AIPackage
type: Class
type: NodeShape
comment: Specifies an AI package and its associated information.
subclass of: Package
property:
  datatype: string
  max count: 1
  node kind: Literal
  path: informationAboutTraining
property:
  datatype: string
  node kind: Literal
  path: typeOfModel
property:
  datatype: string
  node kind: Literal
  path: standardCompliance
property:
  datatype: string
  max count: 1
  node kind: Literal
  path: informationAboutApplication
property:
  class: DictionaryEntry
  node kind: BlankNodeOrIRI
  path: metric
property:
  datatype: string
  node kind: Literal
  path: modelExplainability
property:
  class: PresenceType
  max count: 1
  node kind: IRI
  path: autonomyType
property:
  datatype: string
  max count: 1
  node kind: Literal
  path: energyConsumption
property:
  class: DictionaryEntry
  node kind: BlankNodeOrIRI
  path: hyperparameter
property:
  datatype: string
  max count: 1
  node kind: Literal
  path: limitation
property:
  class: PresenceType
  max count: 1
  node kind: IRI
  path: useSensitivePersonalInformation
property:
  datatype: string
  node kind: Literal
  path: domain
property:
  class: DictionaryEntry
  node kind: BlankNodeOrIRI
  path: metricDecisionThreshold
property:
  class: SafetyRiskAssessmentType
  max count: 1
  node kind: IRI
  path: safetyRiskAssessment
property:
  datatype: string
  node kind: Literal
  path: modelDataPreprocessing

high
type: NamedIndividual
type: SafetyRiskAssessmentType
comment: The second-highest level of risk posed by an AI system.

low
type: NamedIndividual
type: SafetyRiskAssessmentType
comment: Low/no risk is posed by the AI system.

medium
type: NamedIndividual
type: SafetyRiskAssessmentType
comment: The third-highest level of risk posed by an AI system.

serious
type: NamedIndividual
type: SafetyRiskAssessmentType
comment: The highest level of risk posed by an AI system.

Build
type: Class
type: NodeShape
comment: Class that describes a build instance of software/artifacts.
subclass of: Element
property:
  datatype: string
  node kind: Literal
  path: configSourceEntrypoint
property:
  class: Hash
  node kind: BlankNodeOrIRI
  path: configSourceDigest
property:
  class: DictionaryEntry
  node kind: BlankNodeOrIRI
  path: environment
property:
  datatype: anyURI
  node kind: Literal
  path: configSourceUri
property:
  datatype: string
  max count: 1
  node kind: Literal
  path: buildId
property:
  datatype: anyURI
  max count: 1
  min count: 1
  node kind: Literal
  path: buildType
property:
  datatype: dateTimeStamp
  max count: 1
  node kind: Literal
  path: buildEndTime
  pattern: ^\d\d\d\d-\d\d-\d\dT\d\d:\d\d:\d\dZ$
property:
  class: DictionaryEntry
  node kind: BlankNodeOrIRI
  path: parameters
property:
  datatype: dateTimeStamp
  max count: 1
  node kind: Literal
  path: buildStartTime
  pattern: ^\d\d\d\d-\d\d-\d\dT\d\d:\d\d:\d\dZ$

Annotation
type: Class
type: NodeShape
comment: An assertion made in relation to one or more elements.
subclass of: Element
property:
  class: Element
  max count: 1
  min count: 1
  node kind: BlankNodeOrIRI
  path: subject
property:
  class: AnnotationType
  max count: 1
  min count: 1
  node kind: IRI
  path: annotationType
property:
  datatype: string
  max count: 1
  node kind: Literal
  path: statement
property:
  datatype: string
  max count: 1
  node kind: Literal
  path: contentType
  pattern: ^[^\/]+\/[^\/]+$

other
type: NamedIndividual
type: AnnotationType
comment: Used to store extra information about an Element which is not part of a Review (e.g. extra information provided during the creation of the Element).

review
type: NamedIndividual
type: AnnotationType
comment: Used when someone reviews the Element.

cpe22
type: NamedIndividual
type: ExternalIdentifierType
comment: https://cpe.mitre.org/files/cpe-specification_2.2.pdf

cpe23
type: NamedIndividual
type: ExternalIdentifierType
comment: https://nvlpubs.nist.gov/nistpubs/Legacy/IR/nistir7695.pdf

cve
type: NamedIndividual
type: ExternalIdentifierType
comment: An identifier for a specific software flaw defined within the official CVE Dictionary and that conforms to the CVE specification as defined by https://csrc.nist.gov/glossary/term/cve_id.

email
type: NamedIndividual
type: ExternalIdentifierType
comment: https://datatracker.ietf.org/doc/html/rfc3696#section-3

gitoid
type: NamedIndividual
type: ExternalIdentifierType
comment: https://www.iana.org/assignments/uri-schemes/prov/gitoid Gitoid stands for [Git Object ID](https://git-scm.com/book/en/v2/Git-Internals-Git-Objects) and a gitoid of type blob is a unique hash of a binary artifact. A gitoid may represent the software [Artifact ID](https://github.com/omnibor/spec/blob/main/spec/SPEC.md#artifact-id) or the [OmniBOR Identifier](https://github.com/omnibor/spec/blob/main/spec/SPEC.md#omnibor-identifier) for the software artifact's associated [OmniBOR Document](https://github.com/omnibor/spec/blob/main/spec/SPEC.md#omnibor-document); this ambiguity exists because the OmniBOR Document is itself an artifact, and the gitoid of that artifact is its valid identifier. Omnibor is a minimalistic schema to describe software [Artifact Dependency Graphs](https://github.com/omnibor/spec/blob/main/spec/SPEC.md#artifact-dependency-graph-adg). Gitoids calculated on software artifacts (Snippet, File, or Package Elements) should be recorded in the SPDX 3.0 SoftwareArtifact's ContentIdentifier property. Gitoids calculated on the OmniBOR Document (OmniBOR Identifiers) should be recorded in the SPDX 3.0 Element's ExternalIdentifier property.

other
type: NamedIndividual
type: ExternalIdentifierType
comment: Used when the type doesn't match any of the other options.

packageUrl
type: NamedIndividual
type: ExternalIdentifierType
comment: https://github.com/package-url/purl-spec

securityOther
type: NamedIndividual
type: ExternalIdentifierType
comment: Used when there is a security related identifier of unspecified type.

swhid
type: NamedIndividual
type: ExternalIdentifierType
comment: SoftWare Hash IDentifier, persistent intrinsic identifiers for digital artifacts, such as files, trees (also known as directories or folders), commits, and other objects typically found in version control systems. The syntax of the identifiers is defined in the [SWHID specification](https://www.swhid.org/specification/v1.1/4.Syntax) and they typically look like `swh:1:cnt:94a9ed024d3859793618152ea559a168bbcbb5e2`.

swid
type: NamedIndividual
type: ExternalIdentifierType
comment: https://www.ietf.org/archive/id/draft-ietf-sacm-coswid-21.html#section-2.3

urlScheme
type: NamedIndividual
type: ExternalIdentifierType
comment: the scheme used in order to locate a resource https://www.iana.org/assignments/uri-schemes/uri-schemes.xhtml

altDownloadLocation
type: NamedIndividual
type: ExternalRefType
comment: A reference to an alternative download location.

altWebPage
type: NamedIndividual
type: ExternalRefType
comment: A reference to an alternative web page.

binaryArtifact
type: NamedIndividual
type: ExternalRefType
comment: A reference to binary artifacts related to a package.

bower
type: NamedIndividual
type: ExternalRefType
comment: A reference to a bower package.

buildMeta
type: NamedIndividual
type: ExternalRefType
comment: A reference build metadata related to a published package.

buildSystem
type: NamedIndividual
type: ExternalRefType
comment: A reference build system used to create or publish the package.

certificationReport
type: NamedIndividual
type: ExternalRefType
comment: A reference to a certification report for a package from an accredited/independent body.

chat
type: NamedIndividual
type: ExternalRefType
comment: A reference to the instant messaging system used by the maintainer for a package.

componentAnalysisReport
type: NamedIndividual
type: ExternalRefType
comment: A reference to a Software Composition Analysis (SCA) report.

documentation
type: NamedIndividual
type: ExternalRefType
comment: A reference to the documentation for a package.

dynamicAnalysisReport
type: NamedIndividual
type: ExternalRefType
comment: A reference to a dynamic analysis report for a package.

eolNotice
type: NamedIndividual
type: ExternalRefType
comment: A reference to the End Of Sale (EOS) and/or End Of Life (EOL) information related to a package.

exportControlAssessment
type: NamedIndividual
type: ExternalRefType
comment: A reference to a export control assessment for a package.

funding
type: NamedIndividual
type: ExternalRefType
comment: A reference to funding information related to a package.

issueTracker
type: NamedIndividual
type: ExternalRefType
comment: A reference to the issue tracker for a package.

license
type: NamedIndividual
type: ExternalRefType
comment: A reference to additional license information related to an artifact.

mailingList
type: NamedIndividual
type: ExternalRefType
comment: A reference to the mailing list used by the maintainer for a package.

mavenCentral
type: NamedIndividual
type: ExternalRefType
comment: A reference to a maven repository artifact.

metrics
type: NamedIndividual
type: ExternalRefType
comment: A reference to metrics related to package such as OpenSSF scorecards.

npm
type: NamedIndividual
type: ExternalRefType
comment: A reference to an npm package.

nuget
type: NamedIndividual
type: ExternalRefType
comment: A reference to a nuget package.

other
type: NamedIndividual
type: ExternalRefType
comment: Used when the type doesn't match any of the other options.

privacyAssessment
type: NamedIndividual
type: ExternalRefType
comment: A reference to a privacy assessment for a package.

productMetadata
type: NamedIndividual
type: ExternalRefType
comment: A reference to additional product metadata such as reference within organization's product catalog.

purchaseOrder
type: NamedIndividual
type: ExternalRefType
comment: A reference to a purchase order for a package.

qualityAssessmentReport
type: NamedIndividual
type: ExternalRefType
comment: A reference to a quality assessment for a package.

releaseHistory
type: NamedIndividual
type: ExternalRefType
comment: A reference to a published list of releases for a package.

releaseNotes
type: NamedIndividual
type: ExternalRefType
comment: A reference to the release notes for a package.

riskAssessment
type: NamedIndividual
type: ExternalRefType
comment: A reference to a risk assessment for a package.

runtimeAnalysisReport
type: NamedIndividual
type: ExternalRefType
comment: A reference to a runtime analysis report for a package.

