On nedelja, 28. julij 2019 22:15:26 CEST, Gary O'Neall wrote:

[G.O.] The idea is that there would be a package definition. It could be in a separate SPDX document, or more likely, as a separate SPDX package definition within the same SPDX document. The originating package definition could have the FilesAnalyzed set to false which allows for a rather small number of required fields. The origin could then be indicated by a relationship between the file and the package.

I see. Is there already any tooling available to make this actually usable in practice? Sw360, DejaCode?


cheers,
Matija
—
P.S. Sorry about the late reply, I had a lot going on in the past few weeks/months.
--
gsm: tel:+386.41.849.552
www: https://matija.suklje.name
xmpp: matija.suklje@...
sip: matija_suklje@...