An Individual Value for Element representing a set of Elements of unknown identity or cardinality (number).
An Individual Value for Element representing a set of Elements with cardinality (number/count) of zero.
An Individual Value for License when no assertion can be made about its actual value.
An Individual Value for License where the SPDX data creator determines that no license is present.
A type of extension consisting of a list of name value pairs.
Information related to physical hardware.
Provides the result of an export control assessment.
This individual element was defined by the spec.
System Package Data Exchange™ (SPDX®) Ontology
This ontology defines the terms and relationships used in the SPDX specification to describe system packages
SPDX Project
System Package Data Exchange (SPDX) Ontology
Copyright (C) 2026 SPDX Project
A Package that contains AI software or an AI model.
Kilowatt-hour.
Megajoule.
Any other units of energy measurement.
The second-highest level of risk posed by an AI system.
Low/no risk is posed by an AI system.
The third-highest level of risk posed by an AI system.
The highest level of risk posed by an AI system.
**DEPRECATED in SPDX 3.1.** Use [/Core/isoAutomationLevel](../../Core/Properties/isoAutomationLevel.md) instead. Indicates whether the system can perform a decision or action without human involvement or guidance.
Domain in which the AI package can be used.
Energy consumption incurred by an AI model.
Energy quantity.
Unit in which energy is measured.
Energy consumed when finetuning the AI model that is being used in the AI system.
Hyperparameter used to build the AI model contained in the AI package.
Energy consumed during inference time by an AI model that is being used in the AI system.
Information about the AI software, not including the model description.
Information about different steps of the training process.
Limitation of the AI software.
Metric used to evaluate the AI model.
Threshold that was used for computation of a metric described in the metric field.
Preprocessing steps applied to the training data before the model training.
Methods that can be used to explain the results from the AI model.
Results of general safety risk assessment of the AI system.
Standard that an artifact is being complied with.
Energy consumed when training the AI model that is being used in the AI system.
Type of the model used in the AI software.
Records if sensitive personal information is used during model training or could be used during the inference.
Class that describes a build instance of software/artifacts.
Property that describes the time at which a build stops.
A buildId is a locally unique identifier used by a builder to identify a unique instance of a build produced by it.
Property describing the start time of a build.
A buildType is a hint that is used to indicate the toolchain, platform, or infrastructure that the build was invoked on.
Property that describes the digest of the build configuration file used to invoke a build.
Property describes the invocation entrypoint of a build.
Property that describes the URI of the build configuration source file.
Property describing the session in which a build is invoked.
Property describing a parameter used in an instance of a build.
An assertion made in relation to one or more elements.
Used to store extra information about an Element which is not part of a review (e.g. extra information provided during the creation of the Element).
Used when someone reviews the Element.
A contact point from an Artifact to an Agent.
A contact point for compliance (i.e. export control, licensing).
A generic contact point to be used when the contact type does not match any of the other options.
A contact for reporting security vulnerabilities.
A contact point for support.
[Common Platform Enumeration Specification 2.2](https://cpe.mitre.org/files/cpe-specification_2.2.pdf).
[Common Platform Enumeration: Naming Specification Version 2.3](https://csrc.nist.gov/publications/detail/nistir/7695/final).
Common Vulnerabilities and Exposures identifiers, an identifier for a specific software flaw defined within the official CVE Dictionary and that conforms to the [CVE specification](https://csrc.nist.gov/glossary/term/cve_id).
[Data Universal Numbering System (D-U-N-S) Number](https://www.dnb.com/en-us/smb/duns.html) is a unique nine-digit identifier, issued by Dun & Bradstreet, that identifies a business entity, often on a location-specific basis.
Email address, as defined in [RFC 3696](https://datatracker.ietf.org/doc/rfc3696/) Section 3.
The UUID used by a reporting management system or any other lifecycle management tool to uniquely identify an evidence relationship item. UUID, or universally unique ID, is a standard term to refer to evidence items.
[Gitoid](https://www.iana.org/assignments/uri-schemes/prov/gitoid), stands for [Git Object ID](https://git-scm.com/book/en/v2/Git-Internals-Git-Objects). A gitoid of type blob is a unique hash of a binary artifact. A gitoid may represent either an [Artifact Identifier](https://github.com/omnibor/spec/blob/eb1ee5c961c16215eb8709b2975d193a2007a35d/spec/SPEC.md#artifact-identifier-types) for the software artifact or an [Input Manifest Identifier](https://github.com/omnibor/spec/blob/eb1ee5c961c16215eb8709b2975d193a2007a35d/spec/SPEC.md#input-manifest-identifier) for the software artifact's associated [Artifact Input Manifest](https://github.com/omnibor/spec/blob/eb1ee5c961c16215eb8709b2975d193a2007a35d/spec/SPEC.md#artifact-input-manifest); this ambiguity exists because the Artifact Input Manifest is itself an artifact, and the gitoid of that artifact is its valid identifier. Gitoids calculated on software artifacts (Snippet, File, or Package Elements) should be recorded in the SPDX 3 SoftwareArtifact's contentIdentifier property. Gitoids calculated on the Artifact Input Manifest (Input Manifest Identifier) should be recorded in the SPDX 3 Element's externalIdentifier property. See [OmniBOR Specification](https://github.com/omnibor/spec/), a minimalistic specification for describing software [Artifact Dependency Graphs](https://github.com/omnibor/spec/blob/eb1ee5c961c16215eb8709b2975d193a2007a35d/spec/SPEC.md#artifact-dependency-graph-adg).
[Global Location Number (GLN)](https://www.gs1.org/standards/id-keys/gln) is a 13-digit number, assigned by GS1, that uniquely identifies a legal entity (e.g., a company or customer), a function within a legal entity, a physical location (e.g., a warehouse or a specific shelf in a store), or a digital location (e.g., an Electronic Data Interchange (EDI) gateway).
[GLobal Unique Enterprise (GLUE) Identifiers](https://datatracker.ietf.org/doc/draft-ietf-spice-glue-id/), as defined by the IETF Internet-Draft, is expressed as a GLUE URI, a Uniform Resource Identifier that standardizes the representation of existing organizational entity identifiers.
[Global Trade Item Number (GTIN)](https://www.gs1.org/standards/id-keys/gtin) is a number, assigned by GS1, that uniquely identifies a trade item (product or service).
The [Harmonized System (HS)](https://www.wcoomd.org/en/topics/nomenclature/overview/what-is-the-harmonized-system.aspx) of tariff nomenclature is an internationally standardized system of names and numbers, defined by the World Customs Organization, used to classify traded products.
The [Legal Entity Identifier (LEI)](https://www.gleif.org/en/organizational-identity/introducing-the-legal-entity-identifier-lei) is a 20-character, alphanumeric code based on the [ISO 17442](https://www.iso.org/standard/78829.html) standard developed by the International Organization for Standardization.
Used when the type does not match any of the other options.
Package URL, as defined in the corresponding [Annex](../../../annexes/pkg-url-specification.md) of this document.
Phone number; A string of decimal digits that uniquely indicates the network termination point defined in [RFC 3966](https://datatracker.ietf.org/doc/rfc3966/) Section 5.
The UUID used by a requirements management or any other lifecycle management tool to uniquely identify a requirement item. UUID, or universally unique ID, is a standard term in requirements engineering.
