CycloneDX v1.4 JSON Reference

Type: object
No Additional Properties

Type: enum (of string)

Specifies the format of the BOM. This helps to identify the file as CycloneDX since BOMs do not have a filename convention nor does JSON schema support namespaces. This value MUST be "CycloneDX".

Must be one of:

  • "CycloneDX"

Type: string

The version of the CycloneDX specification a BOM conforms to (starting at version 1.2).


Example:

"1.4"

Type: string

Every BOM generated SHOULD have a unique serial number, even if the contents of the BOM have not changed over time. If specified, the serial number MUST conform to RFC-4122. Use of serial numbers are RECOMMENDED.

Must match regular expression: ^urn:uuid:[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$
Example:

"urn:uuid:3e671687-395b-41f5-a30f-a58921a69b79"

Type: integer Default: 1

Whenever an existing BOM is modified, either manually or through automated processes, the version of the BOM SHOULD be incremented by 1. When a system is presented with multiple BOMs with identical serial numbers, the system SHOULD use the most recent version of the BOM. The default version is '1'.


Example:

1

Type: object

Provides additional information about a BOM.

No Additional Properties

Type: stringFormat: date-time

The date and time (timestamp) when the BOM was created.

Type: array

The tool(s) used in the creation of the BOM.

No Additional Items

Each item of this array must be:

Type: object

Information about the automated or manual tool used

No Additional Properties

Type: string

The name of the vendor who created the tool

Type: string

The name of the tool

Type: string

The version of the tool

Type: array

The hashes of the tool (if applicable).

No Additional Items

Each item of this array must be:

Type: object
No Additional Properties

Type: enum (of string)

Must be one of:

  • "MD5"
  • "SHA-1"
  • "SHA-256"
  • "SHA-384"
  • "SHA-512"
  • "SHA3-256"
  • "SHA3-384"
  • "SHA3-512"
  • "BLAKE2b-256"
  • "BLAKE2b-384"
  • "BLAKE2b-512"
  • "BLAKE3"

Type: string
Must match regular expression: ^([a-fA-F0-9]{32}|[a-fA-F0-9]{40}|[a-fA-F0-9]{64}|[a-fA-F0-9]{96}|[a-fA-F0-9]{128})$
Example:

"3942447fac867ae5cdb3229b658f4d48"

Type: array

External references provide a way to document systems, sites, and information that may be relevant but which are not included with the BOM.

No Additional Items

Each item of this array must be:

Type: object

Specifies an individual external reference

No Additional Properties

Type: stringFormat: iri-reference

The URL to the external reference

Type: string

An optional comment describing the external reference

Type: enum (of string)

Specifies the type of external reference. There are built-in types to describe common references. If a type does not exist for the reference being referred to, use the "other" type.

Must be one of:

  • "vcs"
  • "issue-tracker"
  • "website"
  • "advisories"
  • "bom"
  • "mailing-list"
  • "social"
  • "chat"
  • "documentation"
  • "support"
  • "distribution"
  • "license"
  • "build-meta"
  • "build-system"
  • "release-notes"
  • "other"

Type: array

The hashes of the external reference (if applicable).

No Additional Items

Each item of this array must be:

Type: object
No Additional Properties

Type: enum (of string)

Must be one of:

  • "MD5"
  • "SHA-1"
  • "SHA-256"
  • "SHA-384"
  • "SHA-512"
  • "SHA3-256"
  • "SHA3-384"
  • "SHA3-512"
  • "BLAKE2b-256"
  • "BLAKE2b-384"
  • "BLAKE2b-512"
  • "BLAKE3"

Type: string
Must match regular expression: ^([a-fA-F0-9]{32}|[a-fA-F0-9]{40}|[a-fA-F0-9]{64}|[a-fA-F0-9]{96}|[a-fA-F0-9]{128})$
Example:

"3942447fac867ae5cdb3229b658f4d48"

Type: array

The person(s) who created the BOM. Authors are common in BOMs created through manual processes. BOMs created through automated means may not have authors.

No Additional Items

Each item of this array must be:

Type: object
No Additional Properties

Type: string

The name of a contact


Example:

"Contact name"

Type: stringFormat: idn-email

The email address of the contact.


Example:

Type: string

The phone number of the contact.


Example:

"800-555-1212"

Type: object

The component that the BOM describes.

No Additional Properties

Type: enum (of string)

Specifies the type of component. For software components, classify as application if no more specific appropriate classification is available or cannot be determined for the component. Types include:

Must be one of:

  • "application"
  • "framework"
  • "library"
  • "container"
  • "operating-system"
  • "device"
  • "firmware"
  • "file"

Example:

"library"

Type: string

The optional mime-type of the component. When used on file components, the mime-type can provide additional context about the kind of file being represented such as an image, font, or executable. Some library or framework components may also have an associated mime-type.

Must match regular expression: ^[-+a-z0-9.]+/[-+a-z0-9.]+$
Example:

"image/jpeg"

Type: string

An optional identifier which can be used to reference the component elsewhere in the BOM. Every bom-ref MUST be unique within the BOM.

Type: object

The organization that supplied the component. The supplier may often be the manufacturer, but may also be a distributor or repackager.

No Additional Properties

Type: string

The name of the organization


Example:

"Example Inc."

Type: array of string

The URL of the organization. Multiple URLs are allowed.

No Additional Items

Each item of this array must be:

Type: stringFormat: iri-reference

Example:

"https://example.com"

Type: array

A contact at the organization. Multiple contacts are allowed.

No Additional Items

Each item of this array must be:

Type: object
No Additional Properties

Type: string

The name of a contact


Example:

"Contact name"

Type: stringFormat: idn-email

The email address of the contact.


Example:

Type: string

The phone number of the contact.


Example:

"800-555-1212"

Type: string

The person(s) or organization(s) that authored the component


Example:

"Acme Inc"

Type: string

The person(s) or organization(s) that published the component


Example:

"Acme Inc"

Type: string

The grouping name or identifier. This will often be a shortened, single name of the company or project that produced the component, or the source package or domain name. Whitespace and special characters should be avoided. Examples include: apache, org.apache.commons, and apache.org.


Example:

"com.acme"

Type: string

The name of the component. This will often be a shortened, single name of the component. Examples: commons-lang3 and jquery


Example:

"tomcat-catalina"

Type: string

The component version. The version should ideally comply with semantic versioning but is not enforced.


Example:

"9.0.14"

Type: string

Specifies a description for the component

Type: enum (of string) Default: "required"

Specifies the scope of the component. If scope is not specified, 'required' scope SHOULD be assumed by the consumer of the BOM.

Must be one of:

  • "required"
  • "optional"
  • "excluded"

Type: array
No Additional Items

Each item of this array must be:

Type: object
No Additional Properties

Type: enum (of string)

Must be one of:

  • "MD5"
  • "SHA-1"
  • "SHA-256"
  • "SHA-384"
  • "SHA-512"
  • "SHA3-256"
  • "SHA3-384"
  • "SHA3-512"
  • "BLAKE2b-256"
  • "BLAKE2b-384"
  • "BLAKE2b-512"
  • "BLAKE3"

Type: string
Must match regular expression: ^([a-fA-F0-9]{32}|[a-fA-F0-9]{40}|[a-fA-F0-9]{64}|[a-fA-F0-9]{96}|[a-fA-F0-9]{128})$
Example:

"3942447fac867ae5cdb3229b658f4d48"

Type: array
No Additional Items

Each item of this array must be:

Type: object
No Additional Properties

Type: object

The following properties are required:

  • license
Type: object

The following properties are required:

  • expression

Type: object
No Additional Properties

Type: object

The following properties are required:

  • id
Type: object

The following properties are required:

  • name

Type: enum (of string)

A valid SPDX license ID

Must be one of:

NameDescription
"0BSD"

BSD Zero Clause License

"3D-Slicer-1.0"

3D Slicer License v1.0

"AAL"

Attribution Assurance License

"Abstyles"

Abstyles License

"AdaCore-doc"

AdaCore Doc License

"Adobe-2006"

Adobe Systems Incorporated Source Code License Agreement

"Adobe-Display-PostScript"

Adobe Display PostScript License

"Adobe-Glyph"

Adobe Glyph List License

"Adobe-Utopia"

Adobe Utopia Font License

"ADSL"

Amazon Digital Services License

"Advanced-Cryptics-Dictionary"

Advanced Cryptics Dictionary License

"AFL-1.1"

Academic Free License v1.1

"AFL-1.2"

Academic Free License v1.2

"AFL-2.0"

Academic Free License v2.0

"AFL-2.1"

Academic Free License v2.1

"AFL-3.0"

