Hi,

Whilst preparing for SPDX bakeoff I noticed a few issues with my interpretation of the specification that may be worth discussion.

Firstly a number of fields in tag files contain arbitrary text enclosed within <text>...</text> tags. I found examples where the text I am including within these tags does itself contain HTML/XML tags from the source document. The inclusion of non-SPDX tags within the <text> tags makes it hard to spot the end of the </text>. This raises the question of whether the text within <text> tags ought to be escaped in some way? I did not find anything on this point in the SPDX specification (apologies if I missed anything).

Secondly, I noticed that in the tag field PackageLicenseInfoFromFiles I am including license exceptions, for example:

PackageLicenseInfoFromFiles: Classpath-exception-2.0

However, I think my use is incorrect. The spec says a license identifier is needed here, and a license exception identifier is not a license identifier. I cannot alternatively use "license WITH exception" here because this is an expression not a license identifier. This raises the question, how should exceptions be represented in PackageLicenseInfoFromFiles, if at all?

I appreciate your thoughts on these issues.