secureSoftwareAttestation
type: NamedIndividual
type: ExternalRefType
comment: A reference to information assuring that the software is developed using security practices as defined by [NIST SP 800-218 Secure Software Development Framework (SSDF)](https://csrc.nist.gov/publications/detail/sp/800-218/final) or [CISA Secure Software Development Attestation Form](https://www.cisa.gov/sites/default/files/2023-04/secure-software-self-attestation_common-form_508.pdf).

securityAdversaryModel
type: NamedIndividual
type: ExternalRefType
comment: A reference to the security adversary model for a package.

securityAdvisory
type: NamedIndividual
type: ExternalRefType
comment: A reference to a published security advisory (where advisory as defined per ISO 29147:2018) that may affect one or more elements, e.g., vendor advisories or specific NVD entries.

securityFix
type: NamedIndividual
type: ExternalRefType
comment: A reference to the patch or source code that fixes a vulnerability.

securityOther
type: NamedIndividual
type: ExternalRefType
comment: A reference to related security information of unspecified type.

securityPenTestReport
type: NamedIndividual
type: ExternalRefType
comment: A reference to a [penetration test](https://en.wikipedia.org/wiki/Penetration_test) report for a package.

securityPolicy
type: NamedIndividual
type: ExternalRefType
comment: A reference to instructions for reporting newly discovered security vulnerabilities for a package.

securityThreatModel
type: NamedIndividual
type: ExternalRefType
comment: A reference the [security threat model](https://en.wikipedia.org/wiki/Threat_model) for a package.

socialMedia
type: NamedIndividual
type: ExternalRefType
comment: A reference to a social media channel for a package.

sourceArtifact
type: NamedIndividual
type: ExternalRefType
comment: A reference to an artifact containing the sources for a package.

staticAnalysisReport
type: NamedIndividual
type: ExternalRefType
comment: A reference to a static analysis report for a package.

support
type: NamedIndividual
type: ExternalRefType
comment: A reference to the software support channel or other support information for a package.

vcs
type: NamedIndividual
type: ExternalRefType
comment: A reference to a version control system related to a software artifact.

vulnerabilityDisclosureReport
type: NamedIndividual
type: ExternalRefType
comment: A reference to a Vulnerability Disclosure Report (VDR) which provides the software supplier's analysis and findings describing the impact (or lack of impact) that reported vulnerabilities have on packages or products in the supplier's SBOM as defined in [NIST SP 800-161](https://csrc.nist.gov/publications/detail/sp/800-161/rev-1/final).

vulnerabilityExploitabilityAssessment
type: NamedIndividual
type: ExternalRefType
comment: A reference to a Vulnerability Exploitability eXchange (VEX) statement which provides information on whether a product is impacted by a specific vulnerability in an included package and, if affected, whether there are actions recommended to remediate. See also [NTIA VEX one-page](https://ntia.gov/files/ntia/publications/vex_one-page_summary.pdf).

blake2b256
type: NamedIndividual
type: HashAlgorithm
comment: blake2b algorithm with a digest size of 256 https://datatracker.ietf.org/doc/html/rfc7693#section-4

blake2b384
type: NamedIndividual
type: HashAlgorithm
comment: blake2b algorithm with a digest size of 384 https://datatracker.ietf.org/doc/html/rfc7693#section-4

blake2b512
type: NamedIndividual
type: HashAlgorithm
comment: blake2b algorithm with a digest size of 512 https://datatracker.ietf.org/doc/html/rfc7693#section-4

blake3
type: NamedIndividual
type: HashAlgorithm
comment: https://github.com/BLAKE3-team/BLAKE3-specs/blob/master/blake3.pdf

crystalsDilithium
type: NamedIndividual
type: HashAlgorithm
comment: https://pq-crystals.org/dilithium/index.shtml

crystalsKyber
type: NamedIndividual
type: HashAlgorithm
comment: https://pq-crystals.org/kyber/index.shtml

falcon
type: NamedIndividual
type: HashAlgorithm
comment: https://falcon-sign.info/falcon.pdf

md2
type: NamedIndividual
type: HashAlgorithm
comment: https://datatracker.ietf.org/doc/rfc1319/

md4
type: NamedIndividual
type: HashAlgorithm
comment: https://datatracker.ietf.org/doc/html/rfc1186

md5
type: NamedIndividual
type: HashAlgorithm
comment: https://datatracker.ietf.org/doc/html/rfc1321

md6
type: NamedIndividual
type: HashAlgorithm
comment: https://people.csail.mit.edu/rivest/pubs/RABCx08.pdf

other
type: NamedIndividual
type: HashAlgorithm
comment: any hashing algorithm that does not exist in this list of entries

sha1
type: NamedIndividual
type: HashAlgorithm
comment: https://datatracker.ietf.org/doc/html/rfc3174

sha224
type: NamedIndividual
type: HashAlgorithm
comment: secure hashing algorithm with a digest length of 224 https://datatracker.ietf.org/doc/html/draft-ietf-pkix-sha224-01

sha256
type: NamedIndividual
type: HashAlgorithm
comment: secure hashing algorithm with a digest length of 256 https://www.rfc-editor.org/rfc/rfc4634

sha384
type: NamedIndividual
type: HashAlgorithm
comment: secure hashing algorithm with a digest length of 384 https://www.rfc-editor.org/rfc/rfc4634

sha3_224
type: NamedIndividual
type: HashAlgorithm
comment: sha3 with a digest length of 224 https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.202.pdf

sha3_256
type: NamedIndividual
type: HashAlgorithm
comment: sha3 with a digest length of 256 https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.202.pdf

sha3_384
type: NamedIndividual
type: HashAlgorithm
comment: sha3 with a digest length of 384 https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.202.pdf

sha3_512
type: NamedIndividual
type: HashAlgorithm
comment: sha3 with a digest length of 512 https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.202.pdf

sha512
type: NamedIndividual
type: HashAlgorithm
comment: secure hashing algorithm with a digest length of 512 https://www.rfc-editor.org/rfc/rfc4634

build
type: NamedIndividual
type: LifecycleScopeType
comment: A relationship has specific context implications during an element's build phase, during development.

design
type: NamedIndividual
type: LifecycleScopeType
comment: A relationship has specific context implications during an element's design.

development
type: NamedIndividual
type: LifecycleScopeType
comment: A relationship has specific context implications during development phase of an element.

other
type: NamedIndividual
type: LifecycleScopeType
comment: A relationship has other specific context information necessary to capture that the above set of enumerations does not handle.

runtime
type: NamedIndividual
type: LifecycleScopeType
comment: A relationship has specific context implications during the execution phase of an element.

test
type: NamedIndividual
type: LifecycleScopeType
comment: A relationship has specific context implications during an element's testing phase, during development.

LifecycleScopedRelationship
type: Class
type: NodeShape
comment: Provide context for a relationship that occurs in the lifecycle.
subclass of: Relationship
property:
  class: LifecycleScopeType
  max count: 1
  node kind: IRI
  path: scope

Organization
type: Class
comment: A group of people who work together in an organized way for a shared purpose.
subclass of: Agent

PackageVerificationCode
type: Class
type: NodeShape
comment: An SPDX version 2.X compatible verification method for software packages.
subclass of: IntegrityMethod
property:
  datatype: string
  node kind: Literal
  path: packageVerificationCodeExcludedFile
property:
  datatype: string
  max count: 1
  min count: 1
  node kind: Literal
  path: hashValue

Person
type: Class
comment: An individual human being.
subclass of: Agent

no
type: NamedIndividual
type: PresenceType
comment: Indicates absence of the field.

noAssertion
type: NamedIndividual
type: PresenceType
comment: Makes no assertion about the field.

yes
type: NamedIndividual
type: PresenceType
comment: Indicates presence of the field.

ai
type: NamedIndividual
type: ProfileIdentifierType
comment: the element follows the AI profile specification

build
type: NamedIndividual
type: ProfileIdentifierType
comment: the element follows the Build profile specification

core
type: NamedIndividual
type: ProfileIdentifierType
comment: the element follows the Core profile specification

dataset
type: NamedIndividual
type: ProfileIdentifierType
comment: the element follows the Dataset profile specification

expandedLicensing
type: NamedIndividual
type: ProfileIdentifierType
comment: the element follows the expanded Licensing profile specification

extension
type: NamedIndividual
type: ProfileIdentifierType
comment: the element follows the Extension profile specification

security
type: NamedIndividual
type: ProfileIdentifierType
comment: the element follows the Security profile specification

simpleLicensing
type: NamedIndividual
type: ProfileIdentifierType
comment: the element follows the simple Licensing profile specification

software
type: NamedIndividual
type: ProfileIdentifierType
comment: the element follows the Software profile specification

usage
type: NamedIndividual
type: ProfileIdentifierType
comment: the element follows the Usage profile specification

complete
type: NamedIndividual
type: RelationshipCompleteness
comment: The relationship is known to be exhaustive.

incomplete
type: NamedIndividual
type: RelationshipCompleteness
comment: The relationship is known not to be exhaustive.

noAssertion
type: NamedIndividual
type: RelationshipCompleteness
comment: No assertion can be made about the completeness of the relationship.

affects
type: NamedIndividual
type: RelationshipType
comment: (Security/VEX) The `from` vulnerability affect each `to` Element

amendedBy
type: NamedIndividual
type: RelationshipType
comment: The `from` Element is amended by each `to` Element

ancestorOf
type: NamedIndividual
type: RelationshipType
comment: The `from` Element is an ancestor of each `to` Element

availableFrom
type: NamedIndividual
type: RelationshipType
comment: The `from` Element is available from the additional supplier described by each `to` Element

configures
type: NamedIndividual
type: RelationshipType
comment: The `from` Element is a configuration applied to each `to` Element during a LifecycleScopeType period

contains
type: NamedIndividual
type: RelationshipType
comment: The `from` Element contains each `to` Element

coordinatedBy
type: NamedIndividual
type: RelationshipType
comment: (Security) The `from` Vulnerability is coordinatedBy the `to` Agent(s) (vendor, researcher, or consumer agent)

copiedTo
type: NamedIndividual
type: RelationshipType
comment: The `from` Element has been copied to each `to` Element

delegatedTo
type: NamedIndividual
type: RelationshipType
comment: The `from` Agent is delegating an action to the Agent of the `to` Relationship (which must be of type invokedBy) during a LifecycleScopeType. (e.g. the `to` invokedBy Relationship is being done on behalf of `from`)

dependsOn
type: NamedIndividual
type: RelationshipType
comment: The `from` Element depends on each `to` Element during a LifecycleScopeType period.

descendantOf
type: NamedIndividual
type: RelationshipType
comment: The `from` Element is a descendant of each `to` Element

describes
type: NamedIndividual
type: RelationshipType
comment: The `from` Element describes each `to` Element. To denote the root(s) of a tree of elements in a collection, the rootElement property should be used.