Used when there is a security related identifier of unspecified type.
SoftWare Hash IDentifier, a persistent intrinsic identifier for digital artifacts, such as files, trees (also known as directories or folders), commits, and other objects typically found in version control systems. The format of the identifiers is defined in the [SWHID specification](https://www.swhid.org/swhid-specification/v1.2/) ([ISO/IEC 18670](https://www.iso.org/standard/89985.html)). They typically look like `swh:1:cnt:94a9ed024d3859793618152ea559a168bbcbb5e2`.
Concise Software Identification (CoSWID) tag, as defined in [RFC 9393](https://datatracker.ietf.org/doc/rfc9393/) Section 2.3.
[Uniform Resource Identifier (URI) Schemes](https://www.iana.org/assignments/uri-schemes/uri-schemes.xhtml). The scheme used in order to locate a resource.
The UUID used by a verification management system or any other lifecycle management tool to uniquely identify a verification item. UUID, or universally unique ID, is a standard term to refer to verification items.
Absolute URL that can be used to locate a resource, as defined in [RFC 7230](https://datatracker.ietf.org/doc/rfc7230/) Section 2.7.1 or Section 2.7.2.
A reference to an alternative download location.
A reference to an alternative web page.
A reference to binary artifacts related to a package.
A reference to a Bower package. The package locator format, looks like `package#version`, is defined in the "install" section of [Bower API documentation](https://bower.io/docs/api/#install).
A reference build metadata related to a published package.
A reference build system used to create or publish the package.
A reference to a certification report for a package from an accredited/independent body.
A reference to the instant messaging system used by the maintainer for a package.
A reference to a Software Composition Analysis (SCA) report.
[Common Weakness Enumeration](https://csrc.nist.gov/glossary/term/common_weakness_enumeration). A reference to a source of software flaw defined within the official [CWE List](https://cwe.mitre.org/data/) that conforms to the [CWE specification](https://cwe.mitre.org/).
A reference to the documentation for a package.
A reference to a dynamic analysis report for a package.
A reference to the End Of Sale (EOS) and/or End Of Life (EOL) information related to a package.
A reference to an export control assessment for a package.
A reference to funding information related to a package.
A reference to the issue tracker for a package.
A reference to additional license information related to an artifact.
A reference to the mailing list used by the maintainer for a package.
A reference to a Maven repository artifact. The artifact locator format is defined in the [Maven documentation](https://maven.apache.org/guides/mini/guide-naming-conventions.html) and looks like `groupId:artifactId[:version]`.
A reference to metrics related to package such as OpenSSF scorecards.
A reference to an npm package. The package locator format is defined in the [npm documentation](https://docs.npmjs.com/cli/v10/configuring-npm/package-json) and looks like `package@version`.
A reference to a NuGet package. The package locator format is defined in the [NuGet documentation](https://docs.nuget.org) and looks like `package/version`.
A reference to a privacy assessment for a package.
A reference to additional product metadata such as reference within organization's product catalog.
A reference to a purchase order for a package.
A reference to a quality assessment for a package.
A reference to a published list of releases for a package.
A reference to the release notes for a package.
A reference to a risk assessment for a package.
A reference to a runtime analysis report for a package.
A reference to information assuring that the software is developed using security practices as defined by [NIST SP 800-218 Secure Software Development Framework (SSDF) Version 1.1](https://csrc.nist.gov/pubs/sp/800/218/final) or [CISA Secure Software Development Attestation Form](https://www.cisa.gov/resources-tools/resources/secure-software-development-attestation-form).
A reference to the security adversary model for a package.
A reference to a published security advisory (where advisory as defined per [ISO 29147:2018](https://www.iso.org/standard/72311.html)) that may affect one or more elements, e.g., vendor advisories or specific NVD entries.
A reference to the patch or source code that fixes a vulnerability.
A reference to related security information of unspecified type.
A reference to a [penetration test](https://en.wikipedia.org/wiki/Penetration_test) report for a package.
A reference to instructions for reporting newly discovered security vulnerabilities for a package.
A reference the [security threat model](https://en.wikipedia.org/wiki/Threat_model) for a package.
A reference to a social media channel for a package.
A reference to an artifact containing the sources for a package.
A reference to a static analysis report for a package.
A reference to the software support channel or other support information for a package.
A reference to a version control system related to a software artifact.
A reference to a Vulnerability Disclosure Report (VDR) which provides the software supplier's analysis and findings describing the impact (or lack of impact) that reported vulnerabilities have on packages or products in the supplier's SBOM as defined in [NIST SP 800-161 Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations](https://csrc.nist.gov/pubs/sp/800/161/r1/final).
A reference to a Vulnerability Exploitability eXchange (VEX) statement which provides information on whether a product is impacted by a specific vulnerability in an included package and, if affected, whether there are actions recommended to remediate. See also [NTIA VEX one-page summary](https://ntia.gov/files/ntia/publications/vex_one-page_summary.pdf).
A reference to an X.509 certificate as defined in [RFC 1422](https://datatracker.ietf.org/doc/rfc1422/). The media type shall be one of application/x-x509-ca-cert or application/x-x509-user-cert.
Level 1 - Assistive automation. The system assists an operator.
Level 6 - Autonomous. The system is capable of modifying its intended domain of use or its goals without external intervention, control or oversight.
Level 3 - Conditional automation. The system can propose strategies and then automatically execute the approved plan, with an external agent being ready to take over when necessary.
Level 5 - Full automation. The system is capable of performing its entire mission without external intervention.
Level 4 - High automation. The system performs parts of its mission without external intervention.
Level 0 - Not automated. No automation. The operator fully controls the system.
Level 2 - Partial automation or task automation. Some sub-functions of the system are fully automated while the system remain under control of an external agent. The system can perform actions for an approved task without requiring the agent's continuous direct control.
Provide context for a relationship that occurs in the lifecycle.
An SPDX version 2.X compatible verification method for software packages.
An individual human being.
A physical location is a tangible, geographically identifiable place where objects, people, or assets exist or operate.
in use
in production
superseded or not valid at present
other
The element follows the AI profile specification.
The element follows the Build profile specification.
The element follows the Core profile specification.
The element follows the Dataset profile specification.
The element follows the ExpandedLicensing profile specification.
The element follows the Extension profile specification.
The element follows the Hardware profile specification.
The element follows the Lite profile specification.
The element follows the Security profile specification.
The element follows the SimpleLicensing profile specification.
The element follows the Software profile specification.
The element follows the SupplyChain profile specification.
Regulation represents a rule or directive maintained by an authority.
The relationship is known to be exhaustive.
The relationship is known not to be exhaustive.
No assertion can be made about the completeness of the relationship.
The `from` Vulnerability, Action or DefinedProcess affects each `to` Element.
The `from` Element is amended by each `to` Element.
The `from` Element is an ancestor of each `to` Element.
The `from` Element is available from the additional supplier described by each `to` Element.
The `from` Element is a configuration applied to each `to` Element, during a LifecycleScopeType period.
The `from` Element conforms to each `to` Specification.
The `from` Element contains each `to` Element.
The `from` Vulnerability is coordinatedBy the `to` Agent(s) (vendor, researcher, or consumer agent).
