search

spdx / LicenseListPublisher

Tool that generates license data found in the license-list-data repository from the license-list-XML source
Apache License 2.0
11 stars 18 forks source link

Generate SPDXv3 RDF license definitions #183

Open zvr opened 3 months ago

zvr commented 3 months ago

Now that we're working with validated RDF data, we need to have all the licenses as valid RDF elements.

For example, if we have a declaration of a concluded license like:

{
  "spdxId": "https://example.org/rel-1",
  "type": "Relationship",
  "relationshipType": "hasConcludedLicense",
  "from": "https://example.org/my-artifact",
  "to": ["https://spdx.org/licenses/MIT"],
  "creationInfo": "_:creationinfo"
}

Validation of this data will fail, since https://spdx.org/licenses/MIT is not known to be a ListedLicense (in SPDXv3 RDF ontology). An example of the exact validation error is shown in https://github.com/spdx/spdx-examples/pull/80#issuecomment-2179288271

The solution is that the License List Publisher should generate RDF data for each of the listed licenses and exceptions. Similar to what is currently being generated for SPDXv2 RDF in https://github.com/spdx/license-list-data/tree/main/jsonld.

I don't know how releases are handled in the https://github.com/spdx/license-list-data/ repo; I only see a package of "all source files". Should all RDF data be collected and published in something like spdx.org/rdf/license-list-3.24.0.jsonld ? Because depending on the licenseListVersion property value, different set of licenses should be available. Anyway, this is a subsequent topic, about deployment. I open this ticket only for the creation of the SPDXv3 data.