doesNotAffect
type: NamedIndividual
type: RelationshipType
comment: (Security/VEX) The `from` Vulnerability has no impact on each `to` Element

expandsTo
type: NamedIndividual
type: RelationshipType
comment: The `from` archive expands out as an artifact described by each `to` Element

exploitCreatedBy
type: NamedIndividual
type: RelationshipType
comment: (Security) The `from` Vulnerability has had an exploit created against it by each `to` Agent

fixedBy
type: NamedIndividual
type: RelationshipType
comment: (Security) Designates a `from` Vulnerability has been fixed by the `to` Agent(s)

fixedIn
type: NamedIndividual
type: RelationshipType
comment: (Security/VEX) A `from` Vulnerability has been fixed in each of the `to` Element(s)

foundBy
type: NamedIndividual
type: RelationshipType
comment: (Security) Designates a `from` Vulnerability was originally discovered by the `to` Agent(s)

generates
type: NamedIndividual
type: RelationshipType
comment: The `from` Element generates each `to` Element

hasAddedFile
type: NamedIndividual
type: RelationshipType
comment: Every `to` Element is is a file added to the `from` Element (`from` hasAddedFile `to`)

hasAssessmentFor
type: NamedIndividual
type: RelationshipType
comment: (Security) Relates a `from` Vulnerability and each `to` Element(s) with a security assessment. To be used with `VulnAssessmentRelationship` types

hasAssociatedVulnerability
type: NamedIndividual
type: RelationshipType
comment: (Security) Used to associate a `from` Artifact with each `to` Vulnerability

hasConcludedLicense
type: NamedIndividual
type: RelationshipType
comment: The `from` Software Artifact is concluded by the SPDX data creator to be governed by each `to` license

hasDataFile
type: NamedIndividual
type: RelationshipType
comment: The `from` Element treats each `to` Element as a data file

hasDeclaredLicense
type: NamedIndividual
type: RelationshipType
comment: The `from` Software Artifact was discovered to actually contain each `to` license, for example as detected by use of automated tooling.

hasDeletedFile
type: NamedIndividual
type: RelationshipType
comment: Every `to` Element is a file deleted from the `from` Element (`from` hasDeletedFile `to`)

hasDependencyManifest
type: NamedIndividual
type: RelationshipType
comment: The `from` Element has manifest files that contain dependency information in each `to` Element

hasDistributionArtifact
type: NamedIndividual
type: RelationshipType
comment: The `from` Element is distributed as an artifact in each Element `to`, (e.g. an RPM or archive file)

hasDocumentation
type: NamedIndividual
type: RelationshipType
comment: The `from` Element is documented by each `to` Element

hasDynamicLink
type: NamedIndividual
type: RelationshipType
comment: The `from` Element dynamically links in each `to` Element, during a LifecycleScopeType period.

hasEvidence
type: NamedIndividual
type: RelationshipType
comment: (Dataset) Every `to` Element is considered as evidence for the `from` Element (`from` hasEvidence `to`)

hasExample
type: NamedIndividual
type: RelationshipType
comment: Every `to` Element is an example for the `from` Element (`from` hasExample `to`)

hasHost
type: NamedIndividual
type: RelationshipType
comment: The `from` Build was run on the `to` Element during a LifecycleScopeType period (e.g. The host that the build runs on)

hasInputs
type: NamedIndividual
type: RelationshipType
comment: The `from` Build has each `to` Elements as an input during a LifecycleScopeType period.

hasMetadata
type: NamedIndividual
type: RelationshipType
comment: Every `to` Element is metadata about the `from` Element (`from` hasMetadata `to`)

hasOptionalComponent
type: NamedIndividual
type: RelationshipType
comment: Every `to` Element is an optional component of the `from` Element (`from` hasOptionalComponent` `to`)

hasOptionalDependency
type: NamedIndividual
type: RelationshipType
comment: The `from` Element optionally depends on each `to` Element during a LifecycleScopeType period

hasOutputs
type: NamedIndividual
type: RelationshipType
comment: The `from` Build element generates each `to` Element as an output during a LifecycleScopeType period.

hasPrerequsite
type: NamedIndividual
type: RelationshipType
comment: The `from` Element has a prerequsite on each `to` Element, during a LifecycleScopeType period

hasProvidedDependency
type: NamedIndividual
type: RelationshipType
comment: The `from` Element has a dependency on each `to` Element, but dependency is not in the distributed artifact, but assumed to be provided, during a LifecycleScopeType period

hasRequirement
type: NamedIndividual
type: RelationshipType
comment: The `from` Element has a requirement on each `to` Element, during a LifecycleScopeType period

hasSpecification
type: NamedIndividual
type: RelationshipType
comment: Every `to` Element is a specification for the `from` Element (`from` hasSpecification `to`), during a LifecycleScopeType period

hasStaticLink
type: NamedIndividual
type: RelationshipType
comment: The `from` Element statically links in each `to` Element, during a LifecycleScopeType period

hasTest
type: NamedIndividual
type: RelationshipType
comment: Every `to` Element is a test artifact for the `from` Element (`from` hasTest `to`), during a LifecycleScopeType period

hasTestCase
type: NamedIndividual
type: RelationshipType
comment: Every `to` Element is a test case for the `from` Element (`from` hasTestCase `to`)

hasVariant
type: NamedIndividual
type: RelationshipType
comment: Every `to` Element is a variant the `from` Element (`from` hasVariant `to`)

invokedBy
type: NamedIndividual
type: RelationshipType
comment: The `from` Element was invoked by the `to` Agent during a LifecycleScopeType period (for example, a Build element that describes a build step)

modifiedBy
type: NamedIndividual
type: RelationshipType
comment: The `from` Element is modified by each `to` Element

other
type: NamedIndividual
type: RelationshipType
comment: Every `to` Element is related to the `from` Element where the relationship type is not described by any of the SPDX relationhip types (this relationship is directionless)

packagedBy
type: NamedIndividual
type: RelationshipType
comment: Every `to` Element is a packaged instance of the `from` Element (`from` packagedBy `to`)

patchedBy
type: NamedIndividual
type: RelationshipType
comment: Every `to` Element is a patch for the `from` Element (`from` patchedBy `to`)

publishedBy
type: NamedIndividual
type: RelationshipType
comment: (Security) Designates a `from` Vulnerability was made available for public use or reference by each `to` Agent

reportedBy
type: NamedIndividual
type: RelationshipType
comment: (Security) Designates a `from` Vulnerability was first reported to a project, vendor, or tracking database for formal identification by each `to` Agent

republishedBy
type: NamedIndividual
type: RelationshipType
comment: (Security) Designates a `from` Vulnerability's details were tracked, aggregated, and/or enriched to improve context (i.e. NVD) by a `to` Agent(s)

serializedInArtifact
type: NamedIndividual
type: RelationshipType
comment: The `from` SPDXDocument can be found in a serialized form in each `to` Artifact

testedOn
type: NamedIndividual
type: RelationshipType
comment: (AI, Dataset) The `from` Element has been tested on the `to` Element

trainedOn
type: NamedIndividual
type: RelationshipType
comment: (AI, Dataset) The `from` Element has been trained by the `to` Element(s)

underInvestigationFor
type: NamedIndividual
type: RelationshipType
comment: (Security/VEX) The `from` Vulnerability impact is being investigated for each `to` Element

usesTool
type: NamedIndividual
type: RelationshipType
comment: The `from` Element uses each `to` Element as a tool during a LifecycleScopeType period.

SoftwareAgent
type: Class
comment: A software agent.
subclass of: Agent

SpdxDocument
type: Class
type: NodeShape
comment: A collection of SPDX Elements that could potentially be serialized.
subclass of: ElementCollection
property:
  class: NamespaceMap
  node kind: BlankNodeOrIRI
  path: namespaceMap
property:
  class: AnyLicenseInfo
  max count: 1
  node kind: BlankNodeOrIRI
  path: dataLicense
property:
  class: ExternalMap
  node kind: BlankNodeOrIRI
  path: imports

deployed
type: NamedIndividual
type: SupportType
comment: in addition to being supported by the supplier, the software is known to have been deployed and is in use. For a software as a service provider, this implies the software is now available as a service.

development
type: NamedIndividual
type: SupportType
comment: the artifact is in active development and is not considered ready for formal support from the supplier.

endOfSupport
type: NamedIndividual
type: SupportType
comment: there is a defined end of support for the artifact from the supplier. This may also be referred to as end of life. There is a validUntilDate that can be used to signal when support ends for the artifact.

limitedSupport
type: NamedIndividual
type: SupportType
comment: the artifact has been released, and there is limited support available from the supplier. There is a validUntilDate that can provide additional information about the duration of support.

noAssertion
type: NamedIndividual
type: SupportType
comment: no assertion about the type of support is made. This is considered the default if no other support type is used.

noSupport
type: NamedIndividual
type: SupportType
comment: there is no support for the artifact from the supplier, consumer assumes any support obligations.

support
type: NamedIndividual
type: SupportType
comment: the artifact has been released, and is supported from the supplier. There is a validUntilDate that can provide additional information about the duration of support.

amber
type: NamedIndividual
type: ConfidentialityLevelType
comment: Data points in the dataset can be shared only with specific organizations and their clients on a need to know basis.

clear
type: NamedIndividual
type: ConfidentialityLevelType
comment: Dataset may be distributed freely, without restriction.

green
type: NamedIndividual
type: ConfidentialityLevelType
comment: Dataset can be shared within a community of peers and partners.

red
type: NamedIndividual
type: ConfidentialityLevelType
comment: Data points in the dataset are highly confidential and can only be shared with named recipients.

clickthrough
type: NamedIndividual
type: DatasetAvailabilityType
comment: the dataset is not publicly available and can only be accessed after affirmatively accepting terms on a clickthrough webpage.

directDownload
type: NamedIndividual
type: DatasetAvailabilityType
comment: the dataset is publicly available and can be downloaded directly.

query
type: NamedIndividual
type: DatasetAvailabilityType
comment: the dataset is publicly available, but not all at once, and can only be accessed through queries which return parts of the dataset.

registration
type: NamedIndividual
type: DatasetAvailabilityType
comment: the dataset is not publicly available and an email registration is required before accessing the dataset, although without an affirmative acceptance of terms.

scrapingScript
type: NamedIndividual
type: DatasetAvailabilityType
comment: the dataset provider is not making available the underlying data and the dataset must be reassembled, typically using the provided script for scraping the data.