Academic Free License v3.0

"Afmparse"

Afmparse License

"AGPL-1.0"

Affero General Public License v1.0

"AGPL-1.0-only"

Affero General Public License v1.0 only

"AGPL-1.0-or-later"

Affero General Public License v1.0 or later

"AGPL-3.0"

GNU Affero General Public License v3.0

"AGPL-3.0-only"

GNU Affero General Public License v3.0 only

"AGPL-3.0-or-later"

GNU Affero General Public License v3.0 or later

"Aladdin"

Aladdin Free Public License

"ALGLIB-Documentation"

ALGLIB Documentation License

"AMD-newlib"

AMD newlib License

"AMDPLPA"

AMD's plpa_map.c License

"AML"

Apple MIT License

"AML-glslang"

AML glslang variant License

"AMPAS"

Academy of Motion Picture Arts and Sciences BSD

"ANTLR-PD"

ANTLR Software Rights Notice

"ANTLR-PD-fallback"

ANTLR Software Rights Notice with license fallback

"any-OSI"

Any OSI License

"any-OSI-perl-modules"

Any OSI License - Perl Modules

"Apache-1.0"

Apache License 1.0

"Apache-1.1"

Apache License 1.1

"Apache-2.0"

Apache License 2.0

"APAFML"

Adobe Postscript AFM License

"APL-1.0"

Adaptive Public License 1.0

"App-s2p"

App::s2p License

"APSL-1.0"

Apple Public Source License 1.0

"APSL-1.1"

Apple Public Source License 1.1

"APSL-1.2"

Apple Public Source License 1.2

"APSL-2.0"

Apple Public Source License 2.0

"Arphic-1999"

Arphic Public License

"Artistic-1.0"

Artistic License 1.0

"Artistic-1.0-cl8"

Artistic License 1.0 w/clause 8

"Artistic-1.0-Perl"

Artistic License 1.0 (Perl)

"Artistic-2.0"

Artistic License 2.0

"Artistic-dist"

Artistic License 1.0 (dist)

"Aspell-RU"

Aspell Russian License

"ASWF-Digital-Assets-1.0"

ASWF Digital Assets License version 1.0

"ASWF-Digital-Assets-1.1"

ASWF Digital Assets License 1.1

"Baekmuk"

Baekmuk License

"Bahyph"

Bahyph License

"Barr"

Barr License

"bcrypt-Solar-Designer"

bcrypt Solar Designer License

"Beerware"

Beerware License

"Bitstream-Charter"

Bitstream Charter Font License

"Bitstream-Vera"

Bitstream Vera Font License

"BitTorrent-1.0"

BitTorrent Open Source License v1.0

"BitTorrent-1.1"

BitTorrent Open Source License v1.1

"blessing"

SQLite Blessing

"BlueOak-1.0.0"

Blue Oak Model License 1.0.0

"Boehm-GC"

Boehm-Demers-Weiser GC License

"Boehm-GC-without-fee"

Boehm-Demers-Weiser GC License (without fee)

"BOLA-1.1"

Buena Onda License Agreement v1.1

"Borceux"

Borceux license

"Brian-Gladman-2-Clause"

Brian Gladman 2-Clause License

"Brian-Gladman-3-Clause"

Brian Gladman 3-Clause License

"BSD-1-Clause"

BSD 1-Clause License

"BSD-2-Clause"

BSD 2-Clause "Simplified" License

"BSD-2-Clause-Darwin"

BSD 2-Clause - Ian Darwin variant

"BSD-2-Clause-first-lines"

BSD 2-Clause - first lines requirement

"BSD-2-Clause-FreeBSD"

BSD 2-Clause FreeBSD License

"BSD-2-Clause-NetBSD"

BSD 2-Clause NetBSD License

"BSD-2-Clause-Patent"

BSD-2-Clause Plus Patent License

"BSD-2-Clause-pkgconf-disclaimer"

BSD 2-Clause pkgconf disclaimer variant

"BSD-2-Clause-Views"

BSD 2-Clause with views sentence

"BSD-3-Clause"

BSD 3-Clause "New" or "Revised" License

"BSD-3-Clause-acpica"

BSD 3-Clause acpica variant

"BSD-3-Clause-Attribution"

BSD with attribution

"BSD-3-Clause-Clear"

BSD 3-Clause Clear License

"BSD-3-Clause-flex"

BSD 3-Clause Flex variant

"BSD-3-Clause-HP"

Hewlett-Packard BSD variant license

"BSD-3-Clause-LBNL"

Lawrence Berkeley National Labs BSD variant license

"BSD-3-Clause-Modification"

BSD 3-Clause Modification

"BSD-3-Clause-No-Military-License"

BSD 3-Clause No Military License

"BSD-3-Clause-No-Nuclear-License"

BSD 3-Clause No Nuclear License

"BSD-3-Clause-No-Nuclear-License-2014"

BSD 3-Clause No Nuclear License 2014

"BSD-3-Clause-No-Nuclear-Warranty"

BSD 3-Clause No Nuclear Warranty

"BSD-3-Clause-Open-MPI"

BSD 3-Clause Open MPI variant

"BSD-3-Clause-Sun"

BSD 3-Clause Sun Microsystems

"BSD-3-Clause-Tso"

BSD 3-Clause Tso variant

"BSD-4-Clause"

BSD 4-Clause "Original" or "Old" License

"BSD-4-Clause-Shortened"

BSD 4 Clause Shortened

"BSD-4-Clause-UC"

BSD-4-Clause (University of California-Specific)

"BSD-4.3RENO"

BSD 4.3 RENO License

"BSD-4.3TAHOE"

BSD 4.3 TAHOE License

"BSD-Advertising-Acknowledgement"

BSD Advertising Acknowledgement License

"BSD-Attribution-HPND-disclaimer"

BSD with Attribution and HPND disclaimer

"BSD-Inferno-Nettverk"

BSD-Inferno-Nettverk

"BSD-Mark-Modifications"

BSD Mark Modifications License

"BSD-Protection"

BSD Protection License

"BSD-Source-beginning-file"

BSD Source Code Attribution - beginning of file variant

"BSD-Source-Code"

BSD Source Code Attribution

"BSD-Systemics"

Systemics BSD variant license

"BSD-Systemics-W3Works"

Systemics W3Works BSD variant license

"BSL-1.0"

Boost Software License 1.0

"Buddy"

Buddy License

"BUSL-1.1"

Business Source License 1.1

"bzip2-1.0.5"

bzip2 and libbzip2 License v1.0.5

"bzip2-1.0.6"

bzip2 and libbzip2 License v1.0.6

"C-UDA-1.0"

Computational Use of Data Agreement v1.0

"CAL-1.0"

Cryptographic Autonomy License 1.0

"CAL-1.0-Combined-Work-Exception"

Cryptographic Autonomy License 1.0 (Combined Work Exception)

"Caldera"

Caldera License

"Caldera-no-preamble"

Caldera License (without preamble)

"CAPEC-tou"

Common Attack Pattern Enumeration and Classification License

"Catharon"

Catharon License

"CATOSL-1.1"

Computer Associates Trusted Open Source License 1.1

"CC-BY-1.0"

Creative Commons Attribution 1.0 Generic

"CC-BY-2.0"

Creative Commons Attribution 2.0 Generic

"CC-BY-2.5"

Creative Commons Attribution 2.5 Generic

"CC-BY-2.5-AU"

Creative Commons Attribution 2.5 Australia

"CC-BY-3.0"

Creative Commons Attribution 3.0 Unported

"CC-BY-3.0-AT"

Creative Commons Attribution 3.0 Austria

"CC-BY-3.0-AU"

Creative Commons Attribution 3.0 Australia

"CC-BY-3.0-DE"

Creative Commons Attribution 3.0 Germany

"CC-BY-3.0-IGO"

Creative Commons Attribution 3.0 IGO

"CC-BY-3.0-NL"

Creative Commons Attribution 3.0 Netherlands

"CC-BY-3.0-US"

Creative Commons Attribution 3.0 United States

"CC-BY-4.0"

Creative Commons Attribution 4.0 International

"CC-BY-NC-1.0"

Creative Commons Attribution Non Commercial 1.0 Generic

"CC-BY-NC-2.0"

Creative Commons Attribution Non Commercial 2.0 Generic

"CC-BY-NC-2.5"

Creative Commons Attribution Non Commercial 2.5 Generic

"CC-BY-NC-3.0"

Creative Commons Attribution Non Commercial 3.0 Unported

"CC-BY-NC-3.0-DE"

Creative Commons Attribution Non Commercial 3.0 Germany

"CC-BY-NC-4.0"

