<!--
SPDX-FileCopyrightText: (c) 2019-2025 T. Graf
SPDX-License-Identifier: Apache-2.0
-->
Tethys.SPDX
The Software Package Data Exchange (SPDX) is an open standard for describing a software bill of material.
SPDX focuses especially on licensing and copyright information.
License and copyright scanners like FOSSology for example use this standard
to provide their scan results.
Having a format to describe all the different scenarios of license findings, license relations,
and copyright findings is not trivial, so SPDX can get quite complex.
The libraries in this project support two tasks:
load the SPDX license list and provide it to .Net applications
parse SPDX files and provide the contained data in a .Net way
Please note that due to the complexity of the SPDX standard not all
possible SPDX files can be parsed. But the libraries are open source, so feel
free to enhance them.
There an ongoing discussion whether to use System.Text.Json instead of Newtonsoft.Json.
Well, moving from Newtonsoft.Json to System.Text.Json is not straightforward and costs
quite some effort. SPDX JSON reading and writing is based on many Newtonsoft JsonConverters
and at the moment there is no plan to change this. If someone wants to take the challenge, well,
go ahead and do a pull request.
Current status:
The following packages do not use any JSON support:
Tethys.SPDX.ExpressionParser
Tethys.SPDX.Support
The following packages use System.Text.Json:
Tethys.SPDX.Interfaces
Tethys.SPDX.KnownLicenses, netstandard2.0
The following packages use Newtonsoft.Json:
Tethys.SPDX.Model
Tethys.SPDX.SimpleSpdxParser
Tethys.SPDX.Writer
SPDX
See https://spdx.org/licenses/ for more details on SPDX, the software
package data exchange format, the SPDX license identifiers
and matching guidelines.
The SPDX license information is not part of the libraries, you have to
download it from SPDX License List
and place it in a local folder.
Very simple demo
A minimal code snippet looks like this
var knownLicenseManager = new KnownLicenseManager();
knownLicenseManager.LoadSpdxSourceFiles(...SPDX license files...);
knownLicenseManager.LoadSpdxExceptionFiles(...SPDX license exception files...);
var reader = new RdfParser(knownLicenseManager);
var spdxDoc = reader.ReadFromFile(...SPDX file...);
...
Just run the demo application
dotnet run --project .\SpdxParserDemo\SpdxParserDemo.csproj .\TestData\yaml-0.1.0.zip.spdx2.rdf.xml
or
dotnet run --project .\SpdxParserDemo\SpdxParserDemo.csproj .\TestData\SPDXJSONExample-v2.3.spdx.json
Build
Requisites
Visual Studio 2022
NuGet access
Required NuGet Packages
Tethys.Logging, version 1.6.1
Tethys.Xml, version 1.1.0
(Newtonsoft.Json, version 13.0.3)
(System.Text,Json, version 8.0.3)
Build Solution
Just use the basic dotnet command:
dotnet build
License
Copyright (c) 2019-2025 T. Graf.
Tethys.SPDX is licensed under the Apache License, Version 2.0.