The `from` Element has been copied to each `to` Element.
The `from` Element's Action or DefinedProcess is createdBy `to` Agent(s).
The `from` Agent is delegating an action to the Agent of the `to` Relationship (which shall be of type invokedBy), during a LifecycleScopeType (e.g. the `to` invokedBy Relationship is being done on behalf of `from`).
The `from` Element depends on each `to` Element, during a LifecycleScopeType period.
The `from` Element is a descendant of each `to` Element.
The `from` Element describes each `to` Element. To denote the root(s) of a tree of elements in a collection, the rootElement property shall be used.
The `from` Vulnerability has no impact on each `to` Element. The use of the `doesNotAffect` is constrained to `VexNotAffectedVulnAssessmentRelationship` classed relationships.
The `from` Element has been evaluated on the `to` Element(s).
The `from` Element expands out as an artifact described by each `to` Element.
The `from` Vulnerability has had an exploit created against it by each `to` Agent.
The `from` Element has been finetuned on the `to` Element(s).
Designates a `from` Vulnerability has been fixed by the `to` Agent(s).
A `from` Vulnerability has been fixed in each `to` Element. The use of the `fixedIn` type is constrained to `VexFixedVulnAssessmentRelationship` classed relationships.
The `to` Element succeeds the `from` Element, establishing a unidirectional sequence. This succession is defined as chronological, procedural, or logical. It is used to represent either a temporal order (e.g., in a workflow) or a logical order for processing and traversal (e.g., in an ordered list).
Designates a `from` Vulnerability was originally discovered by the `to` Agent(s).
The `from` Element generates each `to` Element.
Every `to` Element is a file added to the `from` Element (`from` hasAddedFile `to`).
Relates a `from` Vulnerability and each `to` Element with a security assessment. To be used with `VulnAssessmentRelationship` types.
Used to associate a `from` Artifact with each `to` Vulnerability.
The `from` SoftwareArtifact is concluded by the SPDX data creator to be governed by each `to` AnyLicenseInfo.
The `from` Artifact has each `to` Agent as a contact point. The use of `hasContactPoint` type is constrained to `ContactPointRelationship` typed relationships. The type of contact (i.e. security) may be specified using a `ContactPointRelationship` element.
The `from` Element treats each `to` Element as a data file. A data file is an artifact that stores data required or optional for the `from` Element's functionality. A data file can be a database file, an index file, a log file, an AI model file, a calibration data file, a temporary file, a backup file, and more. For AI training dataset, test dataset, test artifact, configuration data, build input data, and build output data, please consider using the more specific relationship types: `trainedOn`, `testedOn`, `hasTest`, `configures`, `hasInput`, and `hasOutput`, respectively. This relationship does not imply dependency.
The `from` SoftwareArtifact was discovered to actually contain each `to` AnyLicenseInfo (for example, as detected by automated tooling).
Every `to` Element is a file deleted from the `from` Element (`from` hasDeletedFile `to`).
The `from` Element has manifest files that contain dependency information in each `to` Element.
The `from` Element is distributed as an artifact in each `to` Element (e.g. an RPM or archive file).
The `from` Element is documented by each `to` Element.
The `from` Element dynamically links in each `to` Element, during a LifecycleScopeType period.
Every `to` Element is considered as evidence for the `from` Element (`from` hasEvidence `to`).
Every `to` Element is an example for the `from` Element (`from` hasExample `to`).
The `from` Build was run on the `to` Element during a LifecycleScopeType period (e.g. the host that the build runs on).
The `from` Build, DefinedProcess or Action element has each `to` Element as an input.
Every `to` Element is metadata about the `from` Element (`from` hasMetadata `to`).
Every `to` Element is an optional component of the `from` Element (`from` hasOptionalComponent `to`).
The `from` Element optionally depends on each `to` Element, during a LifecycleScopeType period.
The `from` Build, DefinedProcess or Action element generates each `to` Element as an output.
The `from` Element has a prerequisite on each `to` Element, during a LifecycleScopeType period.
The `from` Element has a dependency on each `to` Element, dependency is not in the distributed artifact, but assumed to be provided, during a LifecycleScopeType period.
The `from` Element has a requirement on each `to` Element, during a LifecycleScopeType period.
The `from` ResolutionAction point to the `to` OutOfSpecAction that is addressed.
Every `to` Element is a specification for the `from` Element (`from` hasSpecification `to`), during a LifecycleScopeType period.
The `from` Element statically links in each `to` Element, during a LifecycleScopeType period.
Every `to` Element is a test artifact for the `from` Element (`from` hasTest `to`), during a LifecycleScopeType period.
Every `to` Element is a test case for the `from` Element (`from` hasTestCase `to`).
Every `to` Element is a variant the `from` Element (`from` hasVariant `to`).
The `from` Requirement is implemented in the `to` Element(s).
The `from` Element was invoked by the `to` Agent, during a LifecycleScopeType period (for example, a Build element that describes a build step).
`from` element located at a specific `to` location. A time period is optional.
The `from` Element is modified by each `to` Element.
Every `to` Element is related to the `from` Element where the relationship type is not described by any of the SPDX relationship types (this relationship is directionless).
Every `to` Element is a packaged instance of the `from` Element (`from` packagedBy `to`).
Every `to` Element is a patch for the `from` Element (`from` patchedBy `to`).
Every `from` action is performedBy `to` Agent.
The `from` Element has been pretrained on the `to` Element(s).
The `from` Agent provides support for each `to` Artifact. Shall be a `SupportRelationship` type.
Designates a `from` Vulnerability was made available for public use or reference by each `to` Agent.
Designates a `from` Vulnerability was first reported to a project, vendor, or tracking database for formal identification by each `to` Agent.
Designates a `from` Vulnerability's details were tracked, aggregated, and/or enriched to improve context (i.e. NVD) by each `to` Agent.
The `to` OutOfSpecAction is resolved in the `from` ResolutionAction.
The `from` Element (the instructions) of runs on each `to` Hardware (processing element), during a LifecycleScopeType period.
The `from` SpdxDocument can be found in a serialized form in each `to` Artifact.
The `from` Element has been tested on the `to` Element(s).
the `from` Requirement is refined and further elaborated by each `to` Requirement, which contains more detailed implementation information.
The `from` Element has been trained on the `to` Element(s).
The `from` Vulnerability impact is being investigated for each `to` Element. The use of the `underInvestigationFor` type is constrained to `VexUnderInvestigationVulnAssessmentRelationship` classed relationships.
The `from` Element uses each `to` Element as a tool, during a LifecycleScopeType period.
The `from` Element has been validated on the `to` Element(s).
The `from` Requirement that has verification (test, review, analysis etc.) details defined in the `to` RequirementVerification.
A distinct unit representing a requirement, as used in systems, software, and hardware engineering.
A software agent.
A collection of SPDX Elements that could potentially be serialized.
A formal standard is a standard ratified by a recognized standards-development organization and published as a normative reference.
Any specification that does not fall under any of the other entries.
A mandatory legal specification issued by a governmental or regulatory authority. Compliance is enforceable by law.
A specification is a detailed document (or set of documents) that describes the requirements, design, behavior, or other characteristics of a system, component, or process so that all stakeholders have a clear, unambiguous reference.