Creative Commons Attribution Non Commercial 4.0 International

"CC-BY-NC-ND-1.0"

Creative Commons Attribution Non Commercial No Derivatives 1.0 Generic

"CC-BY-NC-ND-2.0"

Creative Commons Attribution Non Commercial No Derivatives 2.0 Generic

"CC-BY-NC-ND-2.5"

Creative Commons Attribution Non Commercial No Derivatives 2.5 Generic

"CC-BY-NC-ND-3.0"

Creative Commons Attribution Non Commercial No Derivatives 3.0 Unported

"CC-BY-NC-ND-3.0-DE"

Creative Commons Attribution Non Commercial No Derivatives 3.0 Germany

"CC-BY-NC-ND-3.0-IGO"

Creative Commons Attribution Non Commercial No Derivatives 3.0 IGO

"CC-BY-NC-ND-4.0"

Creative Commons Attribution Non Commercial No Derivatives 4.0 International

"CC-BY-NC-SA-1.0"

Creative Commons Attribution Non Commercial Share Alike 1.0 Generic

"CC-BY-NC-SA-2.0"

Creative Commons Attribution Non Commercial Share Alike 2.0 Generic

"CC-BY-NC-SA-2.0-DE"

Creative Commons Attribution Non Commercial Share Alike 2.0 Germany

"CC-BY-NC-SA-2.0-FR"

Creative Commons Attribution-NonCommercial-ShareAlike 2.0 France

"CC-BY-NC-SA-2.0-UK"

Creative Commons Attribution Non Commercial Share Alike 2.0 England and Wales

"CC-BY-NC-SA-2.5"

Creative Commons Attribution Non Commercial Share Alike 2.5 Generic

"CC-BY-NC-SA-3.0"

Creative Commons Attribution Non Commercial Share Alike 3.0 Unported

"CC-BY-NC-SA-3.0-DE"

Creative Commons Attribution Non Commercial Share Alike 3.0 Germany

"CC-BY-NC-SA-3.0-IGO"

Creative Commons Attribution Non Commercial Share Alike 3.0 IGO

"CC-BY-NC-SA-4.0"

Creative Commons Attribution Non Commercial Share Alike 4.0 International

"CC-BY-ND-1.0"

Creative Commons Attribution No Derivatives 1.0 Generic

"CC-BY-ND-2.0"

Creative Commons Attribution No Derivatives 2.0 Generic

"CC-BY-ND-2.5"

Creative Commons Attribution No Derivatives 2.5 Generic

"CC-BY-ND-3.0"

Creative Commons Attribution No Derivatives 3.0 Unported

"CC-BY-ND-3.0-DE"

Creative Commons Attribution No Derivatives 3.0 Germany

"CC-BY-ND-4.0"

Creative Commons Attribution No Derivatives 4.0 International

"CC-BY-SA-1.0"

Creative Commons Attribution Share Alike 1.0 Generic

"CC-BY-SA-2.0"

Creative Commons Attribution Share Alike 2.0 Generic

"CC-BY-SA-2.0-UK"

Creative Commons Attribution Share Alike 2.0 England and Wales

"CC-BY-SA-2.1-JP"

Creative Commons Attribution Share Alike 2.1 Japan

"CC-BY-SA-2.5"

Creative Commons Attribution Share Alike 2.5 Generic

"CC-BY-SA-3.0"

Creative Commons Attribution Share Alike 3.0 Unported

"CC-BY-SA-3.0-AT"

Creative Commons Attribution Share Alike 3.0 Austria

"CC-BY-SA-3.0-DE"

Creative Commons Attribution Share Alike 3.0 Germany

"CC-BY-SA-3.0-IGO"

Creative Commons Attribution-ShareAlike 3.0 IGO

"CC-BY-SA-4.0"

Creative Commons Attribution Share Alike 4.0 International

"CC-PDDC"

Creative Commons Public Domain Dedication and Certification

"CC-PDM-1.0"

Creative Commons Public Domain Mark 1.0 Universal

"CC-SA-1.0"

Creative Commons Share Alike 1.0 Generic

"CC0-1.0"

Creative Commons Zero v1.0 Universal

"CDDL-1.0"

Common Development and Distribution License 1.0

"CDDL-1.1"

Common Development and Distribution License 1.1

"CDL-1.0"

Common Documentation License 1.0

"CDLA-Permissive-1.0"

Community Data License Agreement Permissive 1.0

"CDLA-Permissive-2.0"

Community Data License Agreement Permissive 2.0

"CDLA-Sharing-1.0"

Community Data License Agreement Sharing 1.0

"CECILL-1.0"

CeCILL Free Software License Agreement v1.0

"CECILL-1.1"

CeCILL Free Software License Agreement v1.1

"CECILL-2.0"

CeCILL Free Software License Agreement v2.0

"CECILL-2.1"

CeCILL Free Software License Agreement v2.1

"CECILL-B"

CeCILL-B Free Software License Agreement

"CECILL-C"

CeCILL-C Free Software License Agreement

"CERN-OHL-1.1"

CERN Open Hardware Licence v1.1

"CERN-OHL-1.2"

CERN Open Hardware Licence v1.2

"CERN-OHL-P-2.0"

CERN Open Hardware Licence Version 2 - Permissive

"CERN-OHL-S-2.0"

CERN Open Hardware Licence Version 2 - Strongly Reciprocal

"CERN-OHL-W-2.0"

CERN Open Hardware Licence Version 2 - Weakly Reciprocal

"CFITSIO"

CFITSIO License

"check-cvs"

check-cvs License

"checkmk"

Checkmk License

"ClArtistic"

Clarified Artistic License

"Clips"

Clips License

"CMU-Mach"

CMU Mach License

"CMU-Mach-nodoc"

CMU Mach - no notices-in-documentation variant

"CNRI-Jython"

CNRI Jython License

"CNRI-Python"

CNRI Python License

"CNRI-Python-GPL-Compatible"

CNRI Python Open Source GPL Compatible License Agreement

"COIL-1.0"

Copyfree Open Innovation License

"Community-Spec-1.0"

Community Specification License 1.0

"Condor-1.1"

Condor Public License v1.1

"copyleft-next-0.3.0"

copyleft-next 0.3.0

"copyleft-next-0.3.1"

copyleft-next 0.3.1

"Cornell-Lossless-JPEG"

Cornell Lossless JPEG License

"CPAL-1.0"

Common Public Attribution License 1.0

"CPL-1.0"

Common Public License 1.0

"CPOL-1.02"

Code Project Open License 1.02

"Cronyx"

Cronyx License

"Crossword"

Crossword License

"CryptoSwift"

CryptoSwift License

"CrystalStacker"

CrystalStacker License

"CUA-OPL-1.0"

CUA Office Public License v1.0

"Cube"

Cube License

"curl"

curl License

"cve-tou"

Common Vulnerability Enumeration ToU License

"D-FSL-1.0"

Deutsche Freie Software Lizenz

"DEC-3-Clause"

DEC 3-Clause License

"diffmark"

diffmark license

"DL-DE-BY-2.0"

Data licence Germany – attribution – version 2.0

"DL-DE-ZERO-2.0"

Data licence Germany – zero – version 2.0

"DOC"

DOC License

"DocBook-DTD"

DocBook DTD License

"DocBook-Schema"

DocBook Schema License

"DocBook-Stylesheet"

DocBook Stylesheet License

"DocBook-XML"

DocBook XML License

"Dotseqn"

Dotseqn License

"DRL-1.0"

Detection Rule License 1.0

"DRL-1.1"

Detection Rule License 1.1

"DSDP"

DSDP License

"dtoa"

David M. Gay dtoa License

"dvipdfm"

dvipdfm License

"ECL-1.0"

Educational Community License v1.0

"ECL-2.0"

Educational Community License v2.0

"eCos-2.0"

eCos license version 2.0

"EFL-1.0"

Eiffel Forum License v1.0

"EFL-2.0"

Eiffel Forum License v2.0

"eGenix"

eGenix.com Public License 1.1.0

"Elastic-2.0"

Elastic License 2.0

"Entessa"

Entessa Public License v1.0

"EPICS"

EPICS Open License

"EPL-1.0"

Eclipse Public License 1.0

"EPL-2.0"

Eclipse Public License 2.0

"ErlPL-1.1"

Erlang Public License v1.1

"ESA-PL-permissive-2.4"

European Space Agency Public License – v2.4 – Permissive (Type 3)

"ESA-PL-strong-copyleft-2.4"

European Space Agency Public License (ESA-PL) - V2.4 - Strong Copyleft (Type 1)

"ESA-PL-weak-copyleft-2.4"

European Space Agency Public License – v2.4 – Weak Copyleft (Type 2)

