feat: SPDX 2.3 support (#1311)

2026-11-04 08:26:38 +01:00 · 2022-11-18 08:54:39 -05:00
parent 0c4b99c1c2
commit 42cb0a47a4
71 changed files with 892 additions and 1339 deletions
@@ -0,0 +1,4 @@
+# Note: changes to this file will result in updating several test values. Consider making a new image fixture instead of editing this one.
+FROM scratch
+ADD file-1.txt /somefile-1.txt
+ADD file-2.txt /somefile-2.txt
@@ -0,0 +1 @@
+this file has contents
@@ -0,0 +1 @@
+file-2 contents!
@@ -0,0 +1,66 @@
+{
+ "spdxVersion": "SPDX-2.3",
+ "dataLicense": "CC0-1.0",
+ "SPDXID": "SPDXRef-DOCUMENT",
+ "name": "/some/path",
+ "documentNamespace": "https://anchore.com/syft/dir/some/path-0f9b165e-1819-43cb-bd58-f61c1c23d6cf",
+ "creationInfo": {
+  "licenseListVersion": "3.18",
+  "creators": [
+   "Organization: Anchore, Inc",
+   "Tool: syft-v0.42.0-bogus"
+  ],
+  "created": "2022-11-11T19:24:55Z",
+  "comment": ""
+ },
+ "packages": [
+  {
+   "name": "package-1",
+   "SPDXID": "SPDXRef-Package-python-package-1-1b1d0be59ac59d2c",
+   "versionInfo": "1.0.1",
+   "downloadLocation": "NOASSERTION",
+   "sourceInfo": "acquired package info from installed python package manifest file: /some/path/pkg1",
+   "licenseConcluded": "MIT",
+   "licenseDeclared": "MIT",
+   "copyrightText": "NOASSERTION",
+   "externalRefs": [
+    {
+     "referenceCategory": "SECURITY",
+     "referenceType": "cpe23Type",
+     "referenceLocator": "cpe:2.3:*:some:package:2:*:*:*:*:*:*:*",
+     "comment": ""
+    },
+    {
+     "referenceCategory": "PACKAGE-MANAGER",
+     "referenceType": "purl",
+     "referenceLocator": "a-purl-2",
+     "comment": ""
+    }
+   ]
+  },
+  {
+   "name": "package-2",
+   "SPDXID": "SPDXRef-Package-deb-package-2-db4abfe497c180d3",
+   "versionInfo": "2.0.1",
+   "downloadLocation": "NOASSERTION",
+   "sourceInfo": "acquired package info from DPKG DB: /some/path/pkg1",
+   "licenseConcluded": "NONE",
+   "licenseDeclared": "NONE",
+   "copyrightText": "NOASSERTION",
+   "externalRefs": [
+    {
+     "referenceCategory": "SECURITY",
+     "referenceType": "cpe23Type",
+     "referenceLocator": "cpe:2.3:*:some:package:2:*:*:*:*:*:*:*",
+     "comment": ""
+    },
+    {
+     "referenceCategory": "PACKAGE-MANAGER",
+     "referenceType": "purl",
+     "referenceLocator": "pkg:deb/debian/package-2@2.0.1",
+     "comment": ""
+    }
+   ]
+  }
+ ]
+}
@@ -0,0 +1,66 @@
+{
+ "spdxVersion": "SPDX-2.3",
+ "dataLicense": "CC0-1.0",
+ "SPDXID": "SPDXRef-DOCUMENT",
+ "name": "user-image-input",
+ "documentNamespace": "https://anchore.com/syft/image/user-image-input-5841d063-c3ef-406b-91b4-8a702ef45ce9",
+ "creationInfo": {
+  "licenseListVersion": "3.18",
+  "creators": [
+   "Organization: Anchore, Inc",
+   "Tool: syft-v0.42.0-bogus"
+  ],
+  "created": "2022-11-11T19:24:55Z",
+  "comment": ""
+ },
+ "packages": [
+  {
+   "name": "package-1",
+   "SPDXID": "SPDXRef-Package-python-package-1-66ba429119b8bec6",
+   "versionInfo": "1.0.1",
+   "downloadLocation": "NOASSERTION",
+   "sourceInfo": "acquired package info from installed python package manifest file: /somefile-1.txt",
+   "licenseConcluded": "MIT",
+   "licenseDeclared": "MIT",
+   "copyrightText": "NOASSERTION",
+   "externalRefs": [
+    {
+     "referenceCategory": "SECURITY",
+     "referenceType": "cpe23Type",
+     "referenceLocator": "cpe:2.3:*:some:package:1:*:*:*:*:*:*:*",
+     "comment": ""
+    },
+    {
+     "referenceCategory": "PACKAGE-MANAGER",
+     "referenceType": "purl",
+     "referenceLocator": "a-purl-1",