DatasetPackage
type: Class
type: NodeShape
comment: Specifies a data package and its associated information.
subclass of: Package
property:
  datatype: string
  max count: 1
  node kind: Literal
  path: dataCollectionProcess
property:
  datatype: string
  max count: 1
  node kind: Literal
  path: intendedUse
property:
  class: DatasetAvailabilityType
  max count: 1
  node kind: IRI
  path: datasetAvailability
property:
  class: PresenceType
  max count: 1
  node kind: IRI
  path: hasSensitivePersonalInformation
property:
  datatype: nonNegativeInteger
  max count: 1
  node kind: Literal
  path: datasetSize
property:
  class: DictionaryEntry
  node kind: BlankNodeOrIRI
  path: sensor
property:
  class: DatasetType
  min count: 1
  node kind: IRI
  path: datasetType
property:
  datatype: string
  node kind: Literal
  path: knownBias
property:
  datatype: string
  node kind: Literal
  path: anonymizationMethodUsed
property:
  datatype: string
  max count: 1
  node kind: Literal
  path: datasetUpdateMechanism
property:
  datatype: string
  node kind: Literal
  path: dataPreprocessing
property:
  class: ConfidentialityLevelType
  max count: 1
  node kind: IRI
  path: confidentialityLevel
property:
  datatype: string
  max count: 1
  node kind: Literal
  path: datasetNoise

audio
type: NamedIndividual
type: DatasetType
comment: data is audio based, such as a collection of music from the 80s.

categorical
type: NamedIndividual
type: DatasetType
comment: data that is classified into a discrete number of categories, such as the eye color of a population of people.

graph
type: NamedIndividual
type: DatasetType
comment: data is in the form of a graph where entries are somehow related to each other through edges, such a social network of friends.

image
type: NamedIndividual
type: DatasetType
comment: data is a collection of images such as pictures of animals.

noAssertion
type: NamedIndividual
type: DatasetType
comment: data type is not known.

numeric
type: NamedIndividual
type: DatasetType
comment: data consists only of numeric entries.

other
type: NamedIndividual
type: DatasetType
comment: data is of a type not included in this list.

sensor
type: NamedIndividual
type: DatasetType
comment: data is recorded from a physical sensor, such as a thermometer reading or biometric device.

structured
type: NamedIndividual
type: DatasetType
comment: data is stored in tabular format or retrieved from a relational database.

syntactic
type: NamedIndividual
type: DatasetType
comment: data describes the syntax or semantics of a language or text, such as a parse tree used for natural language processing.

text
type: NamedIndividual
type: DatasetType
comment: data consists of unstructured text, such as a book, wikipedia article (without images), or transcript.

timeseries
type: NamedIndividual
type: DatasetType
comment: data is recorded in an ordered sequence of timestamped entries, such as the price of a stock over the course of a day.

timestamp
type: NamedIndividual
type: DatasetType
comment: data is recorded with a timestamp for each entry, but not necessarily ordered or at specific intervals, such as when a taxi ride starts and ends.

video
type: NamedIndividual
type: DatasetType
comment: data is video based, such as a collection of movie clips featuring Tom Hanks.

ConjunctiveLicenseSet
type: Class
type: NodeShape
comment: Portion of an AnyLicenseInfo representing a set of licensing information where all elements apply.
subclass of: AnyLicenseInfo
property:
  class: AnyLicenseInfo
  min count: 2
  node kind: BlankNodeOrIRI
  path: member

CustomLicense
type: Class
comment: A license that is not listed on the SPDX License List.
subclass of: License

CustomLicenseAddition
type: Class
comment: A license addition that is not listed on the SPDX Exceptions List.
subclass of: LicenseAddition

DisjunctiveLicenseSet
type: Class
type: NodeShape
comment: Portion of an AnyLicenseInfo representing a set of licensing information where only one of the elements applies.
subclass of: AnyLicenseInfo
property:
  class: AnyLicenseInfo
  min count: 2
  node kind: BlankNodeOrIRI
  path: member

ListedLicense
type: Class
type: NodeShape
comment: A license that is listed on the SPDX License List.
subclass of: License
property:
  datatype: string
  max count: 1
  node kind: Literal
  path: deprecatedVersion
property:
  datatype: string
  max count: 1
  node kind: Literal
  path: listVersionAdded

ListedLicenseException
type: Class
type: NodeShape
comment: A license exception that is listed on the SPDX Exceptions list.
subclass of: LicenseAddition
property:
  datatype: string
  max count: 1
  node kind: Literal
  path: listVersionAdded
property:
  datatype: string
  max count: 1
  node kind: Literal
  path: deprecatedVersion

NoAssertionLicense
type: NamedIndividual
comment: An Individual Value for License when no assertion can be made about its actual value.
range: IndividualLicensingInfo

NoneLicense
type: NamedIndividual
comment: An Individual Value for License where the SPDX data creator determines that no license is present.
range: IndividualLicensingInfo

OrLaterOperator
type: Class
type: NodeShape
comment: Portion of an AnyLicenseInfo representing this version, or any later version, of the indicated License.
subclass of: ExtendableLicense
property:
  class: License
  max count: 1
  min count: 1
  node kind: BlankNodeOrIRI
  path: subjectLicense

WithAdditionOperator
type: Class
type: NodeShape
comment: Portion of an AnyLicenseInfo representing a License which has additional text applied to it.
subclass of: AnyLicenseInfo
property:
  class: LicenseAddition
  max count: 1
  min count: 1
  node kind: BlankNodeOrIRI
  path: subjectAddition
property:
  class: ExtendableLicense
  max count: 1
  min count: 1
  node kind: BlankNodeOrIRI
  path: subjectExtendableLicense

critical
type: NamedIndividual
type: CvssSeverityType
comment: When a CVSS score is between 9.0 - 10.0

high
type: NamedIndividual
type: CvssSeverityType
comment: When a CVSS score is between 7.0 - 8.9

low
type: NamedIndividual
type: CvssSeverityType
comment: When a CVSS score is between 0 - 3.9

medium
type: NamedIndividual
type: CvssSeverityType
comment: When a CVSS score is between 4 - 6.9

none
type: NamedIndividual
type: CvssSeverityType
comment: When a CVSS score is 0

CvssV2VulnAssessmentRelationship
type: Class
type: NodeShape
comment: Provides a CVSS version 2.0 assessment for a vulnerability.
subclass of: VulnAssessmentRelationship
property:
  datatype: decimal
  max count: 1
  min count: 1
  node kind: Literal
  path: score
property:
  datatype: string
  max count: 1
  min count: 1
  node kind: Literal
  path: vectorString

CvssV3VulnAssessmentRelationship
type: Class
type: NodeShape
comment: Provides a CVSS version 3 assessment for a vulnerability.
subclass of: VulnAssessmentRelationship
property:
  class: CvssSeverityType
  max count: 1
  min count: 1
  node kind: IRI
  path: severity
property:
  datatype: decimal
  max count: 1
  min count: 1
  node kind: Literal
  path: score
property:
  datatype: string
  max count: 1
  min count: 1
  node kind: Literal
  path: vectorString

CvssV4VulnAssessmentRelationship
type: Class
type: NodeShape
comment: Provides a CVSS version 4 assessment for a vulnerability.
subclass of: VulnAssessmentRelationship
property:
  datatype: string
  max count: 1
  min count: 1
  node kind: Literal
  path: vectorString
property:
  class: CvssSeverityType
  max count: 1
  min count: 1
  node kind: IRI
  path: severity
property:
  datatype: decimal
  max count: 1
  min count: 1
  node kind: Literal
  path: score

EpssVulnAssessmentRelationship
type: Class
type: NodeShape
comment: Provides an EPSS assessment for a vulnerability.
subclass of: VulnAssessmentRelationship
property:
  datatype: decimal
  max count: 1
  min count: 1
  node kind: Literal
  path: percentile
property:
  datatype: dateTimeStamp
  max count: 1
  min count: 1
  node kind: Literal
  path: publishedTime
  pattern: ^\d\d\d\d-\d\d-\d\dT\d\d:\d\d:\d\dZ$
property:
  datatype: decimal
  max count: 1
  min count: 1
  node kind: Literal
  path: probability

kev
type: NamedIndividual
type: ExploitCatalogType
comment: CISA's Known Exploited Vulnerability (KEV) Catalog

other
type: NamedIndividual
type: ExploitCatalogType
comment: Other exploit catalogs

ExploitCatalogVulnAssessmentRelationship
type: Class
type: NodeShape
comment: Provides an exploit assessment of a vulnerability.
subclass of: VulnAssessmentRelationship
property:
  datatype: boolean
  max count: 1
  min count: 1
  node kind: Literal
  path: exploited
property:
  datatype: anyURI
  max count: 1
  min count: 1
  node kind: Literal
  path: locator
property:
  class: ExploitCatalogType
  max count: 1
  min count: 1
  node kind: IRI
  path: catalogType

act
type: NamedIndividual
type: SsvcDecisionType
comment: The vulnerability requires attention from the organization's internal, supervisory-level and leadership-level individuals. Necessary actions include requesting assistance or information about the vulnerability, as well as publishing a notification either internally and/or externally. Typically, internal groups would meet to determine the overall response and then execute agreed upon actions. CISA recommends remediating Act vulnerabilities as soon as possible.

attend
type: NamedIndividual
type: SsvcDecisionType
comment: The vulnerability requires attention from the organization's internal, supervisory-level individuals. Necessary actions include requesting assistance or information about the vulnerability, and may involve publishing a notification either internally and/or externally. CISA recommends remediating Attend vulnerabilities sooner than standard update timelines.

track
type: NamedIndividual
type: SsvcDecisionType
comment: The vulnerability does not require action at this time. The organization would continue to track the vulnerability and reassess it if new information becomes available. CISA recommends remediating Track vulnerabilities within standard update timelines.

trackStar
type: NamedIndividual
type: SsvcDecisionType
comment: (Track* in the SSVC spec) The vulnerability contains specific characteristics that may require closer monitoring for changes. CISA recommends remediating Track* vulnerabilities within standard update timelines.

