, or infrastructure that the build was invoked on.
Property that describes the digest of the build configuration file used to invoke a build.
Property describes the invocation entrypoint of a build.
Property that describes the URI of the build configuration source file.
Property describing the session in which a build is invoked.
Property describing the parameters used in an instance of a build.
A container for a grouping of SPDX-3.0 content characterizing details (provenence, composition, licensing, etc.) about a product.
A collection of Elements that have a shared context.
Specifies the algorithm used for calculating the hash value.
Describes the type of annotation.
Defines the beginning of a range.
Specifies the time an artifact was built.
Provides information about the completeness of relationships.
Gives information about the circumstances or unifying properties that Elements of the bundle have been assembled under.
Identifies when the Element was originally created.
Identifies who or what created the Element.
Identifies the tooling that was used during the creation of the Element.
Provides information about the creation of the Element.
Provides the license under which the SPDX documentation of the Element can be used.
Artifact representing a serialization instance of SPDX data containing the definition of a particular Element.
Provides a detailed description of the Element.
Refers to one or more Elements that are part of an ElementCollection.
Defines the end of a range.
Specifies the time from which an element is no longer applicable / valid.
Specifies an Extension characterization of some aspect of an Element.
Provides a reference to a resource outside the scope of SPDX-3.0 content that uniquely identifies an Element.
Specifies the type of the external identifier.
Points to a resource outside the scope of the SPDX-3.0 content that provides additional characteristics of an Element.
Specifies the type of the external reference.
Identifies an external Element used within a Document but defined external to that Document.
References the Element on the left-hand side of a relationship.
Uniquely identifies an external element.
Provides the location for more information regarding an external identifier.
Provides an ExternalMap of Element identifiers.
An entity that is authorized to issue identification credentials.
A key used in a generic key-value pair.
Provides an indication of where to retrieve an external Element.
Provides the location of an external reference.
Identifies the name of an Element as designated by the creator.
Provides an unambiguous mechanism for conveying a URI fragment portion of an ElementID.
Provides a NamespaceMap of prefixes and associated namespace partial URIs applicable to an SpdxDocument and independent of any specific serialization format or instance.
Identifies from where or whom the Element originally came.
The relative file name of a file to be excluded from the `PackageVerificationCode`.
A substitute for a URI.
Describes one a profile which the creator of this ElementCollection intends to conform to.
Information about the relationship between two Elements.
Specifies the time an artifact was released.
This property is used to denote the root Element(s) of a tree of elements contained in an SBOM.
Capture the scope of information about a specific relationship between elements.
Provides a reference number that can be used to understand how to parse and interpret an Element.
The name of a relevant standard that may apply to an artifact.
Specifies the time from which an element is applicable / valid.
Commentary on an assertion that an annotator has made.
An Element an annotator has made an assertion about.
A short description of an Element.
Specifies the level of support associated with an artifact.
References an Element on the right-hand side of a relationship.
Specifies until when the artifact can be used before its usage needs to be reassessed.
A value used in a generic key-value pair.
Describes the anonymization methods used.
Describes the confidentiality level of the data points contained in the dataset.
Describes how the dataset was collected.
Describes the preprocessing steps that were applied to the raw data to create the given dataset.
The field describes the availability of a dataset.
Describes potentially noisy elements of the dataset.
Captures the size of the dataset.
Describes the type of the given dataset.
Describes a mechanism to update the dataset.
Describes if any sensitive personal information is present in the dataset.
Describes what the given dataset should be used for.
Records the biases that the dataset is known to encompass.
Describes a sensor used for collecting the data.
Identifies the full text of a LicenseAddition.
Specifies whether an additional text identifier has been marked as deprecated.
Specifies whether a license or additional text identifier has been marked as deprecated.
Specifies whether the License is listed as free by the [Free Software Foundation (FSF)](https://fsf.org).
Specifies whether the License is listed as approved by the [Open Source Initiative (OSI)](https://opensource.org).
Identifies the full text of a LicenseAddition, in SPDX templating format.
Provides a License author's preferred text to indicate that a file is covered by the License.
Identifies the full text of a License, in SPDX templating format.
A LicenseAddition participating in a 'with addition' model.
A License participating in a 'with addition' model.
A License participating in an 'or later' model.
Provides advise on how to mitigate or remediate a vulnerability when a VEX product is affected by it.
Records the time when a recommended action was communicated in a VEX statement to mitigate a vulnerability.
Specifies an element contained in a piece of software where a vulnerability was found.
Specifies the exploit catalog type.
Provide the enumeration of possible decisions in the Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree [https://www.cisa.gov/sites/default/files/publications/cisa-ssvc-guide%20508c.pdf](https://www.cisa.gov/sites/default/files/publications/cisa-ssvc-guide%20508c.pdf)
Describe that a CVE is known to have an exploit because it's been listed in an exploit catalog.
Explains why a VEX product is not affected by a vulnerability. It is an alternative in VexNotAffectedVulnAssessmentRelationship to the machine-readable justification label.
Timestamp of impact statement.