+     "comment": ""
+    }
+   ]
+  },
+  {
+   "name": "package-2",
+   "SPDXID": "SPDXRef-Package-deb-package-2-958443e2d9304af4",
+   "versionInfo": "2.0.1",
+   "downloadLocation": "NOASSERTION",
+   "sourceInfo": "acquired package info from DPKG DB: /somefile-2.txt",
+   "licenseConcluded": "NONE",
+   "licenseDeclared": "NONE",
+   "copyrightText": "NOASSERTION",
+   "externalRefs": [
+    {
+     "referenceCategory": "SECURITY",
+     "referenceType": "cpe23Type",
+     "referenceLocator": "cpe:2.3:*:some:package:2:*:*:*:*:*:*:*",
+     "comment": ""
+    },
+    {
+     "referenceCategory": "PACKAGE-MANAGER",
+     "referenceType": "purl",
+     "referenceLocator": "pkg:deb/debian/package-2@2.0.1",
+     "comment": ""
+    }
+   ]
+  }
+ ]
+}
@@ -0,0 +1,160 @@
+{
+ "spdxVersion": "SPDX-2.3",
+ "dataLicense": "CC0-1.0",
+ "SPDXID": "SPDXRef-DOCUMENT",
+ "name": "user-image-input",
+ "documentNamespace": "https://anchore.com/syft/image/user-image-input-8755f340-f205-4bf2-a909-94c623670734",
+ "creationInfo": {
+  "licenseListVersion": "3.18",
+  "creators": [
+   "Organization: Anchore, Inc",
+   "Tool: syft-v0.42.0-bogus"
+  ],
+  "created": "2022-11-11T19:24:55Z",
+  "comment": ""
+ },
+ "packages": [
+  {
+   "name": "package-1",
+   "SPDXID": "SPDXRef-Package-python-package-1-66ba429119b8bec6",
+   "versionInfo": "1.0.1",
+   "downloadLocation": "NOASSERTION",
+   "sourceInfo": "acquired package info from installed python package manifest file: /somefile-1.txt",
+   "licenseConcluded": "MIT",
+   "licenseDeclared": "MIT",
+   "copyrightText": "NOASSERTION",
+   "externalRefs": [
+    {
+     "referenceCategory": "SECURITY",
+     "referenceType": "cpe23Type",
+     "referenceLocator": "cpe:2.3:*:some:package:1:*:*:*:*:*:*:*",
+     "comment": ""
+    },
+    {
+     "referenceCategory": "PACKAGE-MANAGER",
+     "referenceType": "purl",
+     "referenceLocator": "a-purl-1",
+     "comment": ""
+    }
+   ]
+  },
+  {
+   "name": "package-2",
+   "SPDXID": "SPDXRef-Package-deb-package-2-958443e2d9304af4",
+   "versionInfo": "2.0.1",
+   "downloadLocation": "NOASSERTION",
+   "sourceInfo": "acquired package info from DPKG DB: /somefile-2.txt",
+   "licenseConcluded": "NONE",
+   "licenseDeclared": "NONE",
+   "copyrightText": "NOASSERTION",
+   "externalRefs": [
+    {
+     "referenceCategory": "SECURITY",
+     "referenceType": "cpe23Type",
+     "referenceLocator": "cpe:2.3:*:some:package:2:*:*:*:*:*:*:*",
+     "comment": ""
+    },
+    {
+     "referenceCategory": "PACKAGE-MANAGER",
+     "referenceType": "purl",
+     "referenceLocator": "pkg:deb/debian/package-2@2.0.1",
+     "comment": ""
+    }
+   ]
+  }
+ ],
+ "files": [
+  {
+   "fileName": "/a1/f6",
+   "SPDXID": "SPDXRef-9c2f7510199b17f6",
+   "fileTypes": [
+    "OTHER"
+   ],
+   "checksums": null,
+   "licenseConcluded": "NOASSERTION",
+   "copyrightText": ""
+  },
+  {
+   "fileName": "/d1/f3",
+   "SPDXID": "SPDXRef-c6f5b29dca12661f",
+   "fileTypes": [
+    "OTHER"
+   ],
+   "checksums": null,
+   "licenseConcluded": "NOASSERTION",
+   "copyrightText": ""
+  },
+  {
+   "fileName": "/d2/f4",
+   "SPDXID": "SPDXRef-c641caa71518099f",
+   "fileTypes": [
+    "OTHER"
+   ],
+   "checksums": null,
+   "licenseConcluded": "NOASSERTION",
+   "copyrightText": ""
+  },
+  {
+   "fileName": "/f1",
+   "SPDXID": "SPDXRef-5265a4dde3edbf7c",
+   "fileTypes": [
+    "OTHER"
+   ],
+   "checksums": null,
+   "licenseConcluded": "NOASSERTION",
+   "copyrightText": ""
+  },
+  {
+   "fileName": "/f2",