"etalab-2.0"

Etalab Open License 2.0

"EUDatagrid"

EU DataGrid Software License

"EUPL-1.0"

European Union Public License 1.0

"EUPL-1.1"

European Union Public License 1.1

"EUPL-1.2"

European Union Public License 1.2

"Eurosym"

Eurosym License

"Fair"

Fair License

"FBM"

Fuzzy Bitmap License

"FDK-AAC"

Fraunhofer FDK AAC Codec Library

"Ferguson-Twofish"

Ferguson Twofish License

"Frameworx-1.0"

Frameworx Open License 1.0

"FreeBSD-DOC"

FreeBSD Documentation License

"FreeImage"

FreeImage Public License v1.0

"FSFAP"

FSF All Permissive License

"FSFAP-no-warranty-disclaimer"

FSF All Permissive License (without Warranty)

"FSFUL"

FSF Unlimited License

"FSFULLR"

FSF Unlimited License (with License Retention)

"FSFULLRSD"

FSF Unlimited License (with License Retention and Short Disclaimer)

"FSFULLRWD"

FSF Unlimited License (With License Retention and Warranty Disclaimer)

"FSL-1.1-ALv2"

Functional Source License, Version 1.1, ALv2 Future License

"FSL-1.1-MIT"

Functional Source License, Version 1.1, MIT Future License

"FTL"

Freetype Project License

"Furuseth"

Furuseth License

"fwlw"

fwlw License

"Game-Programming-Gems"

Game Programming Gems License

"GCR-docs"

Gnome GCR Documentation License

"GD"

GD License

"generic-xts"

Generic XTS License

"GFDL-1.1"

GNU Free Documentation License v1.1

"GFDL-1.1-invariants-only"

GNU Free Documentation License v1.1 only - invariants

"GFDL-1.1-invariants-or-later"

GNU Free Documentation License v1.1 or later - invariants

"GFDL-1.1-no-invariants-only"

GNU Free Documentation License v1.1 only - no invariants

"GFDL-1.1-no-invariants-or-later"

GNU Free Documentation License v1.1 or later - no invariants

"GFDL-1.1-only"

GNU Free Documentation License v1.1 only

"GFDL-1.1-or-later"

GNU Free Documentation License v1.1 or later

"GFDL-1.2"

GNU Free Documentation License v1.2

"GFDL-1.2-invariants-only"

GNU Free Documentation License v1.2 only - invariants

"GFDL-1.2-invariants-or-later"

GNU Free Documentation License v1.2 or later - invariants

"GFDL-1.2-no-invariants-only"

GNU Free Documentation License v1.2 only - no invariants

"GFDL-1.2-no-invariants-or-later"

GNU Free Documentation License v1.2 or later - no invariants

"GFDL-1.2-only"

GNU Free Documentation License v1.2 only

"GFDL-1.2-or-later"

GNU Free Documentation License v1.2 or later

"GFDL-1.3"

GNU Free Documentation License v1.3

"GFDL-1.3-invariants-only"

GNU Free Documentation License v1.3 only - invariants

"GFDL-1.3-invariants-or-later"

GNU Free Documentation License v1.3 or later - invariants

"GFDL-1.3-no-invariants-only"

GNU Free Documentation License v1.3 only - no invariants

"GFDL-1.3-no-invariants-or-later"

GNU Free Documentation License v1.3 or later - no invariants

"GFDL-1.3-only"

GNU Free Documentation License v1.3 only

"GFDL-1.3-or-later"

GNU Free Documentation License v1.3 or later

"Giftware"

Giftware License

"GL2PS"

GL2PS License

"Glide"

3dfx Glide License

"Glulxe"

Glulxe License

"GLWTPL"

Good Luck With That Public License

"gnuplot"

gnuplot License

"GPL-1.0"

GNU General Public License v1.0 only

"GPL-1.0+"

GNU General Public License v1.0 or later

"GPL-1.0-only"

GNU General Public License v1.0 only

"GPL-1.0-or-later"

GNU General Public License v1.0 or later

"GPL-2.0"

GNU General Public License v2.0 only

"GPL-2.0+"

GNU General Public License v2.0 or later

"GPL-2.0-only"

GNU General Public License v2.0 only

"GPL-2.0-or-later"

GNU General Public License v2.0 or later

"GPL-2.0-with-autoconf-exception"

GNU General Public License v2.0 w/Autoconf exception

"GPL-2.0-with-bison-exception"

GNU General Public License v2.0 w/Bison exception

"GPL-2.0-with-classpath-exception"

GNU General Public License v2.0 w/Classpath exception

"GPL-2.0-with-font-exception"

GNU General Public License v2.0 w/Font exception

"GPL-2.0-with-GCC-exception"

GNU General Public License v2.0 w/GCC Runtime Library exception

"GPL-3.0"

GNU General Public License v3.0 only

"GPL-3.0+"

GNU General Public License v3.0 or later

"GPL-3.0-only"

GNU General Public License v3.0 only

"GPL-3.0-or-later"

GNU General Public License v3.0 or later

"GPL-3.0-with-autoconf-exception"

GNU General Public License v3.0 w/Autoconf exception

"GPL-3.0-with-GCC-exception"

GNU General Public License v3.0 w/GCC Runtime Library exception

"Graphics-Gems"

Graphics Gems License

"gSOAP-1.3b"

gSOAP Public License v1.3b

"gtkbook"

gtkbook License

"Gutmann"

Gutmann License

"HaskellReport"

Haskell Language Report License

"HDF5"

HDF5 License

"hdparm"

hdparm License

"HIDAPI"

HIDAPI License

"Hippocratic-2.1"

Hippocratic License 2.1

"HP-1986"

Hewlett-Packard 1986 License

"HP-1989"

Hewlett-Packard 1989 License

"HPND"

Historical Permission Notice and Disclaimer

"HPND-DEC"

Historical Permission Notice and Disclaimer - DEC variant

"HPND-doc"

Historical Permission Notice and Disclaimer - documentation variant

"HPND-doc-sell"

Historical Permission Notice and Disclaimer - documentation sell variant

"HPND-export-US"

HPND with US Government export control warning

"HPND-export-US-acknowledgement"

HPND with US Government export control warning and acknowledgment

"HPND-export-US-modify"

HPND with US Government export control warning and modification rqmt

"HPND-export2-US"

HPND with US Government export control and 2 disclaimers

"HPND-Fenneberg-Livingston"

Historical Permission Notice and Disclaimer - Fenneberg-Livingston variant

"HPND-INRIA-IMAG"

Historical Permission Notice and Disclaimer - INRIA-IMAG variant

"HPND-Intel"

Historical Permission Notice and Disclaimer - Intel variant

"HPND-Kevlin-Henney"

Historical Permission Notice and Disclaimer - Kevlin Henney variant

"HPND-Markus-Kuhn"

Historical Permission Notice and Disclaimer - Markus Kuhn variant

"HPND-merchantability-variant"

Historical Permission Notice and Disclaimer - merchantability variant

"HPND-MIT-disclaimer"

Historical Permission Notice and Disclaimer with MIT disclaimer

"HPND-Netrek"

Historical Permission Notice and Disclaimer - Netrek variant

"HPND-Pbmplus"

Historical Permission Notice and Disclaimer - Pbmplus variant

"HPND-sell-MIT-disclaimer-xserver"

Historical Permission Notice and Disclaimer - sell xserver variant with MIT disclaimer

"HPND-sell-regexpr"

Historical Permission Notice and Disclaimer - sell regexpr variant

"HPND-sell-variant"

Historical Permission Notice and Disclaimer - sell variant

"HPND-sell-variant-critical-systems"

HPND - sell variant with safety critical systems clause

"HPND-sell-variant-MIT-disclaimer"

HPND sell variant with MIT disclaimer

"HPND-sell-variant-MIT-disclaimer-rev"

HPND sell variant with MIT disclaimer - reverse

"HPND-SMC"

Historical Permission Notice and Disclaimer - SMC variant

"HPND-UC"

Historical Permission Notice and Disclaimer - University of California variant

"HPND-UC-export-US"

Historical Permission Notice and Disclaimer - University of California, US export warning

"HTMLTIDY"

HTML Tidy License

"hyphen-bulgarian"

hyphen-bulgarian License

"IBM-pibs"

IBM PowerPC Initialization and Boot Software

"ICU"

ICU License

"IEC-Code-Components-EULA"

IEC Code Components End-user licence agreement

"IJG"

Independent JPEG Group License

"IJG-short"

Independent JPEG Group License - short

"ImageMagick"

ImageMagick License

"iMatix"

iMatix Standard Function Library Agreement

"Imlib2"