Impact justification label to be used when linking a vulnerability to an element representing a VEX product with a VexNotAffectedVulnAssessmentRelationship relationship.
Provides the location of an exploit catalog.
The percentile of the current probability score.
A probability score between 0 and 1 of a vulnerability being exploited.
Conveys information about how VEX status was determined.
Specifies the version of the VEX document.
Maps a LicenseRef or AdditionRef string for a Custom License or a Custom License Addition to its URI ID.
A string in the license expression format.
The version of the SPDX License List used in the license expression.
Provides additional purpose information of the software artifact.
Provides a place for the SPDX data creator to record acknowledgement text for a software Package, File or Snippet.
Defines the byte range in the original host file that the snippet information applies to.
Provides information about the content type of an Element.
Identifies the text of one or more copyright notices for a software Package, File or Snippet, if any.
Identifies the download Uniform Resource Identifier for the package at the time that the document was created.
Describes if a given file is a directory or non-directory kind of file.
Used to record the artifact’s gitoid: a canonical, unique, immutable identifier that can be used for software integrity verification.
A place for the SPDX document creator to record a website that serves as the package's home page.
Defines the line range in the original host file that the snippet information applies to.
Provides a place for the SPDX data creator to record the package URL string (in accordance with the [package URL spec](https://github.com/package-url/purl-spec/blob/master/PURL-SPECIFICATION.rst)) for a software Package.
Identify the version of a package.
Provides information about the primary purpose of the software artifact.
Provides information about the type of an SBOM.
Defines the original host file that the snippet information applies to.
Records any relevant background information or additional comments about the origin of the package.
A collection of Elements, not necessarily with unifying context.
A reference to a resource outside the scope of SPDX-3.0 content that uniquely identifies an Element.
A map of Element identifiers that are used within a Document but defined external to that Document.
A reference to a resource outside the scope of SPDX-3.0 content.
A mathematically calculated representation of a grouping of data.
A mapping between prefixes and namespace partial URIs.
Describes a relationship between one or more elements.
An element of hardware and/or software utilized to carry out a particular function.
Specifies the media type of an Element or Property.
The result of applying a hash algorithm to an Element.
Identifies who or what supplied the artifact or VulnAssessmentRelationship referenced by the Element.
Provides an IntegrityMethod with which the integrity of an Element can be asserted.
A concrete subclass of AnyLicenseInfo used by Individuals in the ExpandedLicensing profile.
Specifies the SPDX License List version in which this license or exception identifier was deprecated.
Identifies all the text and metadata associated with a license in the license XML format.
Specifies the SPDX License List version in which this ListedLicense or ListedLicenseException identifier was first added.
A license expression participating in a license set.
Specifies the licenseId that is preferred to be used in place of a deprecated License or LicenseAddition.
Contains a URL where the License or LicenseAddition can be found in use.
A characterization of some aspect of an Element that is associated with the Element in a generalized fashion.
Specifies a time when a vulnerability assessment was modified
Specifies the CVSS qualitative severity rating of a vulnerability in relation to a piece of software.
Specified the time and date when a vulnerability was withdrawn.
Identifies the full text of a License or Addition.
Refers to any object that stores content on a computer.
Refers to any unit of content that can be associated with a distribution of software.
Specifies the time when a vulnerability was published.
Provides a numerical (0-10) representation of the severity of a vulnerability.
Specifies the CVSS vector string for a vulnerability.
A distinct article or unit related to Software.
Specifies the type of an annotation.
A distinct article or unit within the digital domain.
A tuple of two positive integers that define a range.
Abstract class representing a License or an OrLaterOperator.
Abstract class for the portion of an AnyLicenseInfo representing a license.
Abstract class for additional text intended to be added to a License, but which is not itself a standalone License.
Asbtract ancestor class for all VEX relationships
Enumeration of the different kinds of SPDX file.
Provides an independently reproducible mechanism that permits verification of a specific Element.
Indicates whether a relationship is known to be complete, incomplete, or if no assertion is made with respect to relationship completeness.
Provide consumers with comments by the creator of the Element about the Element.
Specifies the safety risk assessment type.
Categories of confidentiality level.
Specifies the SSVC decision type.
Availability of dataset
Specifies the VEX justification type.
Abstract ancestor class for all vulnerability assessments
Provide an enumerated set of lifecycle phases that can provide context to relationships.
Specifies the CVSS base, temporal, threat, or environmental severity type.
Provides a set of values to be used to describe the common types of SBOMs that tools may create.
Categories of presence or absence.
Indicates the type of support that is associated with an artifact.
Agent represents anything with the potential to act on a system.
Abstract class representing a license combination consisting of one or more licenses (optionally including additional text), which may be combined according to the SPDX license expression syntax.
Enumeration of the valid profiles.
Specifies the type of an external identifier.
A key with an associated value.
Enumeration of dataset types.
Base domain class from which all other SPDX-3.0 domain classes derive.
A mathematical algorithm that maps data of arbitrary size to a bit string.
Provides information about the primary purpose of an Element.
Specifies the type of an external reference.