Describes how an Agent provides support for an Artifact.
Property that describes the time at which an action stops.
Location of a specific action.
Property describing the start time of an action.
Additional relevance information.
Describes the type of annotation.
Defines the beginning of a range.
Specifies the time an artifact was built.
City is a specific name used to define a locality.
Provides information about the completeness of relationships.
Identifies the nature of the contactPointRelationship.
Gives information about the circumstances or unifying properties that Elements of the bundle have been assembled under.
Specifies a country code of the location.
A code that identifies a county.
Identifies when the Element was originally created.
Identifies who or what created the Element.
Identifies the tooling that was used during the creation of the Element.
Provides information about the creation of the Element.
Provides the license under which the SPDX documentation of the Element can be used.
Artifact representing a serialization instance of SPDX data containing the definition of a particular Element.
It is the authoritative or credible entity, document, or body of knowledge that provides the meaning of a type, ensuring accuracy, context, and standardization.
Provides a detailed description of the Element.
The product lifecycle phase, the requirement is applicable for.
Refers to one or more Elements that are part of an ElementCollection.
A value used in a key-value pair with a generic key that refers to an Element
Defines the end of a range.
Specifies the time from which an element is no longer applicable / valid.
Provides a reference to a resource outside the scope of SPDX 3 content that uniquely identifies an Element.
Specifies the type of the external identifier.
Points to a resource outside the scope of the SPDX 3 content that provides additional characteristics of an Element.
Specifies the type of the external reference.
Identifies an external Element used within an SpdxDocument but defined external to that SpdxDocument.
References the Element on the left-hand side of a relationship.
This is a set of point coordinates as defined in by the GPS standard.
The headquartersLocation defines the location of the organization's headquarters.
Uniquely identifies an external element.
Provides the location for more information regarding an external identifier.
Provides an ExternalMap of Element identifiers.
Specifies a human language used within the content of an Element or a property.
The intendedUse property is designed to capture a summary of how or for what item or artifact is meant to be used for.
ISO level of automation.
An entity that is authorized to issue identification credentials.
Provides an indication of where to retrieve an external Element.
A known location is specified at this time.
Provides the location of an external reference.
Identifies the name of an Element as designated by the creator.
Provides an unambiguous mechanism for conveying a URI fragment portion of an Element ID.
Provides a NamespaceMap of prefixes and associated namespace partial URIs applicable to an SpdxDocument and independent of any specific serialization format or instance.
Identifies from where or whom the Element originally came.
The relative file name of a file to be excluded from the `PackageVerificationCode`.
The number that identifies a PO box. A PO box is a box in a post office or other postal service location assigned to an organization where postal items may be kept.
Text specifying the postal code for an address.
The name of the recipient expressed in text.
A substitute for a URI.
The reason a process exists.
processReadiness describes the readiness of a process.
Defines the version of a specific process.
Describes one a profile which the creator of this ElementCollection intends to conform to.
Text specifying a province or state.
Quantity is the amount in the selected QUDT unit.
Information about the relationship between two Elements.
Specifies the time an artifact was released.
Text used to define the rationale or additional information.
A text describing the actual need defined by the requirement.
Provides a universally unique Requirement ID.
This property is used to denote the root Element(s) of a tree of elements contained in a BOM.
Capture the scope of information about a specific relationship between elements.
A specification type defines the nature of a specification.
Provides a reference number that can be used to understand how to parse and interpret an Element.
The name of a relevant standard that may apply to an artifact.
Specifies the time from which an element is applicable / valid.
Commentary on an assertion that an annotator has made.
Street address includes a street number, name and unit ID to identify a specific street.
An Element an annotator has made an assertion about.
A short description of an Element.
References an Element on the right-hand side of a relationship.
typeFromSource is a value used to define an item within the definitionSource.
QUDT unit is used for measurement criteria based on product type, region and use.
Specifies until when the artifact can be used before its usage needs to be reassessed.
A value used in a generic key-value pair.
Data points in the dataset can be shared only with specific organizations and their clients on a need to know basis.
Dataset may be distributed freely, without restriction.
Dataset can be shared within a community of peers and partners.
Data points in the dataset are highly confidential and can only be shared with named recipients.
Dataset is not publicly available and can only be accessed after affirmatively accepting terms on a clickthrough webpage.
Dataset is publicly available and can be downloaded directly.
Dataset is publicly available, but not all at once, and can only be accessed through queries which return parts of the dataset.
Dataset is not publicly available and an email registration is required before accessing the dataset, although without an affirmative acceptance of terms.
Dataset provider is not making available the underlying data and the dataset shall be reassembled, typically using the provided script for scraping the data.
A Package that contains a dataset.
Data is audio based, such as a collection of music from the 80s.
Data that is classified into a discrete number of categories, such as the eye color of a population of people.
Data is in the form of a graph where entries are somehow related to each other through edges, such a social network of friends.
Data is a collection of images such as pictures of animals.
Data type is not known.
Data consists only of numeric entries.
Data is of a type not included in this list.
Data is recorded from a physical sensor, such as a thermometer reading or biometric device.
Data is stored in tabular format or retrieved from a relational database.
Data describes the syntax or semantics of a language or text, such as a parse tree used for natural language processing.
Data consists of unstructured text, such as a book, a Wikipedia article (without images), or a transcript.
Data is recorded in an ordered sequence of timestamped entries, such as the price of a stock over the course of a day.
Data is recorded with a timestamp for each entry, but not necessarily ordered or at specific intervals, such as when a taxi ride starts and ends.
Data is video based, such as a collection of movie clips featuring Tom Hanks.
Anonymization methods used.
Confidentiality level of the data points contained in the dataset.
How the dataset was collected.
Preprocessing steps that were applied to the raw data to create the given dataset.
Availability of a dataset.
Potentially noisy elements of the dataset.
**DEPRECATED in SPDX 3.1.** Use [/Software/artifactSize](../../Software/Properties/artifactSize.md) instead. Size of the dataset.
Type of data in a dataset.
Mechanism to update the dataset.
Describes if any sensitive personal information is present in the dataset.
**DEPRECATED in SPDX 3.1.** Use [/Core/intendedUse](../../Core/Properties/intendedUse.md) instead. The intended use of a given dataset.
Records the biases that the dataset is known to encompass.
Describes a sensor used for collecting the data.
Portion of an AnyLicenseInfo representing a set of licensing information where all elements apply.
A license that is not listed on the SPDX License List.
A license addition that is not listed on the SPDX Exceptions List.
Portion of an AnyLicenseInfo representing a set of licensing information where only one of the elements applies.
A license that is listed on the SPDX License List.
A license exception that is listed on the SPDX Exceptions list.
Portion of an AnyLicenseInfo representing this version, or any later version, of the indicated License.
Portion of an AnyLicenseInfo representing a License which has additional text applied to it.
Identifies the full text of a LicenseAddition.
Specifies whether an additional text identifier has been marked as deprecated.
Specifies whether a license or additional text identifier has been marked as deprecated.
Specifies whether the License is listed as free by the Free Software Foundation (FSF).
Specifies whether the License is listed as approved by the Open Source Initiative (OSI).
Identifies the full text of a LicenseAddition, in SPDX templating format.
Provides a License author's preferred text to indicate that a file is covered by the License.