Imlib2 License

"Info-ZIP"

Info-ZIP License

"Inner-Net-2.0"

Inner Net License v2.0

"InnoSetup"

Inno Setup License

"Intel"

Intel Open Source License

"Intel-ACPI"

Intel ACPI Software License Agreement

"Interbase-1.0"

Interbase Public License v1.0

"IPA"

IPA Font License

"IPL-1.0"

IBM Public License v1.0

"ISC"

ISC License

"ISC-Veillard"

ISC Veillard variant

"ISO-permission"

ISO permission notice

"Jam"

Jam License

"JasPer-2.0"

JasPer License

"jove"

Jove License

"JPL-image"

JPL Image Use Policy

"JPNIC"

Japan Network Information Center License

"JSON"

JSON License

"Kastrup"

Kastrup License

"Kazlib"

Kazlib License

"Knuth-CTAN"

Knuth CTAN License

"LAL-1.2"

Licence Art Libre 1.2

"LAL-1.3"

Licence Art Libre 1.3

"Latex2e"

Latex2e License

"Latex2e-translated-notice"

Latex2e with translated notice permission

"Leptonica"

Leptonica License

"LGPL-2.0"

GNU Library General Public License v2 only

"LGPL-2.0+"

GNU Library General Public License v2 or later

"LGPL-2.0-only"

GNU Library General Public License v2 only

"LGPL-2.0-or-later"

GNU Library General Public License v2 or later

"LGPL-2.1"

GNU Lesser General Public License v2.1 only

"LGPL-2.1+"

GNU Lesser General Public License v2.1 or later

"LGPL-2.1-only"

GNU Lesser General Public License v2.1 only

"LGPL-2.1-or-later"

GNU Lesser General Public License v2.1 or later

"LGPL-3.0"

GNU Lesser General Public License v3.0 only

"LGPL-3.0+"

GNU Lesser General Public License v3.0 or later

"LGPL-3.0-only"

GNU Lesser General Public License v3.0 only

"LGPL-3.0-or-later"

GNU Lesser General Public License v3.0 or later

"LGPLLR"

Lesser General Public License For Linguistic Resources

"Libpng"

libpng License

"libpng-1.6.35"

PNG Reference Library License v1 (for libpng 0.5 through 1.6.35)

"libpng-2.0"

PNG Reference Library version 2

"libselinux-1.0"

libselinux public domain notice

"libtiff"

libtiff License

"libutil-David-Nugent"

libutil David Nugent License

"LiLiQ-P-1.1"

Licence Libre du Québec – Permissive version 1.1

"LiLiQ-R-1.1"

Licence Libre du Québec – Réciprocité version 1.1

"LiLiQ-Rplus-1.1"

Licence Libre du Québec – Réciprocité forte version 1.1

"Linux-man-pages-1-para"

Linux man-pages - 1 paragraph

"Linux-man-pages-copyleft"

Linux man-pages Copyleft

"Linux-man-pages-copyleft-2-para"

Linux man-pages Copyleft - 2 paragraphs

"Linux-man-pages-copyleft-var"

Linux man-pages Copyleft Variant

"Linux-OpenIB"

Linux Kernel Variant of OpenIB.org license

"LOOP"

Common Lisp LOOP License

"LPD-document"

LPD Documentation License

"LPL-1.0"

Lucent Public License Version 1.0

"LPL-1.02"

Lucent Public License v1.02

"LPPL-1.0"

LaTeX Project Public License v1.0

"LPPL-1.1"

LaTeX Project Public License v1.1

"LPPL-1.2"

LaTeX Project Public License v1.2

"LPPL-1.3a"

LaTeX Project Public License v1.3a

"LPPL-1.3c"

LaTeX Project Public License v1.3c

"lsof"

lsof License

"Lucida-Bitmap-Fonts"

Lucida Bitmap Fonts License

"LZMA-SDK-9.11-to-9.20"

LZMA SDK License (versions 9.11 to 9.20)

"LZMA-SDK-9.22"

LZMA SDK License (versions 9.22 and beyond)

"Mackerras-3-Clause"

Mackerras 3-Clause License

"Mackerras-3-Clause-acknowledgment"

Mackerras 3-Clause - acknowledgment variant

"magaz"

magaz License

"mailprio"

mailprio License

"MakeIndex"

MakeIndex License

"man2html"

man2html License

"Martin-Birgmeier"

Martin Birgmeier License

"McPhee-slideshow"

McPhee Slideshow License

"metamail"

metamail License

"Minpack"

Minpack License

"MIPS"

MIPS License

"MirOS"

The MirOS Licence

"MIT"

MIT License

"MIT-0"

MIT No Attribution

"MIT-advertising"

Enlightenment License (e16)

"MIT-Click"

MIT Click License

"MIT-CMU"

CMU License

"MIT-enna"

enna License

"MIT-feh"

feh License

"MIT-Festival"

MIT Festival Variant

"MIT-Khronos-old"

MIT Khronos - old variant

"MIT-Modern-Variant"

MIT License Modern Variant

"MIT-open-group"

MIT Open Group variant

"MIT-STK"

MIT-STK License

"MIT-testregex"

MIT testregex Variant

"MIT-Wu"

MIT Tom Wu Variant

"MITNFA"

MIT +no-false-attribs license

"MMIXware"

MMIXware License

"MMPL-1.0.1"

Minecraft Mod Public License v1.0.1

"Motosoto"

Motosoto License

"MPEG-SSG"

MPEG Software Simulation

"mpi-permissive"

mpi Permissive License

"mpich2"

mpich2 License

"MPL-1.0"

Mozilla Public License 1.0

"MPL-1.1"

Mozilla Public License 1.1

"MPL-2.0"

Mozilla Public License 2.0

"MPL-2.0-no-copyleft-exception"

Mozilla Public License 2.0 (no copyleft exception)

"mplus"

mplus Font License

"MS-LPL"

Microsoft Limited Public License

"MS-PL"

Microsoft Public License

"MS-RL"

Microsoft Reciprocal License

"MTLL"

Matrix Template Library License

"MulanPSL-1.0"

Mulan Permissive Software License, Version 1

"MulanPSL-2.0"

Mulan Permissive Software License, Version 2

"Multics"

Multics License

"Mup"

Mup License

"NAIST-2003"

Nara Institute of Science and Technology License (2003)

"NASA-1.3"

NASA Open Source Agreement 1.3

"Naumen"

Naumen Public License

"NBPL-1.0"

Net Boolean Public License v1

"NCBI-PD"

NCBI Public Domain Notice

"NCGL-UK-2.0"

Non-Commercial Government Licence

"NCL"

NCL Source Code License

"NCSA"

University of Illinois/NCSA Open Source License

"Net-SNMP"

Net-SNMP License

"NetCDF"

NetCDF license

"Newsletr"

Newsletr License

"NGPL"

Nethack General Public License

"ngrep"

ngrep License

"NICTA-1.0"

NICTA Public Software License, Version 1.0

"NIST-PD"

NIST Public Domain Notice

"NIST-PD-fallback"

NIST Public Domain Notice with license fallback

"NIST-PD-TNT"

NIST Public Domain Notice TNT variant

"NIST-Software"

NIST Software License

"NLOD-1.0"

Norwegian Licence for Open Government Data (NLOD) 1.0

"NLOD-2.0"

Norwegian Licence for Open Government Data (NLOD) 2.0

"NLPL"

No Limit Public License

"Nokia"

Nokia Open Source License

"NOSL"

Netizen Open Source License

"Noweb"

Noweb License

"NPL-1.0"

Netscape Public License v1.0

"NPL-1.1"

Netscape Public License v1.1

"NPOSL-3.0"

Non-Profit Open Software License 3.0

"NRL"

NRL License

"NTIA-PD"

NTIA Public Domain Notice

"NTP"

NTP License

"NTP-0"

NTP No Attribution

"Nunit"

Nunit License

"O-UDA-1.0"

Open Use of Data Agreement v1.0

"OAR"

OAR License

"OCCT-PL"

Open CASCADE Technology Public License

"OCLC-2.0"

OCLC Research Public License 2.0

"ODbL-1.0"

Open Data Commons Open Database License v1.0

"ODC-By-1.0"

Open Data Commons Attribution License v1.0

"OFFIS"

OFFIS License

"OFL-1.0"

SIL Open Font License 1.0

"OFL-1.0-no-RFN"

SIL Open Font License 1.0 with no Reserved Font Name

"OFL-1.0-RFN"

SIL Open Font License 1.0 with Reserved Font Name

"OFL-1.1"

SIL Open Font License 1.1

"OFL-1.1-no-RFN"