SsvcVulnAssessmentRelationship
type: Class
type: NodeShape
comment: Provides an SSVC assessment for a vulnerability.
subclass of: VulnAssessmentRelationship
property:
  class: SsvcDecisionType
  max count: 1
  min count: 1
  node kind: IRI
  path: decisionType

VexAffectedVulnAssessmentRelationship
type: Class
type: NodeShape
comment: Connects a vulnerability and an element designating the element as a product affected by the vulnerability.
subclass of: VexVulnAssessmentRelationship
property:
  datatype: string
  max count: 1
  node kind: Literal
  path: actionStatement
property:
  datatype: dateTimeStamp
  node kind: Literal
  path: actionStatementTime
  pattern: ^\d\d\d\d-\d\d-\d\dT\d\d:\d\d:\d\dZ$

VexFixedVulnAssessmentRelationship
type: Class
comment: Links a vulnerability and elements representing products (in the VEX sense) where a fix has been applied and are no longer affected.
subclass of: VexVulnAssessmentRelationship

componentNotPresent
type: NamedIndividual
type: VexJustificationType
comment: The software is not affected because the vulnerable component is not in the product.

inlineMitigationsAlreadyExist
type: NamedIndividual
type: VexJustificationType
comment: Built-in inline controls or mitigations prevent an adversary from leveraging the vulnerability.

vulnerableCodeCannotBeControlledByAdversary
type: NamedIndividual
type: VexJustificationType
comment: The vulnerable component is present, and the component contains the vulnerable code. However, vulnerable code is used in such a way that an attacker cannot mount any anticipated attack.

vulnerableCodeNotInExecutePath
type: NamedIndividual
type: VexJustificationType
comment: The affected code is not reachable through the execution of the code, including non-anticipated states of the product.

vulnerableCodeNotPresent
type: NamedIndividual
type: VexJustificationType
comment: The product is not affected because the code underlying the vulnerability is not present in the product.

VexNotAffectedVulnAssessmentRelationship
type: Class
type: NodeShape
comment: Links a vulnerability and one or more elements designating the latter as products not affected by the vulnerability.
subclass of: VexVulnAssessmentRelationship
property:
  datatype: dateTimeStamp
  max count: 1
  node kind: Literal
  path: impactStatementTime
  pattern: ^\d\d\d\d-\d\d-\d\dT\d\d:\d\d:\d\dZ$
property:
  class: VexJustificationType
  max count: 1
  node kind: IRI
  path: justificationType
property:
  datatype: string
  max count: 1
  node kind: Literal
  path: impactStatement

VexUnderInvestigationVulnAssessmentRelationship
type: Class
comment: Designates elements as products where the impact of a vulnerability is being investigated.
subclass of: VexVulnAssessmentRelationship

Vulnerability
type: Class
type: NodeShape
comment: Specifies a vulnerability and its associated information.
subclass of: Artifact
property:
  datatype: dateTimeStamp
  max count: 1
  node kind: Literal
  path: modifiedTime
  pattern: ^\d\d\d\d-\d\d-\d\dT\d\d:\d\d:\d\dZ$
property:
  datatype: dateTimeStamp
  max count: 1
  node kind: Literal
  path: publishedTime
  pattern: ^\d\d\d\d-\d\d-\d\dT\d\d:\d\d:\d\dZ$
property:
  datatype: dateTimeStamp
  max count: 1
  node kind: Literal
  path: withdrawnTime
  pattern: ^\d\d\d\d-\d\d-\d\dT\d\d:\d\d:\d\dZ$

LicenseExpression
type: Class
type: NodeShape
comment: An SPDX Element containing an SPDX license expression string.
subclass of: AnyLicenseInfo
property:
  class: DictionaryEntry
  node kind: BlankNodeOrIRI
  path: customIdToUri
property:
  datatype: string
  max count: 1
  node kind: Literal
  path: licenseListVersion
  pattern: ^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-((?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*)(?:\.(?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*))*))?(?:\+([0-9a-zA-Z-]+(?:\.[0-9a-zA-Z-]+)*))?$
property:
  datatype: string
  max count: 1
  min count: 1
  node kind: Literal
  path: licenseExpression

SimpleLicensingText
type: Class
type: NodeShape
comment: A license or addition that is not listed on the SPDX License List.
subclass of: Element
property:
  datatype: string
  max count: 1
  min count: 1
  node kind: Literal
  path: licenseText

directory
type: NamedIndividual
type: FileKindType
comment: The file represents a directory and all content stored in that directory.

file
type: NamedIndividual
type: FileKindType
comment: The file represents a single file (default).

Sbom
type: Class
type: NodeShape
comment: A collection of SPDX Elements describing a single package.
subclass of: Bom
property:
  class: SbomType
  node kind: IRI
  path: sbomType

analyzed
type: NamedIndividual
type: SbomType
comment: SBOM generated through analysis of artifacts (e.g., executables, packages, containers, and virtual machine images) after its build. Such analysis generally requires a variety of heuristics. In some contexts, this may also be referred to as a “3rd party” SBOM.

build
type: NamedIndividual
type: SbomType
comment: SBOM generated as part of the process of building the software to create a releasable artifact (e.g., executable or package) from data such as source files, dependencies, built components, build process ephemeral data, and other SBOMs.

deployed
type: NamedIndividual
type: SbomType
comment: SBOM provides an inventory of software that is present on a system. This may be an assembly of other SBOMs that combines analysis of configuration options, and examination of execution behavior in a (potentially simulated) deployment environment.

design
type: NamedIndividual
type: SbomType
comment: SBOM of intended, planned software project or product with included components (some of which may not yet exist) for a new software artifact.

runtime
type: NamedIndividual
type: SbomType
comment: SBOM generated through instrumenting the system running the software, to capture only components present in the system, as well as external call-outs or dynamically loaded components. In some contexts, this may also be referred to as an “Instrumented” or “Dynamic” SBOM.

source
type: NamedIndividual
type: SbomType
comment: SBOM created directly from the development environment, source files, and included dependencies used to build an product artifact.

Snippet
type: Class
type: NodeShape
comment: Describes a certain part of a file.
subclass of: SoftwareArtifact
property:
  class: File
  max count: 1
  min count: 1
  node kind: BlankNodeOrIRI
  path: snippetFromFile
property:
  class: PositiveIntegerRange
  max count: 1
  node kind: BlankNodeOrIRI
  path: lineRange
property:
  class: PositiveIntegerRange
  max count: 1
  node kind: BlankNodeOrIRI
  path: byteRange

application
type: NamedIndividual
type: SoftwarePurpose
comment: the Element is a software application

archive
type: NamedIndividual
type: SoftwarePurpose
comment: the Element is an archived collection of one or more files (.tar, .zip, etc)

bom
type: NamedIndividual
type: SoftwarePurpose
comment: Element is a bill of materials

configuration
type: NamedIndividual
type: SoftwarePurpose
comment: Element is configuration data

container
type: NamedIndividual
type: SoftwarePurpose
comment: the Element is a container image which can be used by a container runtime application

data
type: NamedIndividual
type: SoftwarePurpose
comment: Element is data

device
type: NamedIndividual
type: SoftwarePurpose
comment: the Element refers to a chipset, processor, or electronic board

deviceDriver
type: NamedIndividual
type: SoftwarePurpose
comment: Element represents software that controls hardware devices

diskImage
type: NamedIndividual
type: SoftwarePurpose
comment: the Element refers to a disk image that can be written to a disk, booted in a VM, etc. A disk image typically contains most or all of the components necessary to boot, such as bootloaders, kernels, firmware, userspace, etc.

documentation
type: NamedIndividual
type: SoftwarePurpose
comment: Element is documentation

evidence
type: NamedIndividual
type: SoftwarePurpose
comment: the Element is the evidence that a specification or requirement has been fulfilled

executable
type: NamedIndividual
type: SoftwarePurpose
comment: Element is an Artifact that can be run on a computer

file
type: NamedIndividual
type: SoftwarePurpose
comment: the Element is a single file which can be independently distributed (configuration file, statically linked binary, Kubernetes deployment, etc)

filesystemImage
type: NamedIndividual
type: SoftwarePurpose
comment: the Element is a file system image that can be written to a disk (or virtual) partition

firmware
type: NamedIndividual
type: SoftwarePurpose
comment: the Element provides low level control over a device's hardware

framework
type: NamedIndividual
type: SoftwarePurpose
comment: the Element is a software framework

install
type: NamedIndividual
type: SoftwarePurpose
comment: the Element is used to install software on disk

library
type: NamedIndividual
type: SoftwarePurpose
comment: the Element is a software library

manifest
type: NamedIndividual
type: SoftwarePurpose
comment: the Element is a software manifest

model
type: NamedIndividual
type: SoftwarePurpose
comment: the Element is a machine learning or artificial intelligence model

module
type: NamedIndividual
type: SoftwarePurpose
comment: the Element is a module of a piece of software

operatingSystem
type: NamedIndividual
type: SoftwarePurpose
comment: the Element is an operating system

other
type: NamedIndividual
type: SoftwarePurpose
comment: the Element doesn't fit into any of the other categories

patch
type: NamedIndividual
type: SoftwarePurpose
comment: Element contains a set of changes to update, fix, or improve another Element

platform
type: NamedIndividual
type: SoftwarePurpose
comment: Element represents a runtime environment

requirement
type: NamedIndividual
type: SoftwarePurpose
comment: the Element provides a requirement needed as input for another Element

source
type: NamedIndividual
type: SoftwarePurpose
comment: the Element is a single or a collection of source files

specification
type: NamedIndividual
type: SoftwarePurpose
comment: the Element is a plan, guideline or strategy how to create, perform or analyse an application

test
type: NamedIndividual
type: SoftwarePurpose
comment: The Element is a test used to verify functionality on an software element

autonomyType
type: ObjectProperty
comment: States if a human is involved in the decisions of the AI software.
range: PresenceType

domain
type: DatatypeProperty
comment: Captures the domain in which the AI package can be used.
range: string

energyConsumption
type: DatatypeProperty
comment: Indicates the amount of energy consumed to train the AI model.
range: string

hyperparameter
type: ObjectProperty
comment: Records a hyperparameter used to build the AI model contained in the AI package.
range: DictionaryEntry

informationAboutApplication
type: DatatypeProperty
comment: Provides relevant information about the AI software, not including the model description.
range: string

informationAboutTraining
type: DatatypeProperty
comment: Describes relevant information about different steps of the training process.
range: string

limitation
type: DatatypeProperty
comment: Captures a limitation of the AI software.
range: string

metric
type: ObjectProperty
comment: Records the measurement of prediction quality of the AI model.
range: DictionaryEntry

metricDecisionThreshold
type: ObjectProperty
comment: Captures the threshold that was used for computation of a metric described in the metric field.
range: DictionaryEntry

modelDataPreprocessing
type: DatatypeProperty
comment: Describes all the preprocessing steps applied to the training data before the model training.
range: string

modelExplainability
type: DatatypeProperty
comment: Describes methods that can be used to explain the model.
range: string

safetyRiskAssessment
type: ObjectProperty
comment: Categorizes general safety risk assessment of the AI system.
range: SafetyRiskAssessmentType

standardCompliance
type: DatatypeProperty
comment: Captures a standard that is being complied with.
range: string

typeOfModel
type: DatatypeProperty
comment: Records the type of the model used in the AI software.
range: string

useSensitivePersonalInformation
type: ObjectProperty
comment: Records if sensitive personal information is used during model training or could be used during the inference.
range: PresenceType

buildEndTime
type: DatatypeProperty
comment: Property that describes the time at which a build stops.
range: dateTimeStamp

buildId
type: DatatypeProperty
comment: A buildId is a locally unique identifier used by a builder to identify a unique instance of a build produced by it.
range: string

buildStartTime
type: DatatypeProperty
comment: Property describing the start time of a build.
range: dateTimeStamp

buildType
type: DatatypeProperty
comment: A buildType is a hint that is used to indicate the toolchain, platform, or infrastructure that the build was invoked on.
range: anyURI

configSourceDigest
type: ObjectProperty
comment: Property that describes the digest of the build configuration file used to invoke a build.
range: Hash

configSourceEntrypoint
type: DatatypeProperty
comment: Property describes the invocation entrypoint of a build.
range: string

configSourceUri
type: DatatypeProperty
comment: Property that describes the URI of the build configuration source file.
range: anyURI

environment
type: ObjectProperty
comment: Property describing the session in which a build is invoked.
range: DictionaryEntry

parameters
type: ObjectProperty
comment: Property describing the parameters used in an instance of a build.
range: DictionaryEntry