+   "SPDXID": "SPDXRef-f9e49132a4b96ccd",
+   "fileTypes": [
+    "OTHER"
+   ],
+   "checksums": null,
+   "licenseConcluded": "NOASSERTION",
+   "copyrightText": ""
+  },
+  {
+   "fileName": "/z1/f5",
+   "SPDXID": "SPDXRef-839d99ee67d9d174",
+   "fileTypes": [
+    "OTHER"
+   ],
+   "checksums": null,
+   "licenseConcluded": "NOASSERTION",
+   "copyrightText": ""
+  }
+ ],
+ "relationships": [
+  {
+   "spdxElementId": "SPDXRef-Package-python-package-1-66ba429119b8bec6",
+   "relatedSpdxElement": "SPDXRef-5265a4dde3edbf7c",
+   "relationshipType": "CONTAINS"
+  },
+  {
+   "spdxElementId": "SPDXRef-Package-python-package-1-66ba429119b8bec6",
+   "relatedSpdxElement": "SPDXRef-f9e49132a4b96ccd",
+   "relationshipType": "CONTAINS"
+  },
+  {
+   "spdxElementId": "SPDXRef-Package-python-package-1-66ba429119b8bec6",
+   "relatedSpdxElement": "SPDXRef-c6f5b29dca12661f",
+   "relationshipType": "CONTAINS"
+  },
+  {
+   "spdxElementId": "SPDXRef-Package-python-package-1-66ba429119b8bec6",
+   "relatedSpdxElement": "SPDXRef-c641caa71518099f",
+   "relationshipType": "CONTAINS"
+  },
+  {
+   "spdxElementId": "SPDXRef-Package-python-package-1-66ba429119b8bec6",
+   "relatedSpdxElement": "SPDXRef-839d99ee67d9d174",
+   "relationshipType": "CONTAINS"
+  },
+  {
+   "spdxElementId": "SPDXRef-Package-python-package-1-66ba429119b8bec6",
+   "relatedSpdxElement": "SPDXRef-9c2f7510199b17f6",
+   "relationshipType": "CONTAINS"
+  }
+ ]
+}
@@ -0,0 +1,170 @@
+{
+ "SPDXID": "SPDXRef-DOCUMENT",
+ "name": "alpine-3.10",
+ "spdxVersion": "SPDX-2.2",
+ "creationInfo": {
+  "created": "2022-01-20T21:40:24.439211Z",
+  "creators": [
+   "Organization: Anchore, Inc",
+   "Tool: syft-[not provided]"
+  ],
+  "licenseListVersion": "3.15"
+ },
+ "dataLicense": "CC0-1.0",
+ "documentNamespace": "https://anchore.com/syft/image/alpine-3.10-204b304b-beb3-4413-9b38-d8a2e58e3dfb",
+ "packages": [
+  {
+   "SPDXID": "SPDXRef-a61243292e73923",
+   "name": "busybox",
+   "licenseConcluded": "GPL-2.0",
+   "description": "Size optimized toolbox of many common UNIX utilities",
+   "downloadLocation": "https://busybox.net/",
+   "externalRefs": [
+    {
+     "referenceCategory": "SECURITY",
+     "referenceLocator": "cpe:2.3:a:busybox:busybox:1.30.1-r5:*:*:*:*:*:*:*",
+     "referenceType": "cpe23Type"
+    },
+    {
+     "referenceCategory": "PACKAGE_MANAGER",
+     "referenceLocator": "pkg:alpine/busybox@1.30.1-r5?arch=x86_64&distro=alpine-3.10.9",
+     "referenceType": "purl"
+    }
+   ],
+   "filesAnalyzed": false,
+   "licenseDeclared": "GPL-2.0",
+   "originator": "Person: Natanael Copa <ncopa@alpinelinux.org>",
+   "sourceInfo": "acquired package info from APK DB: /lib/apk/db/installed",
+   "versionInfo": "1.30.1-r5"
+  },
+  {
+   "SPDXID": "SPDXRef-d2f55e316dbe92e4",
+   "name": "libssl1.1",
+   "licenseConcluded": "OpenSSL",
+   "description": "SSL shared libraries",
+   "downloadLocation": "https://www.openssl.org",
+   "externalRefs": [
+    {
+     "referenceCategory": "SECURITY",
+     "referenceLocator": "cpe:2.3:a:libssl1.1:libssl1.1:1.1.1k-r0:*:*:*:*:*:*:*",
+     "referenceType": "cpe23Type"
+    },
+    {
+     "referenceCategory": "PACKAGE_MANAGER",
+     "referenceLocator": "pkg:alpine/libssl1.1@1.1.1k-r0?arch=x86_64&distro=alpine-3.10.9",
+     "referenceType": "purl"
+    }
+   ],
+   "filesAnalyzed": false,
+   "licenseDeclared": "OpenSSL",
+   "originator": "Person: Timo Teras <timo.teras@iki.fi>",
+   "sourceInfo": "acquired package info from APK DB: /lib/apk/db/installed",