SIL Open Font License 1.1 with no Reserved Font Name

"OFL-1.1-RFN"

SIL Open Font License 1.1 with Reserved Font Name

"OGC-1.0"

OGC Software License, Version 1.0

"OGDL-Taiwan-1.0"

Taiwan Open Government Data License, version 1.0

"OGL-Canada-2.0"

Open Government Licence - Canada

"OGL-UK-1.0"

Open Government Licence v1.0

"OGL-UK-2.0"

Open Government Licence v2.0

"OGL-UK-3.0"

Open Government Licence v3.0

"OGTSL"

Open Group Test Suite License

"OLDAP-1.1"

Open LDAP Public License v1.1

"OLDAP-1.2"

Open LDAP Public License v1.2

"OLDAP-1.3"

Open LDAP Public License v1.3

"OLDAP-1.4"

Open LDAP Public License v1.4

"OLDAP-2.0"

Open LDAP Public License v2.0 (or possibly 2.0A and 2.0B)

"OLDAP-2.0.1"

Open LDAP Public License v2.0.1

"OLDAP-2.1"

Open LDAP Public License v2.1

"OLDAP-2.2"

Open LDAP Public License v2.2

"OLDAP-2.2.1"

Open LDAP Public License v2.2.1

"OLDAP-2.2.2"

Open LDAP Public License 2.2.2

"OLDAP-2.3"

Open LDAP Public License v2.3

"OLDAP-2.4"

Open LDAP Public License v2.4

"OLDAP-2.5"

Open LDAP Public License v2.5

"OLDAP-2.6"

Open LDAP Public License v2.6

"OLDAP-2.7"

Open LDAP Public License v2.7

"OLDAP-2.8"

Open LDAP Public License v2.8

"OLFL-1.3"

Open Logistics Foundation License Version 1.3

"OML"

Open Market License

"OpenMDW-1.0"

OpenMDW License Agreement v1.0

"OpenPBS-2.3"

OpenPBS v2.3 Software License

"OpenSSL"

OpenSSL License

"OpenSSL-standalone"

OpenSSL License - standalone

"OpenVision"

OpenVision License

"OPL-1.0"

Open Public License v1.0

"OPL-UK-3.0"

United Kingdom Open Parliament Licence v3.0

"OPUBL-1.0"

Open Publication License v1.0

"OSC-1.0"

OSC License 1.0

"OSET-PL-2.1"

OSET Public License version 2.1

"OSL-1.0"

Open Software License 1.0

"OSL-1.1"

Open Software License 1.1

"OSL-2.0"

Open Software License 2.0

"OSL-2.1"

Open Software License 2.1

"OSL-3.0"

Open Software License 3.0

"OSSP"

OSSP License

"PADL"

PADL License

"ParaType-Free-Font-1.3"

ParaType Free Font Licensing Agreement v1.3

"Parity-6.0.0"

The Parity Public License 6.0.0

"Parity-7.0.0"

The Parity Public License 7.0.0

"PDDL-1.0"

Open Data Commons Public Domain Dedication & License 1.0

"PHP-3.0"

PHP License v3.0

"PHP-3.01"

PHP License v3.01

"Pixar"

Pixar License

"pkgconf"

pkgconf License

"Plexus"

Plexus Classworlds License

"pnmstitch"

pnmstitch License

"PolyForm-Noncommercial-1.0.0"

PolyForm Noncommercial License 1.0.0

"PolyForm-Small-Business-1.0.0"

PolyForm Small Business License 1.0.0

"PostgreSQL"

PostgreSQL License

"PPL"

Peer Production License

"PSF-2.0"

Python Software Foundation License 2.0

"psfrag"

psfrag License

"psutils"

psutils License

"Python-2.0"

Python License 2.0

"Python-2.0.1"

Python License 2.0.1

"python-ldap"

Python ldap License

"Qhull"

Qhull License

"QPL-1.0"

Q Public License 1.0

"QPL-1.0-INRIA-2004"

Q Public License 1.0 - INRIA 2004 variant

"radvd"

radvd License

"Rdisc"

Rdisc License

"RHeCos-1.1"

Red Hat eCos Public License v1.1

"RPL-1.1"

Reciprocal Public License 1.1

"RPL-1.5"

Reciprocal Public License 1.5

"RPSL-1.0"

RealNetworks Public Source License v1.0

"RSA-MD"

RSA Message-Digest License

"RSCPL"

Ricoh Source Code Public License

"Ruby"

Ruby License

"Ruby-pty"

Ruby pty extension license

"SAX-PD"

Sax Public Domain Notice

"SAX-PD-2.0"

Sax Public Domain Notice 2.0

"Saxpath"

Saxpath License

"SCEA"

SCEA Shared Source License

"SchemeReport"

Scheme Language Report License

"Sendmail"

Sendmail License

"Sendmail-8.23"

Sendmail License 8.23

"Sendmail-Open-Source-1.1"

Sendmail Open Source License v1.1

"SGI-B-1.0"

SGI Free Software License B v1.0

"SGI-B-1.1"

SGI Free Software License B v1.1

"SGI-B-2.0"

SGI Free Software License B v2.0

"SGI-OpenGL"

SGI OpenGL License

"SGMLUG-PM"

SGMLUG Parser Materials License

"SGP4"

SGP4 Permission Notice

"SHL-0.5"

Solderpad Hardware License v0.5

"SHL-0.51"

Solderpad Hardware License, Version 0.51

"SimPL-2.0"

Simple Public License 2.0

"SISSL"

Sun Industry Standards Source License v1.1

"SISSL-1.2"

Sun Industry Standards Source License v1.2

"SL"

SL License

"Sleepycat"

Sleepycat License

"SMAIL-GPL"

SMAIL General Public License

"SMLNJ"

Standard ML of New Jersey License

"SMPPL"

Secure Messaging Protocol Public License

"SNIA"

SNIA Public License 1.1

"snprintf"

snprintf License

"SOFA"

SOFA Software License

"softSurfer"

softSurfer License

"Soundex"

Soundex License

"Spencer-86"

Spencer License 86

"Spencer-94"

Spencer License 94

"Spencer-99"

Spencer License 99

"SPL-1.0"

Sun Public License v1.0

"ssh-keyscan"

ssh-keyscan License

"SSH-OpenSSH"

SSH OpenSSH license

"SSH-short"

SSH short notice

"SSLeay-standalone"

SSLeay License - standalone

"SSPL-1.0"

Server Side Public License, v 1

"StandardML-NJ"

Standard ML of New Jersey License

"SugarCRM-1.1.3"

SugarCRM Public License v1.1.3

"SUL-1.0"

Sustainable Use License v1.0

"Sun-PPP"

Sun PPP License

"Sun-PPP-2000"

Sun PPP License (2000)

"SunPro"

SunPro License

"SWL"

Scheme Widget Library (SWL) Software License Agreement

"swrule"

swrule License

"Symlinks"

Symlinks License

"TAPR-OHL-1.0"

TAPR Open Hardware License v1.0

"TCL"

TCL/TK License

"TCP-wrappers"

TCP Wrappers License

"TekHVC"

TekHVC License

"TermReadKey"

TermReadKey License

"TGPPL-1.0"

Transitive Grace Period Public Licence 1.0

"ThirdEye"

ThirdEye License

"threeparttable"

threeparttable License

"TMate"

TMate Open Source License

"TORQUE-1.1"

TORQUE v2.5+ Software License v1.1

"TOSL"

Trusster Open Source License

"TPDL"

Time::ParseDate License

"TPL-1.0"

THOR Public License 1.0

"TrustedQSL"

TrustedQSL License

"TTWL"

Text-Tabs+Wrap License

"TTYP0"

TTYP0 License

"TU-Berlin-1.0"

Technische Universitaet Berlin License 1.0

"TU-Berlin-2.0"

Technische Universitaet Berlin License 2.0

"Ubuntu-font-1.0"

Ubuntu Font Licence v1.0

"UCAR"

UCAR License

"UCL-1.0"

Upstream Compatibility License v1.0

"ulem"

ulem License

"UMich-Merit"

Michigan/Merit Networks License

"Unicode-3.0"

Unicode License v3

"Unicode-DFS-2015"

Unicode License Agreement - Data Files and Software (2015)

"Unicode-DFS-2016"

Unicode License Agreement - Data Files and Software (2016)

"Unicode-TOU"

Unicode Terms of Use

"UnixCrypt"

UnixCrypt License

"Unlicense"

The Unlicense

"Unlicense-libtelnet"

Unlicense - libtelnet variant

"Unlicense-libwhirlpool"

Unlicense - libwhirlpool variant

"UnRAR"