Bom
type: Class
comment: A container for a grouping of SPDX-3.0 content characterizing details (provenence, composition, licensing, etc.) about a product.
subclass of: Bundle

Bundle
type: Class
type: NodeShape
comment: A collection of Elements that have a shared context.
subclass of: ElementCollection
property:
  datatype: string
  max count: 1
  node kind: Literal
  path: context

algorithm
type: ObjectProperty
comment: Specifies the algorithm used for calculating the hash value.
range: HashAlgorithm

annotationType
type: ObjectProperty
comment: Describes the type of annotation.
range: AnnotationType

beginIntegerRange
type: DatatypeProperty
comment: Defines the beginning of a range.
range: positiveInteger

builtTime
type: DatatypeProperty
comment: Specifies the time an artifact was built.
range: dateTimeStamp

completeness
type: ObjectProperty
comment: Provides information about the completeness of relationships.
range: RelationshipCompleteness

context
type: DatatypeProperty
comment: Gives information about the circumstances or unifying properties that Elements of the bundle have been assembled under.
range: string

created
type: DatatypeProperty
comment: Identifies when the Element was originally created.
range: dateTimeStamp

createdBy
type: ObjectProperty
comment: Identifies who or what created the Element.
range: Agent

createdUsing
type: ObjectProperty
comment: Identifies the tooling that was used during the creation of the Element.
range: Tool

creationInfo
type: ObjectProperty
comment: Provides information about the creation of the Element.
range: CreationInfo

dataLicense
type: ObjectProperty
comment: Provides the license under which the SPDX documentation of the Element can be used.
range: AnyLicenseInfo

definingArtifact
type: ObjectProperty
comment: Artifact representing a serialization instance of SPDX data containing the definition of a particular Element.
range: Artifact

description
type: DatatypeProperty
comment: Provides a detailed description of the Element.
range: string

element
type: ObjectProperty
comment: Refers to one or more Elements that are part of an ElementCollection.
range: Element

endIntegerRange
type: DatatypeProperty
comment: Defines the end of a range.
range: positiveInteger

endTime
type: DatatypeProperty
comment: Specifies the time from which an element is no longer applicable / valid.
range: dateTimeStamp

extension
type: ObjectProperty
comment: Specifies an Extension characterization of some aspect of an Element.
range: Extension

externalIdentifier
type: ObjectProperty
comment: Provides a reference to a resource outside the scope of SPDX-3.0 content that uniquely identifies an Element.
range: ExternalIdentifier

externalIdentifierType
type: ObjectProperty
comment: Specifies the type of the external identifier.
range: ExternalIdentifierType

externalRef
type: ObjectProperty
comment: Points to a resource outside the scope of the SPDX-3.0 content that provides additional characteristics of an Element.
range: ExternalRef

externalRefType
type: ObjectProperty
comment: Specifies the type of the external reference.
range: ExternalRefType

externalSpdxId
type: DatatypeProperty
comment: Identifies an external Element used within a Document but defined external to that Document.
range: anyURI

from
type: ObjectProperty
comment: References the Element on the left-hand side of a relationship.
range: Element

identifier
type: DatatypeProperty
comment: Uniquely identifies an external element.
range: string

identifierLocator
type: DatatypeProperty
comment: Provides the location for more information regarding an external identifier.
range: anyURI

imports
type: ObjectProperty
comment: Provides an ExternalMap of Element identifiers.
range: ExternalMap

issuingAuthority
type: DatatypeProperty
comment: An entity that is authorized to issue identification credentials.
range: string

key
type: DatatypeProperty
comment: A key used in a generic key-value pair.
range: string

locationHint
type: DatatypeProperty
comment: Provides an indication of where to retrieve an external Element.
range: anyURI

locator
type: DatatypeProperty
comment: Provides the location of an external reference.
range: string

name
type: DatatypeProperty
comment: Identifies the name of an Element as designated by the creator.
range: string

namespace
type: DatatypeProperty
comment: Provides an unambiguous mechanism for conveying a URI fragment portion of an ElementID.
range: anyURI

namespaceMap
type: ObjectProperty
comment: Provides a NamespaceMap of prefixes and associated namespace partial URIs applicable to an SpdxDocument and independent of any specific serialization format or instance.
range: NamespaceMap

originatedBy
type: ObjectProperty
comment: Identifies from where or whom the Element originally came.
range: Agent

packageVerificationCodeExcludedFile
type: DatatypeProperty
comment: The relative file name of a file to be excluded from the `PackageVerificationCode`.
range: string

prefix
type: DatatypeProperty
comment: A substitute for a URI.
range: string

profileConformance
type: ObjectProperty
comment: Describes one a profile which the creator of this ElementCollection intends to conform to.
range: ProfileIdentifierType

relationshipType
type: ObjectProperty
comment: Information about the relationship between two Elements.
range: RelationshipType

releaseTime
type: DatatypeProperty
comment: Specifies the time an artifact was released.
range: dateTimeStamp

rootElement
type: ObjectProperty
comment: This property is used to denote the root Element(s) of a tree of elements contained in an SBOM.
range: Element

scope
type: ObjectProperty
comment: Capture the scope of information about a specific relationship between elements.
range: LifecycleScopeType

specVersion
type: DatatypeProperty
comment: Provides a reference number that can be used to understand how to parse and interpret an Element.
range: string

standardName
type: DatatypeProperty
comment: The name of a relevant standard that may apply to an artifact.
range: string

startTime
type: DatatypeProperty
comment: Specifies the time from which an element is applicable / valid.
range: dateTimeStamp

statement
type: DatatypeProperty
comment: Commentary on an assertion that an annotator has made.
range: string

subject
type: ObjectProperty
comment: An Element an annotator has made an assertion about.
range: Element

summary
type: DatatypeProperty
comment: A short description of an Element.
range: string

supportLevel
type: ObjectProperty
comment: Specifies the level of support associated with an artifact.
range: SupportType

to
type: ObjectProperty
comment: References an Element on the right-hand side of a relationship.
range: Element

validUntilTime
type: DatatypeProperty
comment: Specifies until when the artifact can be used before its usage needs to be reassessed.
range: dateTimeStamp

value
type: DatatypeProperty
comment: A value used in a generic key-value pair.
range: string

anonymizationMethodUsed
type: DatatypeProperty
comment: Describes the anonymization methods used.
range: string

confidentialityLevel
type: ObjectProperty
comment: Describes the confidentiality level of the data points contained in the dataset.
range: ConfidentialityLevelType

dataCollectionProcess
type: DatatypeProperty
comment: Describes how the dataset was collected.
range: string

dataPreprocessing
type: DatatypeProperty
comment: Describes the preprocessing steps that were applied to the raw data to create the given dataset.
range: string

datasetAvailability
type: ObjectProperty
comment: The field describes the availability of a dataset.
range: DatasetAvailabilityType

datasetNoise
type: DatatypeProperty
comment: Describes potentially noisy elements of the dataset.
range: string

datasetSize
type: DatatypeProperty
comment: Captures the size of the dataset.
range: nonNegativeInteger

datasetType
type: ObjectProperty
comment: Describes the type of the given dataset.
range: DatasetType

datasetUpdateMechanism
type: DatatypeProperty
comment: Describes a mechanism to update the dataset.
range: string

hasSensitivePersonalInformation
type: ObjectProperty
comment: Describes if any sensitive personal information is present in the dataset.
range: PresenceType

intendedUse
type: DatatypeProperty
comment: Describes what the given dataset should be used for.
range: string

knownBias
type: DatatypeProperty
comment: Records the biases that the dataset is known to encompass.
range: string

sensor
type: ObjectProperty
comment: Describes a sensor used for collecting the data.
range: DictionaryEntry

additionText
type: DatatypeProperty
comment: Identifies the full text of a LicenseAddition.
range: string

isDeprecatedAdditionId
type: DatatypeProperty
comment: Specifies whether an additional text identifier has been marked as deprecated.
range: boolean

isDeprecatedLicenseId
type: DatatypeProperty
comment: Specifies whether a license or additional text identifier has been marked as deprecated.
range: boolean

isFsfLibre
type: DatatypeProperty
comment: Specifies whether the License is listed as free by the [Free Software Foundation (FSF)](https://fsf.org).
range: boolean

isOsiApproved
type: DatatypeProperty
comment: Specifies whether the License is listed as approved by the [Open Source Initiative (OSI)](https://opensource.org).
range: boolean

standardAdditionTemplate
type: DatatypeProperty
comment: Identifies the full text of a LicenseAddition, in SPDX templating format.
range: string

standardLicenseHeader
type: DatatypeProperty
comment: Provides a License author's preferred text to indicate that a file is covered by the License.
range: string

standardLicenseTemplate
type: DatatypeProperty
comment: Identifies the full text of a License, in SPDX templating format.
range: string

subjectAddition
type: ObjectProperty
comment: A LicenseAddition participating in a 'with addition' model.
range: LicenseAddition

subjectExtendableLicense
type: ObjectProperty
comment: A License participating in a 'with addition' model.
range: ExtendableLicense

subjectLicense
type: ObjectProperty
comment: A License participating in an 'or later' model.
range: License

actionStatement
type: DatatypeProperty
comment: Provides advise on how to mitigate or remediate a vulnerability when a VEX product is affected by it.
range: string