+   "versionInfo": "1.1.1k-r0"
+  },
+  {
+   "SPDXID": "SPDXRef-2b24657ad7aaafea",
+   "name": "ssl_client",
+   "licenseConcluded": "GPL-2.0",
+   "description": "EXternal ssl_client for busybox wget",
+   "downloadLocation": "https://busybox.net/",
+   "externalRefs": [
+    {
+     "referenceCategory": "SECURITY",
+     "referenceLocator": "cpe:2.3:a:ssl-client:ssl-client:1.30.1-r5:*:*:*:*:*:*:*",
+     "referenceType": "cpe23Type"
+    },
+    {
+     "referenceCategory": "SECURITY",
+     "referenceLocator": "cpe:2.3:a:ssl-client:ssl_client:1.30.1-r5:*:*:*:*:*:*:*",
+     "referenceType": "cpe23Type"
+    },
+    {
+     "referenceCategory": "SECURITY",
+     "referenceLocator": "cpe:2.3:a:ssl_client:ssl-client:1.30.1-r5:*:*:*:*:*:*:*",
+     "referenceType": "cpe23Type"
+    },
+    {
+     "referenceCategory": "SECURITY",
+     "referenceLocator": "cpe:2.3:a:ssl_client:ssl_client:1.30.1-r5:*:*:*:*:*:*:*",
+     "referenceType": "cpe23Type"
+    },
+    {
+     "referenceCategory": "SECURITY",
+     "referenceLocator": "cpe:2.3:a:ssl:ssl-client:1.30.1-r5:*:*:*:*:*:*:*",
+     "referenceType": "cpe23Type"
+    },
+    {
+     "referenceCategory": "SECURITY",
+     "referenceLocator": "cpe:2.3:a:ssl:ssl_client:1.30.1-r5:*:*:*:*:*:*:*",
+     "referenceType": "cpe23Type"
+    },
+    {
+     "referenceCategory": "PACKAGE_MANAGER",
+     "referenceLocator": "pkg:alpine/ssl_client@1.30.1-r5?arch=x86_64&upstream=busybox&distro=alpine-3.10.9",
+     "referenceType": "purl"
+    }
+   ],
+   "filesAnalyzed": false,
+   "licenseDeclared": "GPL-2.0",
+   "originator": "Person: Natanael Copa <ncopa@alpinelinux.org>",
+   "sourceInfo": "acquired package info from APK DB: /lib/apk/db/installed",
+   "versionInfo": "1.30.1-r5"
+  }
+ ],
+ "files": [
+  {
+   "SPDXID": "SPDXRef-a07392483a2d0750",
+   "comment": "layerID: sha256:9fb3aa2f8b8023a4bebbf92aa567caf88e38e969ada9f0ac12643b2847391635",
+   "licenseConcluded": "NOASSERTION",
+   "fileName": "/bin/busybox"
+  },
+  {
+   "SPDXID": "SPDXRef-aa3cfed221706d80",
+   "comment": "layerID: sha256:9fb3aa2f8b8023a4bebbf92aa567caf88e38e969ada9f0ac12643b2847391635",
+   "licenseConcluded": "NOASSERTION",
+   "fileName": "/lib/libssl.so.1.1"
+  }
+  ],
+  "relationships": [
+  {
+   "spdxElementId": "SPDXRef-a61243292e73923",
+   "relationshipType": "CONTAINS",
+   "relatedSpdxElement": "SPDXRef-a07392483a2d0750"
+  },
+  {
+   "spdxElementId": "SPDXRef-a61243292e73923",
+   "relationshipType": "CONTAINS",
+   "relatedSpdxElement": "SPDXRef-a07392483a2d0750"
+  },
+  {
+   "spdxElementId": "SPDXRef-a61243292e73923",
+   "relationshipType": "CONTAINS",
+   "relatedSpdxElement": "SPDXRef-499bb68237b0f2b8"
+  },
+  {
+   "spdxElementId": "SPDXRef-a61243292e73923",
+   "relationshipType": "CONTAINS",
+   "relatedSpdxElement": "SPDXRef-df78c68c8206be69"
+  },
+  {
+   "spdxElementId": "SPDXRef-a61243292e73923",
+   "relationshipType": "CONTAINS",
+   "relatedSpdxElement": "SPDXRef-7c980486fc17af43"
+  },
+  {
+   "spdxElementId": "SPDXRef-a61243292e73923",
+   "relationshipType": "CONTAINS",
+   "relatedSpdxElement": "SPDXRef-8762661e65166719"
+  },
+  {
+   "spdxElementId": "SPDXRef-d2f55e316dbe92e4",
+   "relationshipType": "CONTAINS",
+   "relatedSpdxElement": "SPDXRef-aa3cfed221706d80"
+  },
+  {
+   "spdxElementId": "SPDXRef-d2f55e316dbe92e4",
+   "relationshipType": "CONTAINS",
+   "relatedSpdxElement": "SPDXRef-aa3cfed221706d80"
+  }
+ ]
+}
@@ -0,0 +1,78 @@
+{
+  "SPDXID": "SPDXRef-DOCUMENT",
+  "spdxVersion": "SPDX-2.2",
+  "creationInfo": {