UnRAR License

"UPL-1.0"

Universal Permissive License v1.0

"URT-RLE"

Utah Raster Toolkit Run Length Encoded License

"Vim"

Vim License

"Vixie-Cron"

Vixie Cron License

"VOSTROM"

VOSTROM Public License for Open Source

"VSL-1.0"

Vovida Software License v1.0

"W3C"

W3C Software Notice and License (2002-12-31)

"W3C-19980720"

W3C Software Notice and License (1998-07-20)

"W3C-20150513"

W3C Software Notice and Document License (2015-05-13)

"w3m"

w3m License

"Watcom-1.0"

Sybase Open Watcom Public License 1.0

"Widget-Workshop"

Widget Workshop License

"WordNet"

WordNet License

"Wsuipa"

Wsuipa License

"WTFNMFPL"

Do What The F*ck You Want To But It's Not My Fault Public License

"WTFPL"

Do What The F*ck You Want To Public License

"wwl"

WWL License

"wxWindows"

wxWindows Library License

"X11"

X11 License

"X11-distribute-modifications-variant"

X11 License Distribution Modification Variant

"X11-no-permit-persons"

X11 no permit persons clause

"X11-swapped"

X11 swapped final paragraphs

"Xdebug-1.03"

Xdebug License v 1.03

"Xerox"

Xerox License

"Xfig"

Xfig License

"XFree86-1.1"

XFree86 License 1.1

"xinetd"

xinetd License

"xkeyboard-config-Zinoviev"

xkeyboard-config Zinoviev License

"xlock"

xlock License

"Xnet"

X.Net License

"xpp"

XPP License

"XSkat"

XSkat License

"xzoom"

xzoom License

"YPL-1.0"

Yahoo! Public License v1.0

"YPL-1.1"

Yahoo! Public License v1.1

"Zed"

Zed License

"Zeeff"

Zeeff License

"Zend-2.0"

Zend License v2.0

"Zimbra-1.3"

Zimbra Public License v1.3

"Zimbra-1.4"

Zimbra Public License v1.4

"Zlib"

zlib License

"zlib-acknowledgement"

zlib/libpng License with Acknowledgement

"ZPL-1.1"

Zope Public License 1.1

"ZPL-2.0"

Zope Public License 2.0

"ZPL-2.1"

Zope Public License 2.1

"389-exception"

389 Directory Server Exception

"Asterisk-exception"

Asterisk exception

"Asterisk-linking-protocols-exception"

Asterisk linking protocols exception

"Autoconf-exception-2.0"

Autoconf exception 2.0

"Autoconf-exception-3.0"

Autoconf exception 3.0

"Autoconf-exception-generic"

Autoconf generic exception

"Autoconf-exception-generic-3.0"

Autoconf generic exception for GPL-3.0

"Autoconf-exception-macro"

Autoconf macro exception

"Bison-exception-1.24"

Bison exception 1.24

"Bison-exception-2.2"

Bison exception 2.2

"Bootloader-exception"

Bootloader Distribution Exception

"CGAL-linking-exception"

CGAL Linking Exception

"Classpath-exception-2.0"

Classpath exception 2.0

"Classpath-exception-2.0-short"

Classpath exception 2.0 - short

"CLISP-exception-2.0"

CLISP exception 2.0

"cryptsetup-OpenSSL-exception"

cryptsetup OpenSSL exception

"Digia-Qt-LGPL-exception-1.1"

Digia Qt LGPL Exception version 1.1

"DigiRule-FOSS-exception"

DigiRule FOSS License Exception

"eCos-exception-2.0"

eCos exception 2.0

"erlang-otp-linking-exception"

Erlang/OTP Linking Exception

"Fawkes-Runtime-exception"

Fawkes Runtime Exception

"FLTK-exception"

FLTK exception

"fmt-exception"

fmt exception

"Font-exception-2.0"

Font exception 2.0

"freertos-exception-2.0"

FreeRTOS Exception 2.0

"GCC-exception-2.0"

GCC Runtime Library exception 2.0

"GCC-exception-2.0-note"

GCC Runtime Library exception 2.0 - note variant

"GCC-exception-3.1"

GCC Runtime Library exception 3.1

"Gmsh-exception"

Gmsh exception

"GNAT-exception"

GNAT exception

"GNOME-examples-exception"

GNOME examples exception

"GNU-compiler-exception"

GNU Compiler Exception

"gnu-javamail-exception"

GNU JavaMail exception

"GPL-3.0-389-ds-base-exception"

GPL-3.0 389 DS Base Exception

"GPL-3.0-interface-exception"

GPL-3.0 Interface Exception

"GPL-3.0-linking-exception"

GPL-3.0 Linking Exception

"GPL-3.0-linking-source-exception"

GPL-3.0 Linking Exception (with Corresponding Source)

"GPL-CC-1.0"

GPL Cooperation Commitment 1.0

"GStreamer-exception-2005"

GStreamer Exception (2005)

"GStreamer-exception-2008"

GStreamer Exception (2008)

"harbour-exception"

harbour exception

"i2p-gpl-java-exception"

i2p GPL+Java Exception

"Independent-modules-exception"

Independent Module Linking exception

"KiCad-libraries-exception"

KiCad Libraries Exception

"kvirc-openssl-exception"

kvirc OpenSSL Exception

"LGPL-3.0-linking-exception"

LGPL-3.0 Linking Exception

"libpri-OpenH323-exception"

libpri OpenH323 exception

"Libtool-exception"

Libtool Exception

"Linux-syscall-note"

Linux Syscall Note

"LLGPL"

LLGPL Preamble

"LLVM-exception"

LLVM Exception

"LZMA-exception"

LZMA exception

"mif-exception"

Macros and Inline Functions Exception

"mxml-exception"

mxml Exception

"Nokia-Qt-exception-1.1"

Nokia Qt LGPL exception 1.1

"OCaml-LGPL-linking-exception"

OCaml LGPL Linking Exception

"OCCT-exception-1.0"

Open CASCADE Exception 1.0

"OpenJDK-assembly-exception-1.0"

OpenJDK Assembly exception 1.0

"openvpn-openssl-exception"

OpenVPN OpenSSL Exception

"PCRE2-exception"

PCRE2 exception

"polyparse-exception"

Polyparse Exception

"PS-or-PDF-font-exception-20170817"

PS/PDF font exception (2017-08-17)

"QPL-1.0-INRIA-2004-exception"

INRIA QPL 1.0 2004 variant exception

"Qt-GPL-exception-1.0"

Qt GPL exception 1.0

"Qt-LGPL-exception-1.1"

Qt LGPL exception 1.1

"Qwt-exception-1.0"

Qwt exception 1.0

"romic-exception"

Romic Exception

"RRDtool-FLOSS-exception-2.0"

RRDtool FLOSS exception 2.0

"rsync-linking-exception"

rsync Linking Exception

"SANE-exception"

SANE Exception

"SHL-2.0"

Solderpad Hardware License v2.0

"SHL-2.1"

Solderpad Hardware License v2.1

"Simple-Library-Usage-exception"

Simple Library Usage Exception

"sqlitestudio-OpenSSL-exception"

sqlitestudio OpenSSL exception

"stunnel-exception"

stunnel Exception

"SWI-exception"

SWI exception

"Swift-exception"

Swift Exception

"Texinfo-exception"

Texinfo exception

"u-boot-exception-2.0"

U-Boot exception 2.0

"UBDL-exception"

Unmodified Binary Distribution exception

"Universal-FOSS-exception-1.0"

Universal FOSS Exception, Version 1.0

"vsftpd-openssl-exception"

vsftpd OpenSSL exception

"WxWindows-exception-3.1"

WxWindows Library Exception 3.1

"x11vnc-openssl-exception"

x11vnc OpenSSL Exception


Example:

"Apache-2.0"

Type: string

If SPDX does not define the license used, this field may be used to provide the license name


Example:

"Acme Software License"

Type: object

An optional way to include the textual content of a license.

No Additional Properties

Type: string Default: "text/plain"

Specifies the content type of the text. Defaults to text/plain if not specified.

Type: enum (of string)

Specifies the optional encoding the text is represented in.

Must be one of:

  • "base64"

Type: string

The attachment data. Proactive controls such as input validation and sanitization should be employed to prevent misuse of attachment text.