actionStatementTime
type: DatatypeProperty
comment: Records the time when a recommended action was communicated in a VEX statement to mitigate a vulnerability.
range: dateTimeStamp

assessedElement
type: ObjectProperty
comment: Specifies an element contained in a piece of software where a vulnerability was found.
range: Element

catalogType
type: ObjectProperty
comment: Specifies the exploit catalog type.
range: ExploitCatalogType

decisionType
type: ObjectProperty
comment: Provide the enumeration of possible decisions in the Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree [https://www.cisa.gov/sites/default/files/publications/cisa-ssvc-guide%20508c.pdf](https://www.cisa.gov/sites/default/files/publications/cisa-ssvc-guide%20508c.pdf)
range: SsvcDecisionType

exploited
type: DatatypeProperty
comment: Describe that a CVE is known to have an exploit because it's been listed in an exploit catalog.
range: boolean

impactStatement
type: DatatypeProperty
comment: Explains why a VEX product is not affected by a vulnerability. It is an alternative in VexNotAffectedVulnAssessmentRelationship to the machine-readable justification label.
range: string

impactStatementTime
type: DatatypeProperty
comment: Timestamp of impact statement.
range: dateTimeStamp

justificationType
type: ObjectProperty
comment: Impact justification label to be used when linking a vulnerability to an element representing a VEX product with a VexNotAffectedVulnAssessmentRelationship relationship.
range: VexJustificationType

locator
type: DatatypeProperty
comment: Provides the location of an exploit catalog.
range: anyURI

percentile
type: DatatypeProperty
comment: The percentile of the current probability score.
range: decimal

probability
type: DatatypeProperty
comment: A probability score between 0 and 1 of a vulnerability being exploited.
range: decimal

statusNotes
type: DatatypeProperty
comment: Conveys information about how VEX status was determined.
range: string

vexVersion
type: DatatypeProperty
comment: Specifies the version of the VEX document.
range: string

customIdToUri
type: ObjectProperty
comment: Maps a LicenseRef or AdditionRef string for a Custom License or a Custom License Addition to its URI ID.
range: DictionaryEntry

licenseExpression
type: DatatypeProperty
comment: A string in the license expression format.
range: string

licenseListVersion
type: DatatypeProperty
comment: The version of the SPDX License List used in the license expression.
range: string

additionalPurpose
type: ObjectProperty
comment: Provides additional purpose information of the software artifact.
range: SoftwarePurpose

attributionText
type: DatatypeProperty
comment: Provides a place for the SPDX data creator to record acknowledgement text for a software Package, File or Snippet.
range: string

byteRange
type: DatatypeProperty
comment: Defines the byte range in the original host file that the snippet information applies to.
range: PositiveIntegerRange

contentType
type: DatatypeProperty
comment: Provides information about the content type of an Element.
range: string

copyrightText
type: DatatypeProperty
comment: Identifies the text of one or more copyright notices for a software Package, File or Snippet, if any.
range: string

downloadLocation
type: DatatypeProperty
comment: Identifies the download Uniform Resource Identifier for the package at the time that the document was created.
range: anyURI

fileKind
type: ObjectProperty
comment: Describes if a given file is a directory or non-directory kind of file.
range: FileKindType

gitoid
type: DatatypeProperty
comment: Used to record the artifact’s gitoid: a canonical, unique, immutable identifier that can be used for software integrity verification.
range: anyURI

homePage
type: DatatypeProperty
comment: A place for the SPDX document creator to record a website that serves as the package's home page.
range: anyURI

lineRange
type: DatatypeProperty
comment: Defines the line range in the original host file that the snippet information applies to.
range: PositiveIntegerRange

packageUrl
type: DatatypeProperty
comment: Provides a place for the SPDX data creator to record the package URL string (in accordance with the [package URL spec](https://github.com/package-url/purl-spec/blob/master/PURL-SPECIFICATION.rst)) for a software Package.
range: anyURI

packageVersion
type: DatatypeProperty
comment: Identify the version of a package.
range: string

primaryPurpose
type: ObjectProperty
comment: Provides information about the primary purpose of the software artifact.
range: SoftwarePurpose

sbomType
type: ObjectProperty
comment: Provides information about the type of an SBOM.
range: SbomType

snippetFromFile
type: ObjectProperty
comment: Defines the original host file that the snippet information applies to.
range: File

sourceInfo
type: DatatypeProperty
comment: Records any relevant background information or additional comments about the origin of the package.
range: string

CreationInfo
type: Class
type: NodeShape
comment: Provides information about the creation of the Element.
property:
  class: Tool
  node kind: BlankNodeOrIRI
  path: createdUsing
property:
  datatype: string
  max count: 1
  min count: 1
  node kind: Literal
  path: specVersion
  pattern: ^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-((?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*)(?:\.(?:0|[1-9]\d*|\d*[a-zA-Z-][0-9a-zA-Z-]*))*))?(?:\+([0-9a-zA-Z-]+(?:\.[0-9a-zA-Z-]+)*))?$
property:
  datatype: string
  max count: 1
  node kind: Literal
  path: comment
property:
  class: Agent
  min count: 1
  node kind: BlankNodeOrIRI
  path: createdBy
property:
  datatype: dateTimeStamp
  max count: 1
  min count: 1
  node kind: Literal
  path: created
  pattern: ^\d\d\d\d-\d\d-\d\dT\d\d:\d\d:\d\dZ$

ElementCollection
type: Class
type: NodeShape
comment: A collection of Elements, not necessarily with unifying context.
subclass of: Element
property:
  class: Element
  node kind: BlankNodeOrIRI
  path: element
property:
  class: ProfileIdentifierType
  node kind: IRI
  path: profileConformance
property:
  class: Element
  node kind: BlankNodeOrIRI
  path: rootElement

ExternalIdentifier
type: Class
type: NodeShape
comment: A reference to a resource outside the scope of SPDX-3.0 content that uniquely identifies an Element.
property:
  datatype: string
  max count: 1
  node kind: Literal
  path: comment
property:
  datatype: string
  max count: 1
  node kind: Literal
  path: issuingAuthority
property:
  class: ExternalIdentifierType
  max count: 1
  min count: 1
  node kind: IRI
  path: externalIdentifierType
property:
  datatype: string
  max count: 1
  min count: 1
  node kind: Literal
  path: identifier
property:
  datatype: anyURI
  node kind: Literal
  path: identifierLocator

ExternalMap
type: Class
type: NodeShape
comment: A map of Element identifiers that are used within a Document but defined external to that Document.
property:
  class: IntegrityMethod
  node kind: BlankNodeOrIRI
  path: verifiedUsing
property:
  datatype: anyURI
  max count: 1
  min count: 1
  node kind: Literal
  path: externalSpdxId
property:
  class: Artifact
  max count: 1
  node kind: BlankNodeOrIRI
  path: definingArtifact
property:
  datatype: anyURI
  max count: 1
  node kind: Literal
  path: locationHint

ExternalRef
type: Class
type: NodeShape
comment: A reference to a resource outside the scope of SPDX-3.0 content.
property:
  class: ExternalRefType
  max count: 1
  node kind: IRI
  path: externalRefType
property:
  datatype: string
  max count: 1
  node kind: Literal
  path: contentType
  pattern: ^[^\/]+\/[^\/]+$
property:
  datatype: string
  node kind: Literal
  path: locator
property:
  datatype: string
  max count: 1
  node kind: Literal
  path: comment

Hash
type: Class
type: NodeShape
comment: A mathematically calculated representation of a grouping of data.
subclass of: IntegrityMethod
property:
  datatype: string
  max count: 1
  min count: 1
  node kind: Literal
  path: hashValue
property:
  class: HashAlgorithm
  max count: 1
  min count: 1
  node kind: IRI
  path: algorithm

NamespaceMap
type: Class
type: NodeShape
comment: A mapping between prefixes and namespace partial URIs.
property:
  datatype: string
  max count: 1
  min count: 1
  node kind: Literal
  path: prefix
property:
  datatype: anyURI
  max count: 1
  min count: 1
  node kind: Literal
  path: namespace

Relationship
type: Class
type: NodeShape
comment: Describes a relationship between one or more elements.
subclass of: Element
property:
  class: Element
  max count: 1
  min count: 1
  node kind: BlankNodeOrIRI
  path: from
property:
  class: RelationshipType
  max count: 1
  min count: 1
  node kind: IRI
  path: relationshipType
property:
  class: RelationshipCompleteness
  max count: 1
  node kind: IRI
  path: completeness
property:
  class: Element
  node kind: BlankNodeOrIRI
  path: to
property:
  datatype: dateTimeStamp
  max count: 1
  node kind: Literal
  path: endTime
  pattern: ^\d\d\d\d-\d\d-\d\dT\d\d:\d\d:\d\dZ$
property:
  datatype: dateTimeStamp
  max count: 1
  node kind: Literal
  path: startTime
  pattern: ^\d\d\d\d-\d\d-\d\dT\d\d:\d\d:\d\dZ$

Tool
type: Class
comment: An element of hardware and/or software utilized to carry out a particular function.
subclass of: Element

contentType
type: DatatypeProperty
comment: Specifies the media type of an Element or Property.
range: string

hashValue
type: DatatypeProperty
comment: The result of applying a hash algorithm to an Element.
range: string

suppliedBy
type: ObjectProperty
comment: Identifies who or what supplied the artifact or VulnAssessmentRelationship referenced by the Element.
range: Agent

verifiedUsing
type: ObjectProperty
comment: Provides an IntegrityMethod with which the integrity of an Element can be asserted.
range: IntegrityMethod

IndividualLicensingInfo
type: Class
comment: A concrete subclass of AnyLicenseInfo used by Individuals in the ExpandedLicensing profile.
subclass of: AnyLicenseInfo

deprecatedVersion
type: DatatypeProperty
comment: Specifies the SPDX License List version in which this license or exception identifier was deprecated.
range: string

licenseXml
type: DatatypeProperty
comment: Identifies all the text and metadata associated with a license in the license XML format.
range: string

listVersionAdded
type: DatatypeProperty
comment: Specifies the SPDX License List version in which this ListedLicense or ListedLicenseException identifier was first added.
range: string

member
type: ObjectProperty
comment: A license expression participating in a license set.
range: AnyLicenseInfo

obsoletedBy
type: DatatypeProperty
comment: Specifies the licenseId that is preferred to be used in place of a deprecated License or LicenseAddition.
range: string

seeAlso
type: DatatypeProperty
comment: Contains a URL where the License or LicenseAddition can be found in use.
range: anyURI

Extension
type: Class
comment: A characterization of some aspect of an Element that is associated with the Element in a generalized fashion.