+    "created": "2022-01-18T22:16:16Z",
+    "creators": [
+      "Tool: vendor"
+    ],
+    "licenseListVersion": "3.8"
+  },
+  "name": "alpine:3.10",
+  "dataLicense": "CC0-1.0",
+  "documentNamespace": "https://spdx.org/spdxdocs/alpine-154c794c-4264-4e9f-a2ff-5c01bfbfc02c",
+  "documentDescribes": [
+    "SPDXRef-alpine-3.10"
+  ],
+  "packages": [
+    {
+      "name": "alpine",
+      "SPDXID": "SPDXRef-alpine-3.10",
+      "versionInfo": "3.10",
+      "downloadLocation": "NOASSERTION",
+      "filesAnalyzed": false,
+      "licenseConcluded": "NOASSERTION",
+      "licenseDeclared": "NOASSERTION",
+      "copyrightText": "NOASSERTION"
+    },
+    {
+      "name": "busybox",
+      "SPDXID": "SPDXRef-busybox-1.30.1-r5",
+      "versionInfo": "1.30.1-r5",
+      "downloadLocation": "NOASSERTION",
+      "filesAnalyzed": false,
+      "licenseConcluded": "NOASSERTION",
+      "licenseDeclared": "LicenseRef-7d19a72",
+      "copyrightText": "NONE",
+      "comment": "busybox:\n\twarning: No metadata for key: copyright\n\twarning: No metadata for key: download_url\n\twarning: No metadata for key: checksum\n\twarning: No metadata for key: pkg_licenses\n\twarning: No metadata for key: pkg_format\n\twarning: No metadata for key: src_name\n\twarning: No metadata for key: src_version\n"
+    },
+    {
+      "name": "ssl_client",
+      "SPDXID": "SPDXRef-ssl_client-1.30.1-r5",
+      "versionInfo": "1.30.1-r5",
+      "downloadLocation": "NOASSERTION",
+      "filesAnalyzed": false,
+      "licenseConcluded": "NOASSERTION",
+      "licenseDeclared": "LicenseRef-de5acdd",
+      "copyrightText": "NONE",
+      "comment": "ssl_client:\n\twarning: No metadata for key: copyright\n\twarning: No metadata for key: download_url\n\twarning: No metadata for key: checksum\n\twarning: No metadata for key: pkg_licenses\n\twarning: No metadata for key: pkg_format\n\twarning: No metadata for key: src_name\n\twarning: No metadata for key: src_version\n"
+    }
+  ],
+  "relationships": [
+    {
+      "spdxElementId": "SPDXRef-DOCUMENT",
+      "relatedSpdxElement": "SPDXRef-alpine-3.10",
+      "relationshipType": "DESCRIBES"
+    },
+    {
+      "spdxElementId": "SPDXRef-9fb3aa2f8b",
+      "relatedSpdxElement": "SPDXRef-busybox-1.30.1-r5",
+      "relationshipType": "CONTAINS"
+    },
+    {
+      "spdxElementId": "SPDXRef-9fb3aa2f8b",
+      "relatedSpdxElement": "SPDXRef-ssl_client-1.30.1-r5",
+      "relationshipType": "CONTAINS"
+    }
+  ],
+  "hasExtractedLicensingInfos": [
+    {
+      "extractedText": "OpenSSL",
+      "licenseId": "LicenseRef-de5acdd"
+    },
+    {
+      "extractedText": "GPL-2.0",
+      "licenseId": "LicenseRef-7d19a72"
+    }
+  ]
+}
@@ -0,0 +1,72 @@
+{
+  "spdxVersion": "SPDX-2.2",
+  "dataLicense": "CC0-1.0",
+  "SPDXID": "SPDXRef-DOCUMENT",
+  "creationInfo": {
+    "created": "2020-11-24T01:12:27Z",
+    "creators": [
+      {
+        "Person": "Nisha K (nishak@vmware.com)"
+      }
+    ]
+  },
+  "name": "hello-go-binary.spdx.json",
+  "documentNamespace": "https://swinslow.net/spdx-examples/example7/hello-go-binary",
+  "externalDocumentRefs": [
+    {
+      "externalDocumentId": "DocumentRef-hello-go-module",
+      "checksum": {
+        "algorithm": "SHA1",
+        "checksumValue": "d661f8f831a99c288a64e5843b4794ad5181224a"
+      },
+      "spdxDocument": "https://swinslow.net/spdx-examples/example7/hello-go-module-cfa0c58d-79db-4860-99b6-258477e4838b"
+    },
+    {
+      "externalDocumentId": "DocumentRef-golang-dist",