Identifies the full text of a License, in SPDX templating format.
A LicenseAddition participating in a 'with addition' model.
A License participating in a 'with addition' model.
A License participating in an 'or later' model.
A name used in a CdxPropertyEntry name-value pair.
A value used in a CdxPropertyEntry name-value pair.
Provides a map of a property name to a value.
EvaluationResult is the result of an evaluation.
Indicates a failed evaluation where the requirement or condition is not met.
Inconclusive refers to a result or outcome from a verification, test, or analysis that cannot be clearly classified as either positive (successful, pass) or negative (failed, reject). An inconclusive result means there was not enough clear evidence, data, or signal to make a definitive determination, and further investigation or additional testing is necessary. An inconclusive result always shall need a comment on it.
Indicates a successful evaluation where the requirement or condition is clearly met.
EvidenceRelationship defines the association between pieces of evidence and EvaluationResult.
Time-stamped records capturing system or operational data recorded as usually as a response to specific triggers in a specified environment.
Documentation of direct monitoring or witnessing of the demonstration of processes, tests, or any kind of system responses during a specified timeframe under specified environmental conditions.
Any other relevant type of proof or documentation not covered above.
Captured datastream like audio, video, or any other kind of continuous electronic capture of events, behavior or conditions.
Structured documentation of test results, inspections, or analyses.
Analytical evaluating of data, designs, or processes methodically to verify correctness against standards or expectations. Typical analysis methods are FMEA, FTA, STPA, static analysis for MISRA compliance etc.
A systematic examination of a system, process, or outcome to evaluate compliance of specific work products with a specific expectation with a specification, regulation or standard. Often involves judgement and a rationale of this judgement.
An examination typically focusing on compliance with policies, standards, or regulations. Usually this is done during an audit meeting, while the assessment also involves deep and detailed reviews of work products (e.g. requirements, verification specifications, reports etc.)
Demonstrating and monitoring or recording that the item under verification to confirm that a requirement is met by the item under verification.
A thorough examination or checking of documentation, records, processes, or systems to confirm compliance or adherence. An inspection needs to have a defined set of acceptance criteria (e.g. a checklist), a documentation of roles involved in the inspection (e.g. to document the inspector's independence) and a clear documentation of when and how it was performed.
Any other specialized or custom verification method that fits the context.
A examination or checking of documentation, records, processes, or systems to confirm compliance or adherence with an upper level requirement. Typically done as peer review, offline review or review meeting.
Conducting controlled tests, experiments or simulations to verify that specific requirements regarding performance, functionality, robustness, etc. are met.
Evaluation is an outcome considering results of a verification.
Indicates the specific RequirementVerification instance on which the EvaluationResult is based.
Detailed explanation or reasoning that supports the EvaluationResult.
evidenceCategory refers to a category of documented or observable proof.
A evidenceUUID is a universally unique identifier (UUID) assigned to an entity, item, or requirement.
verificationMethod refers to the specific approach used for a checking an element's conformance with its requirements.
Verification postcondition that are true immediately after a verification method has been performed
Verification preconditions are initial criteria that are to be met prior to initiating the verification method.
A verificationRationale is supporting information that justifies the verification details.
A verificationUUID is a universally unique identifier (UUID) assigned to a Verification item.
Products or commodities produced as a bulk unit are called bulk products. Commodities are often sold in bulk.
Class that describes a physical instance of Hardware.
A product specification (product spec) is a detailed document that outlines the technical, functional, and design requirements of a product.
Class that describes an instance of VirtualHardware.
Simulation architectures with precise cycle-level accuracy.
Simulation the function of the hardware.
All other simulation types.
It is the authoritative or credible entity, document, or body of knowledge that provides the meaning of an additionalInformation key and/or its values, ensuring accuracy, context, and standardization.
Identifier for product production batch.
The amount or measure of a bulk product.
The category describes the hardware item in a DefinedType.
A point representing the mean position of the matter in a body or system.
Information related to hardware dimension.
Version identifier for the hardware product.
Version identifier for the item.
Information related to massOfHardware physical hardware.
The Agent who is responsible for product branding such as an OEM.
Date of product release.
Identifier for specific product is called a serial number.
Information related to virtual hardware simulation.
Assement of an Element for export control classification.
Specifies an Element as subject of an assessment.
Sets the context for an assessment iby specifying the related project.
Timestamp, when an assessment was conducted.
An entity providing an assessment.
Expression for the export control classification.
Specification basis for the export control classification.
Country for which export controls must be taken into account.
Link to the project contract.
Time when the project ends or is planned to end.
Owner or Lead of the project.
Sponsor of the project.
Time when the project starts or is planned to start.
Title of the project.
Weight to express relevance in de minimis consideration.
Provides a CVSS version 2.0 assessment for a vulnerability.
Provides a CVSS version 3 assessment for a vulnerability.
Provides a CVSS version 4 assessment for a vulnerability.
Provides an EPSS assessment for a vulnerability.
CISA's Known Exploited Vulnerability (KEV) catalog.
Other exploit catalogs.
Provides an exploit assessment of a vulnerability.
The vulnerability requires attention from the organization's internal, supervisory-level and leadership-level individuals. Necessary actions include requesting assistance or information about the vulnerability, as well as publishing a notification either internally and/or externally. Typically, internal groups would meet to determine the overall response and then execute agreed upon actions. CISA recommends remediating Act vulnerabilities as soon as possible.
The vulnerability requires attention from the organization's internal, supervisory-level individuals. Necessary actions include requesting assistance or information about the vulnerability, and may involve publishing a notification either internally and/or externally. CISA recommends remediating Attend vulnerabilities sooner than standard update timelines.
The vulnerability does not require action at this time. The organization would continue to track the vulnerability and reassess it if new information becomes available. CISA recommends remediating Track vulnerabilities within standard update timelines.
("Track\*" in the SSVC spec) The vulnerability contains specific characteristics that may require closer monitoring for changes. CISA recommends remediating Track\* vulnerabilities within standard update timelines.
Provides an SSVC assessment for a vulnerability.
Connects a vulnerability and an element designating the element as a product affected by the vulnerability.
Links a vulnerability and elements representing products (in the VEX sense) where a fix has been applied and are no longer affected.
The software is not affected because the vulnerable component is not in the product.
Built-in inline controls or mitigations prevent an adversary from leveraging the vulnerability.
The vulnerable component is present, and the component contains the vulnerable code. However, vulnerable code is used in such a way that an attacker cannot mount any anticipated attack.
The affected code is not reachable through the execution of the code, including non-anticipated states of the product.
The product is not affected because the code underlying the vulnerability is not present in the product.
Links a vulnerability and one or more elements designating the latter as products not affected by the vulnerability.
Designates elements as products where the impact of a vulnerability is being investigated.
Specifies a vulnerability and its associated information.
Provides advise on how to mitigate or remediate a vulnerability when a VEX product is affected by it.
Records the time when a recommended action was communicated in a VEX statement to mitigate a vulnerability.
Specifies an Element contained in a piece of software where a vulnerability was found.
Specifies the exploit catalog type.
Provide the enumeration of possible decisions in the [Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree](https://www.cisa.gov/stakeholder-specific-vulnerability-categorization-ssvc).