modifiedTime
type: DatatypeProperty
comment: Specifies a time when a vulnerability assessment was modified
range: dateTimeStamp

severity
type: ObjectProperty
comment: Specifies the CVSS qualitative severity rating of a vulnerability in relation to a piece of software.
range: CvssSeverityType

withdrawnTime
type: DatatypeProperty
comment: Specified the time and date when a vulnerability was withdrawn.
range: dateTimeStamp

licenseText
type: DatatypeProperty
comment: Identifies the full text of a License or Addition.
range: string

File
type: Class
type: NodeShape
comment: Refers to any object that stores content on a computer.
subclass of: SoftwareArtifact
property:
  class: FileKindType
  max count: 1
  node kind: IRI
  path: fileKind
property:
  datatype: string
  max count: 1
  node kind: Literal
  path: contentType
  pattern: ^[^\/]+\/[^\/]+$

Package
type: Class
type: NodeShape
comment: Refers to any unit of content that can be associated with a distribution of software.
subclass of: SoftwareArtifact
property:
  datatype: anyURI
  max count: 1
  node kind: Literal
  path: downloadLocation
property:
  datatype: string
  max count: 1
  node kind: Literal
  path: packageVersion
property:
  datatype: anyURI
  max count: 1
  node kind: Literal
  path: packageUrl
property:
  datatype: string
  max count: 1
  node kind: Literal
  path: sourceInfo
property:
  datatype: anyURI
  max count: 1
  node kind: Literal
  path: homePage

publishedTime
type: DatatypeProperty
comment: Specifies the time when a vulnerability was published.
range: dateTimeStamp

score
type: DatatypeProperty
comment: Provides a numerical (0-10) representation of the severity of a vulnerability.
range: decimal

vectorString
type: DatatypeProperty
comment: Specifies the CVSS vector string for a vulnerability.
range: string

SoftwareArtifact
type: Class
type: NodeShape
comment: A distinct article or unit related to Software.
subclass of: Artifact
property:
  datatype: anyURI
  max count: 2
  node kind: Literal
  path: gitoid
property:
  datatype: string
  node kind: Literal
  path: attributionText
property:
  class: SoftwarePurpose
  node kind: IRI
  path: additionalPurpose
property:
  class: SoftwarePurpose
  max count: 1
  node kind: IRI
  path: primaryPurpose
property:
  datatype: string
  max count: 1
  node kind: Literal
  path: copyrightText

AnnotationType
type: Class
comment: Specifies the type of an annotation.

Artifact
type: Class
type: NodeShape
comment: A distinct article or unit within the digital domain.
subclass of: Element
property:
  datatype: dateTimeStamp
  max count: 1
  node kind: Literal
  path: releaseTime
  pattern: ^\d\d\d\d-\d\d-\d\dT\d\d:\d\d:\d\dZ$
property:
  datatype: dateTimeStamp
  max count: 1
  node kind: Literal
  path: validUntilTime
  pattern: ^\d\d\d\d-\d\d-\d\dT\d\d:\d\d:\d\dZ$
property:
  class: Agent
  node kind: BlankNodeOrIRI
  path: originatedBy
property:
  class: Agent
  max count: 1
  node kind: BlankNodeOrIRI
  path: suppliedBy
property:
  datatype: dateTimeStamp
  max count: 1
  node kind: Literal
  path: builtTime
  pattern: ^\d\d\d\d-\d\d-\d\dT\d\d:\d\d:\d\dZ$
property:
  class: SupportType
  node kind: IRI
  path: supportLevel
property:
  datatype: string
  node kind: Literal
  path: standardName

PositiveIntegerRange
type: Class
type: NodeShape
comment: A tuple of two positive integers that define a range.
property:
  datatype: positiveInteger
  max count: 1
  min count: 1
  node kind: Literal
  path: beginIntegerRange
property:
  datatype: positiveInteger
  max count: 1
  min count: 1
  node kind: Literal
  path: endIntegerRange

ExtendableLicense
type: Class
comment: Abstract class representing a License or an OrLaterOperator.
subclass of: AnyLicenseInfo

License
type: Class
type: NodeShape
comment: Abstract class for the portion of an AnyLicenseInfo representing a license.
subclass of: ExtendableLicense
property:
  datatype: string
  max count: 1
  min count: 1
  node kind: Literal
  path: licenseText
property:
  datatype: anyURI
  node kind: Literal
  path: seeAlso
property:
  datatype: boolean
  max count: 1
  node kind: Literal
  path: isFsfLibre
property:
  datatype: string
  max count: 1
  node kind: Literal
  path: standardLicenseTemplate
property:
  datatype: string
  max count: 1
  node kind: Literal
  path: obsoletedBy
property:
  datatype: string
  max count: 1
  node kind: Literal
  path: standardLicenseHeader
property:
  datatype: boolean
  max count: 1
  node kind: Literal
  path: isDeprecatedLicenseId
property:
  datatype: string
  max count: 1
  node kind: Literal
  path: licenseXml
property:
  datatype: boolean
  max count: 1
  node kind: Literal
  path: isOsiApproved

LicenseAddition
type: Class
type: NodeShape
comment: Abstract class for additional text intended to be added to a License, but which is not itself a standalone License.
subclass of: Element
property:
  datatype: string
  max count: 1
  node kind: Literal
  path: licenseXml
property:
  datatype: anyURI
  node kind: Literal
  path: seeAlso
property:
  datatype: string
  max count: 1
  node kind: Literal
  path: standardAdditionTemplate
property:
  datatype: string
  max count: 1
  node kind: Literal
  path: obsoletedBy
property:
  datatype: string
  max count: 1
  min count: 1
  node kind: Literal
  path: additionText
property:
  datatype: boolean
  max count: 1
  node kind: Literal
  path: isDeprecatedAdditionId

ExploitCatalogType
type: Class
comment: Specifies the exploit catalog type.

VexVulnAssessmentRelationship
type: Class
type: NodeShape
comment: Asbtract ancestor class for all VEX relationships
subclass of: VulnAssessmentRelationship
property:
  datatype: string
  max count: 1
  node kind: Literal
  path: statusNotes
property:
  datatype: string
  max count: 1
  node kind: Literal
  path: vexVersion

FileKindType
type: Class
comment: Enumeration of the different kinds of SPDX file.

IntegrityMethod
type: Class
type: NodeShape
comment: Provides an independently reproducible mechanism that permits verification of a specific Element.
property:
  datatype: string
  max count: 1
  node kind: Literal
  path: comment

RelationshipCompleteness
type: Class
comment: Indicates whether a relationship is known to be complete, incomplete, or if no assertion is made with respect to relationship completeness.

comment
type: DatatypeProperty
comment: Provide consumers with comments by the creator of the Element about the Element.
range: string

SafetyRiskAssessmentType
type: Class
comment: Specifies the safety risk assessment type.

ConfidentialityLevelType
type: Class
comment: Categories of confidentiality level.

SsvcDecisionType
type: Class
comment: Specifies the SSVC decision type.

DatasetAvailabilityType
type: Class
comment: Availability of dataset

VexJustificationType
type: Class
comment: Specifies the VEX justification type.

VulnAssessmentRelationship
type: Class
type: NodeShape
comment: Abstract ancestor class for all vulnerability assessments
subclass of: Relationship
property:
  datatype: dateTimeStamp
  max count: 1
  node kind: Literal
  path: modifiedTime
  pattern: ^\d\d\d\d-\d\d-\d\dT\d\d:\d\d:\d\dZ$
property:
  datatype: dateTimeStamp
  max count: 1
  node kind: Literal
  path: withdrawnTime
  pattern: ^\d\d\d\d-\d\d-\d\dT\d\d:\d\d:\d\dZ$
property:
  class: Element
  max count: 1
  node kind: BlankNodeOrIRI
  path: assessedElement
property:
  class: Agent
  max count: 1
  node kind: BlankNodeOrIRI
  path: suppliedBy
property:
  datatype: dateTimeStamp
  max count: 1
  node kind: Literal
  path: publishedTime
  pattern: ^\d\d\d\d-\d\d-\d\dT\d\d:\d\d:\d\dZ$

LifecycleScopeType
type: Class
comment: Provide an enumerated set of lifecycle phases that can provide context to relationships.

CvssSeverityType
type: Class
comment: Specifies the CVSS base, temporal, threat, or environmental severity type.

SbomType
type: Class
comment: Provides a set of values to be used to describe the common types of SBOMs that tools may create.

PresenceType
type: Class
comment: Categories of presence or absence.

SupportType
type: Class
comment: Indicates the type of support that is associated with an artifact.

Agent
type: Class
comment: Agent represents anything with the potential to act on a system.
subclass of: Element

AnyLicenseInfo
type: Class
comment: Abstract class representing a license combination consisting of one or more licenses (optionally including additional text), which may be combined according to the SPDX license expression syntax.
subclass of: Element

ProfileIdentifierType
type: Class
comment: Enumeration of the valid profiles.

ExternalIdentifierType
type: Class
comment: Specifies the type of an external identifier.

DictionaryEntry
type: Class
type: NodeShape
comment: A key with an associated value.
property:
  datatype: string
  max count: 1
  min count: 1
  node kind: Literal
  path: key
property:
  datatype: string
  max count: 1
  node kind: Literal
  path: value

DatasetType
type: Class
comment: Enumeration of dataset types.

Element
type: Class
type: NodeShape
comment: Base domain class from which all other SPDX-3.0 domain classes derive.
property:
  class: CreationInfo
  max count: 1
  min count: 1
  node kind: BlankNodeOrIRI
  path: creationInfo
property:
  class: IntegrityMethod
  node kind: BlankNodeOrIRI
  path: verifiedUsing
property:
  datatype: string
  max count: 1
  node kind: Literal
  path: comment
property:
  datatype: string
  max count: 1
  node kind: Literal
  path: name
property:
  datatype: string
  max count: 1
  node kind: Literal
  path: description
property:
  datatype: string
  max count: 1
  node kind: Literal
  path: summary
property:
  class: Extension
  node kind: BlankNodeOrIRI
  path: extension
property:
  class: ExternalIdentifier
  node kind: BlankNodeOrIRI
  path: externalIdentifier
property:
  class: ExternalRef
  node kind: BlankNodeOrIRI
  path: externalRef

HashAlgorithm
type: Class
comment: A mathematical algorithm that maps data of arbitrary size to a bit string.

SoftwarePurpose
type: Class
comment: Provides information about the primary purpose of an Element.

ExternalRefType
type: Class
comment: Specifies the type of an external reference.

RelationshipType
type: Class
comment: Information about the relationship between two Elements.