spdx / spec-v3-template

Templates and examples for writing the v3 specification
Creative Commons Zero v1.0 Universal
2 stars 2 forks source link

Artifact does not act #4

Open davaya opened 3 years ago

davaya commented 3 years ago

An Agent is an entity responsible for an action taking place. (This can fill in the TODO in Classes/Agent description.)

Classes/Artifact shows Artifact as SubclassOf: Element; Agent. Should be SubclassOf: Element.

A tool can be an Artifact - a software distribution with an SBOM, and it can also be a running process with an Identity, but those are two different entities (tool-software and running-tool/user-agent), not a single entity with a hybrid nature.

(An agent could be a person or a non-person entity; an NPE is an organization or a process loaded from an artifact running on a device under an identity.)