Denote whether a CVE is present in an exploit catalog.
Explains why a VEX product is not affected by a vulnerability. It is an alternative in VexNotAffectedVulnAssessmentRelationship to the machine-readable justification label.
Timestamp of impact statement.
Impact justification label to be used when linking a vulnerability to an element representing a VEX product with a VexNotAffectedVulnAssessmentRelationship relationship.
Provides the location of an exploit catalog.
The percentile of the current probability score.
A probability score between 0 and 1 of a vulnerability being exploited.
Conveys information about how VEX status was determined.
Specifies the version of a VEX statement.
Certificate Revocation List, or CRL, is a list of revoked certificates that is downloaded from the Certificate Authority (CA).
Online Certificate Status Protocol, or OCSP, is a common scheme used to maintain the security of a server and other network resources.
An authentication protocol not covered by one of the other AuthenticationProtocolTypes.
Transport Layer Security, or TLS, is a widely adopted security protocol designed to facilitate privacy and data security for communications over the Internet.
Software provided as a service over a network.
The provider of a SoftwareService.
Authentication protocol used by a server.
Specifies a country code where a software service is hosted.
An SPDX Element containing an SPDX license expression string.
A license or addition that is not listed on the SPDX License List.
Maps a "LicenseRef-" string for a custom license or a "AdditionRef-" string for a custom license addition to a `CustomLicense`, a `CustomLicenseAddition`, or a `SimpleLicensingText`.
**DEPRECATED in SPDX 3.1.** Use [customIdToLicense](./customIdToLicense.md) instead. Maps a LicenseRef or AdditionRef string for a Custom License or a Custom License Addition to its URI ID. **NOTE:** This property is deprecated and only included for backward compatibility. New documents should use [customIdToLicense](./customIdToLicense.md) instead.
A string in the license expression format.
The version of the SPDX License List used in the license expression.
The file represents a directory and all content stored in that directory.
The file represents a single file (default).
A collection of SPDX Elements describing a single package.
SBOM generated through analysis of artifacts (e.g., executables, packages, containers, and virtual machine images) after its build. Such analysis generally requires a variety of heuristics. In some contexts, this may also be referred to as a "3rd party" SBOM.
SBOM generated as part of the process of building the software to create a releasable artifact (e.g., executable or package) from data such as source files, dependencies, built components, build process ephemeral data, and other SBOMs.
SBOM provides an inventory of software that is present on a system. This may be an assembly of other SBOMs that combines analysis of configuration options, and examination of execution behavior in a (potentially simulated) deployment environment.
SBOM of intended, planned software project or product with included components (some of which may not yet exist) for a new software artifact.
SBOM generated through instrumenting the system running the software, to capture only components present in the system, as well as external call-outs or dynamically loaded components. In some contexts, this may also be referred to as an "Instrumented" or "Dynamic" SBOM.
SBOM created directly from the development environment, source files, and included dependencies used to build a product artifact.
Describes a certain part of a file.
Provides additional purpose information of the software artifact.
Identifies the size of a software Artifact, in bytes.
Provides a place for the SPDX data creator to record acknowledgement text for a software Package, File or Snippet.
Defines the byte range in the original host file that the snippet information applies to.
A canonical, unique, immutable identifier of the artifact content, that may be used for verifying its identity and/or integrity.
Specifies the type of the content identifier.
Specifies the value of the content identifier.
Identifies the text of one or more copyright notices for a software Package, File or Snippet, if any.
Identifies the download Uniform Resource Identifier for the package at the time that the document was created.
Describes if a given file is a directory or non-directory kind of file.
A place for the SPDX document creator to record a website that serves as the package's home page.
Defines the line range in the original host file that the snippet information applies to.
Provides a place for the SPDX data creator to record the package URL string (in accordance with the Package URL specification) for a software Package.
Identify the version of a package.
Provides information about the primary purpose of the software artifact.
Provides information about the type of an SBOM.
Defines the original host file that the snippet information applies to.
Records any relevant background information or additional comments about the origin of the package.
AssemblyAction represents the event of creating a product by assembling individual components.
The AssemblyProcess represents the process of creating a product by assembling a set of components, potentially in a way that allows for at disassembly (at least partially).
An action of crossing a boundary is defined in this class.
The boundary definition is used to define boundaries.
The Boundary Definition Process refers to the process class used to produce boundaries.
An actual change to a product.
A prescribed change to a product.
The record of destruction is entered in this action.
The destruction process is defined in this process.
HarvestAction represents the act of creating a product by directly extracting goods or materials from nature.
Harvest is the process of extracting goods or products from nature.
An inspection action refers to a specific activity or set of activities performed during an inspection to examine, verify, or evaluate an item, process, or system.
Inspection Process defines specific various processes needed to satisfy the inspection requirements for a specific product or service.
Class that describes an InstantiateVirtualHardwareProcess that is used to define VirtualHardware and its source.
ManufactureAction represents the act of creating a product by a manufacturing process.
This class represents the process involved in manufacturing products.
An out of specification action is defined in this class.
A PlanAction involves the execution of a plan in relation to a PlanProcess.
Process plans outline the stages of implementation or use related to a process.
Reproduction is the biological process by which organisms generate new individuals of the same species.
Reproduction is the biological process by which living organisms produce offspring.
Products out of specification require a resolution action. This is the action of resolution.
ResponsibilityChangeAction refers to the transfer of responsibility from one party to another.
ResponsibilityChangeProcess refers to the process of transferring responsibility from one party to another.
This is the state of an affected Element at a specific moment in time.
Records the storage of a product.
Prescribes the storage of a product.
A test action is a specific action associated with a test.
Test Process defines the testing process for an element.
An actual change to a product's location.
A prescribed change to a product's location.
The boundary parameters define the area or region needed to describe a boundary.
This is the individual, business, or organization who currently manages goods, services, or assets.
This is the state of an affected Element.
This is how the currentState of an affected Element is found.
This is the agent that performed the act of destroying the item.
The location for dropping off or delivering a package or item.
The location that an item will be dropping off or delivered.
The location for picking up a package or item.
This is the planned individual, business, or organization who currently manages goods, services, or assets.
The planned location that a good, product or material is inspected.
This is the planned individual, business, or organization who was previously managing goods, services, or assets.
This is the planned product associated with the change of responsibility.
The planned location that a good, product or material is stored.
A transport route refers to the planned path or network used to move people, goods, data, or resources from one location to another.
This is the individual, business, or organization who was previously managing goods, services, or assets.
The element that has it's responsibility changed.
A transport route refers to the specific path or network used to move people, goods, data, or resources from one location to another.
The valid state for DefinedStateProcess.
A container for a grouping of SPDX 3 content characterizing details (provenance, composition, licensing, etc.) about a product.
Adler-32 checksum is part of the widely used zlib compression library as defined in [RFC 1950](https://datatracker.ietf.org/doc/rfc1950/) Section 2.3.
BLAKE2b algorithm with a digest size of 256, as defined in [RFC 7693](https://datatracker.ietf.org/doc/rfc7693/) Section 4.
BLAKE2b algorithm with a digest size of 384, as defined in [RFC 7693](https://datatracker.ietf.org/doc/rfc7693/) Section 4.
