Provide a Software Bill of materials as a SPDX file - List all libraries, licenses and copyrights

[surfmuggle]

List of all libraries, licenses and copyrights in a software Bill of materials as a SPDX file

Our legal departement requires us to provide a detailed list of every library and every license and copyright that is involved in creating or running our software.

A software bill of materials can be provided. My understanding of SPDX is that SPDX is an XML specification that provides all the details needed for legal.

It would be great if .NET Core SDK and ASP.NET Core runtime would provide such a SPDX file and make it part of the source code repository.

Additional Note

If each source code file would contain a header section with copyright, author(-s) and a SPDK-License-Identifier this would help tools to extract the relevant information from the code.

• SPDX License List and their identifiers
• SPDX IDs: How to use

Example taken from using spdx license list shortidentifiers (pdf page 6)

  /*
   * (C) Copyright 2002
   * AuthorFirstNmae AuthorLastname, CompanyName, author@company.tld
   *
   * SPDX-License-Identifier:        GPL-2.0+
   */

   start of source code

[scalablecory]

@terrajobst @richlander

[scalablecory]

It looks like there is little interest here in ~6 months (no upvotes etc.), so I'm closing this.

[omajid]

We, Red Hat, are also interested in some of this.

SPDX identifiers would just be perfect, but we also care about lower hanging fruit when it comes to licenses, such as dotnet/aspnetcore#25076 and now-resolved issues like dotnet/runtime#2540. Some repos, such as vstest, even license components under a proprietary license blocking inclusion in Linux distributions.

[rpavlik]

I also have interest in this - I normally use the https://reuse.software tool's reuse spdx command, but that doesn't include assemblies I'm pulling in via NuGet (because the files extracted from nuget packages are gitignored, and the reuse tool doesn't understand nuget metadata). Even just a way to extract dependencies' declared licenses would be useful - there are those "deps" files in the output dir but they don't mention anything about license.