spdx-3.0-draft-example.json

{
  "_1": "// Commit -> CI/CD (GitHub Actions) +-> Build Artifact",
  "_2": "//                                  |-> npm Package",
  "_3": "// Caveats: Physical representation, some data excluded, readability over brevity (mostly)",

  "id": "https://api.github.com/iamwillbar/license-list-XML/sboms#repository_f4ab225",
  "_type": "Document",
  "name": "SBOM for iamwillbar/license-listXML@f4ab225",
  "createdBy": "https://api.github.com/users/iamwillbar#v3",
  "externalMap": [
      {
          "externalID": "https://api.github.com/users/iamwillbar#v3",
          "elementURL": "",
          "verifiedUsing": [
              {
                  "": ""
              }
            ]
      }
  ],
  "created": "2021-05-17T12:00:00.000Z",
  "specVersion": "3.0-DRAFT",
  "profiles": ["core", "software"],
  "dataLicense": "CC0",
  "files": [
    {
        "id": "#object_d4e5f6",
        "name": "Makefile",
        "contentType": "text/plain",
        "comment": "Use local FSF Schema to fix travis-ci errors (spdx#1177)",
        "verifiedUsing": [
            {
                "_type": "Hash",
                "algorithm": "SHA512",
                "hashValue": "some_really_long_string"
            }
        ]
    }
  ],
  "elements": [
    {
        "id": "#commit_f4ab225",
        "_type": "SoftwarePackage",
        "comment": "Fix merge",
        "artifactUrl": "pkg:github/iamwillbar/license-list-XML@...",
        "relationships": [
            {
                "relationshipType": "CONTAINS",
                "to": [
                    "#object_d4e5f6"
                ]
            }
        ]
    },
    {
        "_type": "Relationship",
        "from": "#commit_f4",
        "to": ["#object_d4e5f6"],
        "relationshipType": "CONTAINS"
    },
    {
        "id": "#object_d4e5f6",
        "_type": "File",
        "name": "Makefile",
        "contentType": "text/plain",
        "comment": "Use local FSF Schema to fix travis-ci errors (spdx#1177)",
        "verifiedUsing": [
            {
                "_type": "Hash",
                "algorithm": "SHA512",
                "hashValue": "some_really_long_string"
            }
        ]
    },
    {
        "id": "#actions_runs_584753262",
        "_type": "Package",
        "name": "Test4",
        "summary": ".github/workflows/validate.yaml #2: Pull request #2 opened by goneall",
        "createdBy": "https://api.github.com/users/goneall#v4",
        "created": "2021-02-20T12:00:00.000Z",
        "relationships": [
            {
                "relationshipType": "PRODUCED",
                "to": [
                    "#actions_artifacts_238748923748",
                    "https://registry.npmjs.com/sboms#[email protected]"
                ],
                "completeness": "INCOMPLETE"
            }
        ]
    },
    {
        "id": "#actions_artifacts_238748923748",
        "_type": "SoftwarePackage",
        "name": "license-list-XML 3.2",
        "createdBy": "https://api.github.com/users/goneall#v4",
        "created": "2021-02-20T12:00:00.000Z",
        "rootElement": "license#...",
        "elements": [
            ""
        ]
    },
    {
        "id": "https://registry.npmjs.com/sboms#[email protected]",
        "_type": "SoftwarePackage",
        "name": "[email protected]",
        "createdBy": "https://api.github.com/users/goneall#v4",
        "created": "2021-02-20T12:00:00.000Z",
        "specVersion": "3.0-DRAFT-2",
        "profiles": ["core", "defect"]
    },
    {
        "id": "https://api.github.com/users/iamwillbar#v3",
        "_type": "Person",
        "name": "William Bartholomew",
        "email": "[email protected]",
        "verifiedUsing": [
            {
                "_type": "SSH",
                "public": "SHA256:LouY6XvSZTCVQ9LBkEItEHZkxzqDZa38DbxdfQEduE8"
            },
            {
                "_type": "GPG",
                "keyId": "31BF1A3D538DB4FE"
            },
            {
                "_type": "X509",
                "publicKey": ""
            }
        ],
        "externalReferences": [
            {
                "externalReferenceType": "TWITTER",
                "locator": "@iamwillbar"
            }
        ]
    }
  ]
}