BLAKE2b algorithm with a digest size of 512, as defined in [RFC 7693](https://datatracker.ietf.org/doc/rfc7693/) Section 4.
[BLAKE3](https://github.com/BLAKE3-team/BLAKE3-specs/blob/master/blake3.pdf)
[Dilithium](https://pq-crystals.org/dilithium/)
[Kyber](https://pq-crystals.org/kyber/)
[FALCON](https://falcon-sign.info/falcon.pdf)
MD2 message-digest algorithm, as defined in [RFC 1319](https://datatracker.ietf.org/doc/rfc1319/).
MD4 message-digest algorithm, as defined in [RFC 1186](https://datatracker.ietf.org/doc/rfc1186/).
MD5 message-digest algorithm, as defined in [RFC 1321](https://datatracker.ietf.org/doc/rfc1321/).
[MD6 hash function](https://people.csail.mit.edu/rivest/pubs/RABCx08.pdf)
any hashing algorithm that does not exist in this list of entries
SHA-1, a secure hashing algorithm, as defined in [RFC 3174](https://datatracker.ietf.org/doc/rfc3174/).
SHA-2 with a digest length of 224, as defined in [RFC 3874](https://datatracker.ietf.org/doc/rfc3874/).
SHA-2 with a digest length of 256, as defined in [RFC 6234](https://datatracker.ietf.org/doc/rfc6234/).
SHA-2 with a digest length of 384, as defined in [RFC 6234](https://datatracker.ietf.org/doc/rfc6234/).
SHA-3 with a digest length of 224, as defined in [FIPS 202](https://csrc.nist.gov/pubs/fips/202/final).
SHA-3 with a digest length of 256, as defined in [FIPS 202](https://csrc.nist.gov/pubs/fips/202/final).
SHA-3 with a digest length of 384, as defined in [FIPS 202](https://csrc.nist.gov/pubs/fips/202/final).
SHA-3 with a digest length of 512, as defined in [FIPS 202](https://csrc.nist.gov/pubs/fips/202/final).
SHA-2 with a digest length of 512, as defined in [RFC 6234](https://datatracker.ietf.org/doc/rfc6234/).
A relationship has specific context implications during an element's build phase, during development.
A relationship has specific context implications for a product's retirement and/or decommissioning.
A relationship has specific context implications during an element's design.
A relationship has specific context implications during development phase of an element.
A relationship has other specific context information necessary to capture that the above set of enumerations does not handle.
A relationship has specific context implications during the execution phase of an element.
A relationship has specific context implications during an element's testing phase, during development.
A relationship has specific context implications for a product update.
A group of people who work together in an organized way for a shared purpose.
In addition to being supported by the supplier, the software is known to have been deployed and is in use. For a software as a service provider, this implies the software is now available as a service.
The artifact is in active development and is not considered ready for formal support from the supplier.
There is a defined end of support for the artifact from the supplier. This may also be referred to as end of life. There is a validUntilDate that can be used to signal when support ends for the artifact.
The artifact has been released, and there is limited support available from the supplier. There is a validUntilDate that can provide additional information about the duration of support.
No assertion about the type of support is made. This is considered the default if no other support type is used.
There is no support for the artifact from the supplier, consumer assumes any support obligations.
The artifact has been released, and is supported from the supplier. There is a validUntilDate that can provide additional information about the duration of support.
Specifies the algorithm used for calculating the hash value.
Specifies an Extension characterization of some aspect of an Element.
The result of applying a hash algorithm to an Element.
A key used in a generic key-value pair.
Identifies who or what supplied the artifact or VulnAssessmentRelationship referenced by the Element.
Specifies the level of support associated with an artifact.
Provides an IntegrityMethod with which the integrity of an Element can be asserted.
Specifies the SPDX License List version in which this license or exception identifier was deprecated.
Identifies all the text and metadata associated with a license in the license XML format.
Specifies the SPDX License List version in which this ListedLicense or ListedLicenseException identifier was first added.
A license expression participating in a license set.
Specifies the licenseId that is preferred to be used in place of a deprecated License or LicenseAddition.
Contains a URL where the License or LicenseAddition can be found in use.
Hazards are potential sources of harm, danger, or adverse effects to people, property, the environment, or systems within or related to a specific piece of hardware.
Product Part Number as defined by OEM.
When a CVSS score is between 9.0 - 10.0.
When a CVSS score is between 7.0 - 8.9.
When a CVSS score is between 0.1 - 3.9.
When a CVSS score is between 4.0 - 6.9.
When a CVSS score is 0.0.
Specifies a time when a vulnerability assessment was modified
Specifies the time when a vulnerability was published.
Specifies the CVSS qualitative severity rating of a vulnerability in relation to a piece of software.
Specified the time and date when a vulnerability was withdrawn.
Identifies the full text of a License or Addition.
The Element is a software application.
The Element is an archived collection of one or more files (.tar, .zip, etc.).
The Element is a bill of materials.
The Element is configuration data.
The Element is a container image which can be used by a container runtime application.
The Element is data.
The Element refers to a chipset, processor, or electronic board.
The Element represents software that controls hardware devices.
The Element refers to a disk image that can be written to a disk, booted in a VM, etc. A disk image typically contains most or all of the components necessary to boot, such as bootloaders, kernels, firmware, userspace, etc.
The Element is documentation.
The Element is the evidence that a specification or requirement has been fulfilled.
The Element is an Artifact that can be run on a computer.
The Element is a single file which can be independently distributed (configuration file, statically linked binary, Kubernetes deployment, etc.).
The Element is a file system image that can be written to a disk (or virtual) partition.
The Element provides low level control over a device's hardware.
The Element is a software framework.
The Element is used to install software on disk.
The Element is a software library.
The Element is a software manifest.
The Element is a machine learning or artificial intelligence model.
The Element is a module of a piece of software.
The Element is an operating system.
The Element doesn't fit into any of the other categories.
The Element contains a set of changes to update, fix, or improve another Element.
The Element represents a runtime environment.
The Element provides a requirement needed as input for another Element.
The Element is a single or a collection of source files.
The Element is a plan, guideline or strategy how to create, perform or analyze an application.
The Element is a test used to verify functionality on a software element.
Custody refers to the responsibility, control, and safekeeping of an asset, person, or legal entity. It involves both physical possession and legal authority over something or someone.
Ownership refers to the legal right to control, manage, and benefit from an asset, resource, or responsibility. It establishes authority, accountability, and entitlements over something, whether it's property, a business, intellectual property, or responsibilities.
Requirements can be categorized into various types based on their focus, purpose, and scope.
A class for describing the energy consumption incurred by an AI model in different stages of its lifecycle.
A collection of Elements that have a shared context.
A collection of Elements, not necessarily with unifying context.
https://spdx.org/rdf/3.1/terms/Core/ElementCollection is an abstract class and should not be instantiated directly. Instantiate a subclass instead.
A key with an Element.
A map of Element identifiers that are used within an SpdxDocument but defined external to that SpdxDocument.
A reference to a resource outside the scope of SPDX 3 content related to an Element.
A mathematically calculated representation of a grouping of data.
A concrete subclass of Element used by Individuals in the Core profile.
The measure of mass refers to the quantity of matter in an object or substance.
A mapping between prefixes and namespace partial URIs.
Indicates absence of the field.
