Thanks for a great discussion on spdx its got me interested in wrapping spdx into my current release activities as a release manager.

Say for example I ship an SDK and for a customer to use this SDK they need to download a number of other files that were unable to ship within the package. What would be the best way with spdx to indicate such? Ideally if I could ship them I would but for reasons outside of my control I am unable to do so.

To date I have been using Nexus pro to decorate the artifacts that make up the bill of materials by adding metadata to this tool. The metadata i've been storing is inline with what spdx already tracks. I wrote my own Maven plugins to take care of the metadata aspect of adding it and pulling it out of Nexus when producing the bill of materials. What I am thinking is that instead of storing metadata i'll just attach an spdx file as an attached artifact with a classifier and for every artifact that is subsequently packaged it will just pull down the spdx files and aggregate.

Looks like I need to do some reading of the spec and whitepapers etc to get up to speed.

--
Robert