+      "checksum": {
+        "algorithm": "SHA1",
+        "checksumValue": "b6cf54a46329e7cc7610aa5d244018b80103d111"
+      },
+      "spdxDocument": "https://swinslow.net/spdx-examples/example7/golang-dist-492dfde4-318b-49f7-b48c-934bfafbde48"
+    },
+    {
+      "externalDocumentId": "DocumentRef-hello-imports",
+      "checksum": {
+        "algorithm": "SHA1",
+        "checksumValue": "14ff98203c3ddd2bd4803c00b5225d2551ca603c"
+      },
+      "spdxDocument": "https://swinslow.net/spdx-examples/example7/hello-imports-c2d068df-67aa-4c68-98c8-100b450fc408"
+    }
+  ],
+  "documentDescribes": [
+    "SPDXRef-go-bin-hello"
+  ],
+  "packages": [
+    {
+      "packageName": "hello",
+      "SPDXID": "SPDXRef-go-bin-hello",
+      "downloadLocation": "git@github.com:swinslow/spdx-examples.git#example7/content/build/hello",
+      "filesAnalyzed": "false",
+      "packageLicenseConcluded": "NOASSERTION",
+      "packageLicenseDeclared": "NOASSERTION",
+      "packageCopyrightText": "NOASSERTION"
+    }
+  ],
+  "relationships": [
+    {
+      "spdxElementId": "DocumentRef-golang-dist",
+      "relatedSpdxElement": "DocumentRef-hello-go-module",
+      "relationshipType": "BUILD_TOOL_OF"
+    },
+    {
+      "spdxElementId": "DocumentRef-golang-dist:SPDXRef-go-compiler",
+      "relatedSpdxElement": "SPDXRef-go-bin-hello",
+      "relationshipType": "GENERATES"
+    },
+    {
+      "spdxElementId": "DocumentRef-hello-imports",
+      "relatedSpdxElement": "SPDXRef-go-bin-hello",
+      "relationshipType": "STATIC_LINK"
+    }
+  ]
+}
@@ -0,0 +1,29 @@
+{
+  "spdxVersion": "SPDX-2.2",
+  "dataLicense": "CC0-1.0",
+  "SPDXID": "SPDXRef-DOCUMENT",
+  "creationInfo": {
+    "created": "2020-11-24T01:12:27Z",
+    "creators": [
+      {
+        "Person": "Nisha K (nishak@vmware.com)"
+      }
+    ]
+  },
+  "name": "hello-go-module.spdx.json",
+  "documentNamespace": "https://swinslow.net/spdx-examples/example7/hello-go-module",
+  "documentDescribes": [
+    "SPDXRef-go-module-example.com/hello"
+  ],
+  "packages": [
+    {
+      "packageName": "example.com/hello",
+      "SPDXID": "SPDXRef-go-module-example.com/hello",
+      "downloadLocation": "git@github.com:swinslow/spdx-examples.git#example7/content/src/hello",
+      "filesAnalyzed": "false",
+      "packageLicenseConcluded": "NOASSERTION",
+      "packageLicenseDeclared": "NOASSERTION",
+      "packageCopyrightText": "NOASSERTION"
+    }
+  ]
+}
@@ -0,0 +1,46 @@
+{
+  "spdxVersion": "SPDX-2.2",
+  "dataLicense": "CC0-1.0",
+  "SPDXID": "SPDXRef-DOCUMENT",
+  "creationInfo": {
+    "created": "2020-11-24T01:12:27Z",
+    "creators": [
+      {
+        "Person": "Nisha K (nishak@vmware.com)"
+      }
+    ]
+  },
+  "name": "golang-dist",
+  "documentNamespace": "https://swinslow.net/spdx-examples/example7/golang-dist",
+  "documentDescribes": [
+    "SPDXRef-golang-dist"
+  ],
+  "packages": [
+    {
+      "packageName": "go1.16.4.linux-amd64",
+      "SPDXID": "SPDXRef-golang-dist",
+      "downloadLocation": "https://golang.org/dl/go1.16.4.linux-amd64.tar.gz",
+      "packageVersion": "1.16.4",
+      "filesAnalyzed": "false",
+      "checksums": [
+        {
+          "algorithm": "SHA256",
+          "checksumValue": "7154e88f5a8047aad4b80ebace58a059e36e7e2e4eb3b383127a28c711b4ff59"
+        }
+      ],
+      "packageLicenseConcluded": "NOASSERTION",
+      "packageLicenseDeclared": "LicenseRef-Golang-BSD-plus-Patents",
+      "packageCopyrightText": "Copyright (c) 2009 The Go Authors. All rights reserved."