Makes no assertion about the field.
Indicates presence of the field.
An element of hardware and/or software utilized to carry out a particular function.
Provides information about the content type of an Element or a property.
A concrete subclass of AnyLicenseInfo used by Individuals in the ExpandedLicensing profile.
A property name with an associated value.
A characterization of some aspect of an Element that is associated with the Element in a generalized fashion.
https://spdx.org/rdf/3.1/terms/Extension/Extension is an abstract class and should not be instantiated directly. Instantiate a subclass instead.
RequirementVerification class defines the base properties of a verification.
Temporary endeavor with a beginning and an end and that must be used to create a unique product, service or result.
Provides a numerical (0-10) representation of the severity of a vulnerability.
Specifies the CVSS vector string for a vulnerability.
A canonical, unique, immutable identifier.
Refers to any object that stores content on a computer.
Refers to any unit of content that can be associated with a distribution of software.
This process is used to determine the state of an affected Element.
Specifies the type of an annotation.
Class that describes an instance of Hardware.
https://spdx.org/rdf/3.1/terms/Hardware/Hardware is an abstract class and should not be instantiated directly. Instantiate a subclass instead.
Specifies the type of a content identifier.
Enumeration of the different kinds of SPDX file.
An actual alteration of a product.
https://spdx.org/rdf/3.1/terms/SupplyChain/ModifyAction is an abstract class and should not be instantiated directly. Instantiate a subclass instead.
A prescribed alteration of a product.
https://spdx.org/rdf/3.1/terms/SupplyChain/ModifyProcess is an abstract class and should not be instantiated directly. Instantiate a subclass instead.
Unit of energy consumption.
A tuple of two positive integers that define a range.
Indicates whether a relationship is known to be complete, incomplete, or if no assertion is made with respect to relationship completeness.
An Organization representing the SPDX Project.
UnitofMeasure specify information structures through industry standards for Units of Measure, Quantity Kinds, Dimensions and Data Types.
Abstract class representing a License or an OrLaterOperator.
https://spdx.org/rdf/3.1/terms/ExpandedLicensing/ExtendableLicense is an abstract class and should not be instantiated directly. Instantiate a subclass instead.
Abstract class for the portion of an AnyLicenseInfo representing a license.
https://spdx.org/rdf/3.1/terms/ExpandedLicensing/License is an abstract class and should not be instantiated directly. Instantiate a subclass instead.
Abstract class for additional text intended to be added to a License, but which is not itself a standalone License.
https://spdx.org/rdf/3.1/terms/ExpandedLicensing/LicenseAddition is an abstract class and should not be instantiated directly. Instantiate a subclass instead.
EvaluationResultType describes the outcome of an evaluation or verification process with.
Dimensions generally refer to measurable extents or attributes that define the size, shape, or scale of an object, system, or concept.
VirtualHardwareModelType sets the VirtualHardware Model Type.
Abstract ancestor class for all VEX relationships.
https://spdx.org/rdf/3.1/terms/Security/VexVulnAssessmentRelationship is an abstract class and should not be instantiated directly. Instantiate a subclass instead.
CreationAction represents an event of product creation.
https://spdx.org/rdf/3.1/terms/SupplyChain/CreateAction is an abstract class and should not be instantiated directly. Instantiate a subclass instead.
These categories help define sets Responsibility Type.
A state is an instance that describes what a system, component, subsystem, process, or project has achieved at any given time.
Use Process defines actions used by elements.
https://spdx.org/rdf/3.1/terms/SupplyChain/UseProcess is an abstract class and should not be instantiated directly. Instantiate a subclass instead.
Safety risk level.
Information about the type of contact point for `ContactPointRelationship`s.
The DefinedType class associates a specific type with its defined source.
The ProcessReadinessType is defined by the enumeration.
Describes a relationship between one or more elements.
Provide consumers with comments by the creator of the Element about the Element.
Confidentiality level.
Specifies the SSVC decision type.
Protocols which support authentication.
A distinct article or unit related to Software.
https://spdx.org/rdf/3.1/terms/Software/SoftwareArtifact is an abstract class and should not be instantiated directly. Instantiate a subclass instead.
The CreateProcess refers to the abstract process class that can be used to represent the process of creation of a product.
https://spdx.org/rdf/3.1/terms/SupplyChain/CreateProcess is an abstract class and should not be instantiated directly. Instantiate a subclass instead.
The class that helps note down the quantity of energy consumption and the unit used for measurement.
Class that describes an action that has occurred.
https://spdx.org/rdf/3.1/terms/Core/Action is an abstract class and should not be instantiated directly. Instantiate a subclass instead.
Class that describes a process.
https://spdx.org/rdf/3.1/terms/Core/DefinedProcess is an abstract class and should not be instantiated directly. Instantiate a subclass instead.
Provides an independently reproducible mechanism that permits verification of a specific Element.
https://spdx.org/rdf/3.1/terms/Core/IntegrityMethod is an abstract class and should not be instantiated directly. Instantiate a subclass instead.
The measure of length refers to the dimension of an object or space that describes how long it is, typically expressed in various units depending on the system of measurement being used.
Availability of dataset.
EvidenceType refers to categories of documented or observable proof used to verify compliance, qualification, or performance
Specifies the VEX justification type.
Specifies the CVSS base, temporal, threat, or environmental severity type.
Abstract ancestor class for all vulnerability assessments.
https://spdx.org/rdf/3.1/terms/Security/VulnAssessmentRelationship is an abstract class and should not be instantiated directly. Instantiate a subclass instead.
Provides a set of values to be used to describe the common types of SBOMs that tools may create.
The action of product use.
https://spdx.org/rdf/3.1/terms/SupplyChain/UseAction is an abstract class and should not be instantiated directly. Instantiate a subclass instead.
A reference to a resource identifier defined outside the scope of SPDX 3 content that uniquely identifies an Element.
Defines the level of automation a system possesses.
Categories of presence or absence.
A specification is a detailed description of the design, requirements, or features of a product, process, or system.
Type of support that is associated with an artifact.
Enumeration of verification types.
A distinct article or unit within the domain.
https://spdx.org/rdf/3.1/terms/Core/Artifact is an abstract class and should not be instantiated directly. Instantiate a subclass instead.
Provide an enumerated set of lifecycle phases that can provide context to relationships.
Abstract class representing a license combination consisting of one or more licenses.
https://spdx.org/rdf/3.1/terms/SimpleLicensing/AnyLicenseInfo is an abstract class and should not be instantiated directly. Instantiate a subclass instead.
Enumeration of the valid profiles.
Enumeration of dataset types.
Location is used to define the location, address or coordinates of a place.
https://spdx.org/rdf/3.1/terms/Core/Location is an abstract class and should not be instantiated directly. Instantiate a subclass instead.
A key with an associated value.
Specifies the type of an external identifier.
A mathematical algorithm that maps data of arbitrary size to a bit string.
Agent represents anything with the potential to act on a system.
Provides information about the primary purpose of an Element.
Base domain class from which all other SPDX 3 domain classes derive.
https://spdx.org/rdf/3.1/terms/Core/Element is an abstract class and should not be instantiated directly. Instantiate a subclass instead.
Class is known to not derive from Extension and cannot be used
Specifies the type of an external reference.