+    },
+    {
+      "packageName": "go",
+      "SPDXID": "SPDXRef-go-compiler",
+      "downloadLocation": "https://golang.org/dl/go1.16.4.linux-amd64.tar.gz",
+      "packageVersion": "1.16.4",
+      "filesAnalyzed": "false",
+      "packageLicenseConcluded": "NOASSERTION",
+      "packageLicenseDeclared": "NOASSERTION",
+      "packageCopyrightText": "NOASSERTION"
+    }
+  ]
+}
@@ -0,0 +1,49 @@
+{
+  "spdxVersion": "SPDX-2.2",
+  "dataLicense": "CC0-1.0",
+  "SPDXID": "SPDXRef-DOCUMENT",
+  "creationInfo": {
+    "created": "2020-11-24T01:12:27Z",
+    "creators": [
+      {
+        "Person": "Nisha K (nishak@vmware.com)"
+      }
+    ]
+  },
+  "name": "hello-imports.spdx.json",
+  "documentNamespace": "https://swinslow.net/spdx-examples/example7/hello-imports",
+  "documentDescribes": [
+    "SPDXRef-go-module-golang.org/x/text",
+    "SPDXRef-go-module-rsc.io/quote",
+    "SPDXRef-go-module-rsc.io/sampler"
+  ],
+  "packages": [
+    {
+      "packageName": "golang.org/x/text",
+      "SPDXID": "SPDXRef-go-module-golang.org/x/text",
+      "downloadLocation": "go://golang.org/x/text@v0.0.0-20170915032832-14c0d48ead0c",
+      "filesAnalyzed": "false",
+      "packageLicenseConcluded": "NOASSERTION",
+      "packageLicenseDeclared": "NOASSERTION",
+      "packageCopyrightText": "NOASSERTION"
+    },
+    {
+      "packageName": "rsc.io/quote",
+      "SPDXID": "SPDXRef-go-module-rsc.io/quote",
+      "downloadLocation": "go://rsc.io/quote@v1.5.2",
+      "filesAnalyzed": "false",
+      "packageLicenseConcluded": "NOASSERTION",
+      "packageLicenseDeclared": "NOASSERTION",
+      "packageCopyrightText": "NOASSERTION"
+    },
+    {
+      "packageName": "rsc.io/sampler",
+      "SPDXID": "SPDXRef-go-module-rsc.io/sampler",
+      "downloadLocation": "go://rsc.io/sampler@v1.3.0",
+      "filesAnalyzed": "false",
+      "packageLicenseConcluded": "NOASSERTION",
+      "packageLicenseDeclared": "NOASSERTION",
+      "packageCopyrightText": "NOASSERTION"
+    }
+  ]
+}
@@ -0,0 +1,68 @@
+{
+  "spdxVersion": "SPDX-2.2",
+  "dataLicense": "CC0-1.0",
+  "SPDXID": "SPDXRef-DOCUMENT",
+  "creationInfo": {
+    "created": "2020-11-24T01:12:27Z",
+    "creators": [ "Person: Nisha K (nishak@vmware.com)" ]
+  },
+  "name": "hello-go-binary.spdx.json",
+  "documentNamespace": "https://swinslow.net/spdx-examples/example7/hello-go-binary",
+  "externalDocumentRefs": [
+    {
+      "externalDocumentId": "DocumentRef-hello-go-module",
+      "checksum": {
+        "algorithm": "SHA1",
+        "checksumValue": "d661f8f831a99c288a64e5843b4794ad5181224a"
+      },
+      "spdxDocument": "https://swinslow.net/spdx-examples/example7/hello-go-module-cfa0c58d-79db-4860-99b6-258477e4838b"
+    },
+    {
+      "externalDocumentId": "DocumentRef-golang-dist",
+      "checksum": {
+        "algorithm": "SHA1",
+        "checksumValue": "b6cf54a46329e7cc7610aa5d244018b80103d111"
+      },
+      "spdxDocument": "https://swinslow.net/spdx-examples/example7/golang-dist-492dfde4-318b-49f7-b48c-934bfafbde48"
+    },
+    {
+      "externalDocumentId": "DocumentRef-hello-imports",
+      "checksum": {
+        "algorithm": "SHA1",
+        "checksumValue": "14ff98203c3ddd2bd4803c00b5225d2551ca603c"
+      },
+      "spdxDocument": "https://swinslow.net/spdx-examples/example7/hello-imports-c2d068df-67aa-4c68-98c8-100b450fc408"
+    }
+  ],
+  "documentDescribes": [
+    "SPDXRef-go-bin-hello"
+  ],
+  "packages": [
+    {
+      "name": "hello",
+      "SPDXID": "SPDXRef-go-bin-hello",
+      "downloadLocation": "git@github.com:swinslow/spdx-examples.git#example7/content/build/hello",
+      "filesAnalyzed": false,
+      "licenseConcluded": "NOASSERTION",
+      "licenseDeclared": "NOASSERTION",
+      "copyrightText": "NOASSERTION"
+    }
+  ],
+  "relationships": [
+    {
+      "spdxElementId": "DocumentRef-golang-dist:SPDXRef-golang-dist",
+      "relatedSpdxElement": "DocumentRef-hello-go-module:SPDXRef-hello-go-module",
+      "relationshipType": "BUILD_TOOL_OF"
+    },
+    {
+      "spdxElementId": "DocumentRef-golang-dist:SPDXRef-go-compiler",
+      "relatedSpdxElement": "SPDXRef-go-bin-hello",
+      "relationshipType": "GENERATES"
+    },
+    {
+      "spdxElementId": "DocumentRef-hello-imports:SPDXRef-hello-imports",
+      "relatedSpdxElement": "SPDXRef-go-bin-hello",
+      "relationshipType": "STATIC_LINK"
+    }
+  ]
+}
@@ -0,0 +1,25 @@
+{
+  "spdxVersion": "SPDX-2.2",
+  "dataLicense": "CC0-1.0",
+  "SPDXID": "SPDXRef-DOCUMENT",
+  "creationInfo": {
+    "created": "2020-11-24T01:12:27Z",
+    "creators": [ "Person: Nisha K (nishak@vmware.com)" ]
+  },
+  "name": "hello-go-module.spdx.json",
+  "documentNamespace": "https://swinslow.net/spdx-examples/example7/hello-go-module",
+  "documentDescribes": [
+    "SPDXRef-go-module-example.com/hello"
+  ],
+  "packages": [
+    {
+      "name": "example.com/hello",
+      "SPDXID": "SPDXRef-go-module-example.com/hello",
+      "downloadLocation": "git@github.com:swinslow/spdx-examples.git#example7/content/src/hello",
+      "filesAnalyzed": false,
+      "licenseConcluded": "NOASSERTION",
+      "licenseDeclared": "NOASSERTION",
+      "copyrightText": "NOASSERTION"
+    }
+  ]
+}
@@ -0,0 +1,42 @@
+{
+  "spdxVersion": "SPDX-2.2",
+  "dataLicense": "CC0-1.0",
+  "SPDXID": "SPDXRef-DOCUMENT",
+  "creationInfo": {
+    "created": "2020-11-24T01:12:27Z",
+    "creators": [ "Person: Nisha K (nishak@vmware.com)" ]
+  },
+  "name": "golang-dist",
+  "documentNamespace": "https://swinslow.net/spdx-examples/example7/golang-dist",
+  "documentDescribes": [
+    "SPDXRef-golang-dist"
+  ],
+  "packages": [
+    {
+      "name": "go1.16.4.linux-amd64",
+      "SPDXID": "SPDXRef-golang-dist",
+      "downloadLocation": "https://golang.org/dl/go1.16.4.linux-amd64.tar.gz",
+      "versionInfo": "1.16.4",
+      "filesAnalyzed": false,
+      "checksums": [
+        {
+          "algorithm": "SHA256",
+          "checksumValue": "7154e88f5a8047aad4b80ebace58a059e36e7e2e4eb3b383127a28c711b4ff59"
+        }
+      ],
+      "licenseConcluded": "NOASSERTION",
+      "licenseDeclared": "LicenseRef-Golang-BSD-plus-Patents",
+      "copyrightText": "Copyright (c) 2009 The Go Authors. All rights reserved."
+    },
+    {
+      "name": "go",
+      "SPDXID": "SPDXRef-go-compiler",
+      "downloadLocation": "https://golang.org/dl/go1.16.4.linux-amd64.tar.gz",
+      "versionInfo": "1.16.4",
+      "filesAnalyzed": false,
+      "licenseConcluded": "NOASSERTION",
+      "licenseDeclared": "NOASSERTION",
+      "copyrightText": "NOASSERTION"
+    }
+  ]
+}
@@ -0,0 +1,45 @@
+{
+  "spdxVersion": "SPDX-2.2",
+  "dataLicense": "CC0-1.0",
+  "SPDXID": "SPDXRef-DOCUMENT",
+  "creationInfo": {
+    "created": "2020-11-24T01:12:27Z",
+    "creators": [ "Person: Nisha K (nishak@vmware.com)" ]
+  },
+  "name": "hello-imports.spdx.json",
+  "documentNamespace": "https://swinslow.net/spdx-examples/example7/hello-imports",
+  "documentDescribes": [
+    "SPDXRef-go-module-golang.org/x/text",
+    "SPDXRef-go-module-rsc.io/quote",
+    "SPDXRef-go-module-rsc.io/sampler"
+  ],
+  "packages": [
+    {
+      "name": "golang.org/x/text",
+      "SPDXID": "SPDXRef-go-module-golang.org/x/text",
+      "downloadLocation": "go://golang.org/x/text@v0.0.0-20170915032832-14c0d48ead0c",
+      "filesAnalyzed": false,
+      "licenseConcluded": "NOASSERTION",
+      "licenseDeclared": "NOASSERTION",
+      "copyrightText": "NOASSERTION"
+    },
+    {
+      "name": "rsc.io/quote",
+      "SPDXID": "SPDXRef-go-module-rsc.io/quote",
+      "downloadLocation": "go://rsc.io/quote@v1.5.2",
+      "filesAnalyzed": false,
+      "licenseConcluded": "NOASSERTION",
+      "licenseDeclared": "NOASSERTION",
+      "copyrightText": "NOASSERTION"
+    },
+    {
+      "name": "rsc.io/sampler",
+      "SPDXID": "SPDXRef-go-module-rsc.io/sampler",
+      "downloadLocation": "go://rsc.io/sampler@v1.3.0",
+      "filesAnalyzed": false,
+      "licenseConcluded": "NOASSERTION",
+      "licenseDeclared": "NOASSERTION",
+      "copyrightText": "NOASSERTION"
+    }
+  ]
+}