Type: stringFormat: iri-reference

The URL to the license file. If specified, a 'license' externalReference should also be specified for completeness


Example:

"https://www.apache.org/licenses/LICENSE-2.0.txt"

Type: string

Examples:

"Apache-2.0 AND (MIT OR GPL-2.0-only)"

"GPL-3.0-only WITH Classpath-exception-2.0"

Type: string

Specifies a well-formed CPE name that conforms to the CPE 2.2 or 2.3 specification. See https://nvd.nist.gov/products/cpe


Example:

"cpe:2.3:a:acme:component_framework:-:*:*:*:*:*:*:*"

Type: string

Specifies the package-url (purl). The purl, if specified, MUST be valid and conform to the specification defined at: https://github.com/package-url/purl-spec


Example:

"pkg:maven/com.acme/[email protected]?packaging=jar"

Type: object

Specifies metadata and content for ISO-IEC 19770-2 Software Identification (SWID) Tags.

No Additional Properties

Type: string

Maps to the tagId of a SoftwareIdentity.

Type: string

Maps to the name of a SoftwareIdentity.

Type: string Default: "0.0"

Maps to the version of a SoftwareIdentity.

Type: integer Default: 0

Maps to the tagVersion of a SoftwareIdentity.

Type: boolean Default: false

Maps to the patch of a SoftwareIdentity.

Type: object

Specifies the metadata and content of the SWID tag.

No Additional Properties

Type: string Default: "text/plain"

Specifies the content type of the text. Defaults to text/plain if not specified.

Type: enum (of string)

Specifies the optional encoding the text is represented in.

Must be one of:

  • "base64"

Type: string

The attachment data. Proactive controls such as input validation and sanitization should be employed to prevent misuse of attachment text.

Type: stringFormat: iri-reference

The URL to the SWID file.

Type: boolean

[Deprecated] - DO NOT USE. This will be removed in a future version. Use the pedigree element instead to supply information on exactly how the component was modified. A boolean value indicating if the component has been modified from the original. A value of true indicates the component is a derivative of the original. A value of false indicates the component has not been modified from the original.

Type: object

Component pedigree is a way to document complex supply chain scenarios where components are created, distributed, modified, redistributed, combined with other components, etc. Pedigree supports viewing this complex chain from the beginning, the end, or anywhere in the middle. It also provides a way to document variants where the exact relation may not be known.

No Additional Properties

Type: array

Describes zero or more components in which a component is derived from. This is commonly used to describe forks from existing projects where the forked version contains a ancestor node containing the original component it was forked from. For example, Component A is the original component. Component B is the component being used and documented in the BOM. However, Component B contains a pedigree node with a single ancestor documenting Component A - the original component from which Component B is derived from.

No Additional Items

Each item of this array must be:

Type: object
Same definition as component

Type: array

Descendants are the exact opposite of ancestors. This provides a way to document all forks (and their forks) of an original or root component.

No Additional Items

Each item of this array must be:

Type: object
Same definition as component

Type: array

Variants describe relations where the relationship between the components are not known. For example, if Component A contains nearly identical code to Component B. They are both related, but it is unclear if one is derived from the other, or if they share a common ancestor.

No Additional Items

Each item of this array must be:

Type: object
Same definition as component

Type: array

A list of zero or more commits which provide a trail describing how the component deviates from an ancestor, descendant, or variant.

No Additional Items

Each item of this array must be:

Type: object

Specifies an individual commit

No Additional Properties

Type: string

A unique identifier of the commit. This may be version control specific. For example, Subversion uses revision numbers whereas git uses commit hashes.

Type: stringFormat: iri-reference

The URL to the commit. This URL will typically point to a commit in a version control system.

Type: object

The author who created the changes in the commit

No Additional Properties

Type: stringFormat: date-time

The timestamp in which the action occurred

Type: string

The name of the individual who performed the action

Type: stringFormat: idn-email

The email address of the individual who performed the action

Type: object

The person who committed or pushed the commit

No Additional Properties

Type: stringFormat: date-time

The timestamp in which the action occurred

Type: string

The name of the individual who performed the action

Type: stringFormat: idn-email

The email address of the individual who performed the action

Type: string

The text description of the contents of the commit

Type: array

A list of zero or more patches describing how the component deviates from an ancestor, descendant, or variant. Patches may be complimentary to commits or may be used in place of commits.

No Additional Items

Each item of this array must be:

Type: object

Specifies an individual patch

No Additional Properties

Type: enum (of string)

Specifies the purpose for the patch including the resolution of defects, security issues, or new behavior or functionality.

Must be one of:

  • "unofficial"
  • "monkey"
  • "backport"
  • "cherry-pick"

Type: object

The patch file (or diff) that show changes. Refer to https://en.wikipedia.org/wiki/Diff

No Additional Properties

Type: object

Specifies the optional text of the diff

No Additional Properties

Type: string Default: "text/plain"

Specifies the content type of the text. Defaults to text/plain if not specified.

Type: enum (of string)

Specifies the optional encoding the text is represented in.

Must be one of:

  • "base64"

Type: string

The attachment data. Proactive controls such as input validation and sanitization should be employed to prevent misuse of attachment text.

Type: stringFormat: iri-reference

Specifies the URL to the diff

Type: array

A collection of issues the patch resolves

No Additional Items

Each item of this array must be:

Type: object

An individual issue that has been resolved.

No Additional Properties

Type: enum (of string)

Specifies the type of issue

Must be one of:

  • "defect"
  • "enhancement"
  • "security"

Type: string

The identifier of the issue assigned by the source of the issue

Type: string

The name of the issue

Type: string

A description of the issue

Type: object

The source of the issue where it is documented

No Additional Properties

Type: string

The name of the source. For example 'National Vulnerability Database', 'NVD', and 'Apache'

Type: stringFormat: iri-reference

The url of the issue documentation as provided by the source

Type: array of string

A collection of URL's for reference. Multiple URLs are allowed.

No Additional Items

Each item of this array must be:

Type: stringFormat: iri-reference

Example:

"https://example.com"

Type: string

Notes, observations, and other non-structured commentary describing the components pedigree.

Type: array

External references provide a way to document systems, sites, and information that may be relevant but which are not included with the BOM.

No Additional Items

Each item of this array must be:

Type: object

Specifies an individual external reference

No Additional Properties

Type: stringFormat: iri-reference

The URL to the external reference

Type: string

An optional comment describing the external reference

Type: enum (of string)

Specifies the type of external reference. There are built-in types to describe common references. If a type does not exist for the reference being referred to, use the "other" type.

Must be one of:

  • "vcs"
  • "issue-tracker"
  • "website"
  • "advisories"
  • "bom"
  • "mailing-list"
  • "social"
  • "chat"
  • "documentation"
  • "support"
  • "distribution"
  • "license"
  • "build-meta"
  • "build-system"
  • "release-notes"
  • "other"

Type: array

The hashes of the external reference (if applicable).

No Additional Items

Each item of this array must be:

Type: object
No Additional Properties

Type: enum (of string)

Must be one of:

  • "MD5"
  • "SHA-1"
  • "SHA-256"
  • "SHA-384"
  • "SHA-512"
  • "SHA3-256"
  • "SHA3-384"
  • "SHA3-512"
  • "BLAKE2b-256"
  • "BLAKE2b-384"
  • "BLAKE2b-512"
  • "BLAKE3"

Type: string
Must match regular expression: ^([a-fA-F0-9]{32}|[a-fA-F0-9]{40}|[a-fA-F0-9]{64}|[a-fA-F0-9]{96}|[a-fA-F0-9]{128})$
Example:

"3942447fac867ae5cdb3229b658f4d48"

Type: array

A list of software and hardware components included in the parent component. This is not a dependency tree. It provides a way to specify a hierarchical representation of component assemblies, similar to system → subsystem → parts assembly in physical supply chains.

All items must be unique

No Additional Items

Each item of this array must be:

Type: object
Same definition as component

Type: object

Provides the ability to document evidence collected through various forms of extraction or analysis.

No Additional Properties

Type: array
No Additional Items

Each item of this array must be:

Type: object
No Additional Properties

Type: object

The following properties are required:

  • license
Type: object

The following properties are required:

  • expression

Type: object
No Additional Properties

Type: object

The following properties are required:

  • id
Type: object

The following properties are required:

  • name

Type: enum (of string)

A valid SPDX license ID

Must be one of:

NameDescription
"0BSD"

BSD Zero Clause License

"3D-Slicer-1.0"

3D Slicer License v1.0

"AAL"

Attribution Assurance License

"Abstyles"

Abstyles License

"AdaCore-doc"

AdaCore Doc License

"Adobe-2006"

Adobe Systems Incorporated Source Code License Agreement

"Adobe-Display-PostScript"

Adobe Display PostScript License

"Adobe-Glyph"

Adobe Glyph List License

"Adobe-Utopia"

Adobe Utopia Font License

"ADSL"

Amazon Digital Services License

"Advanced-Cryptics-Dictionary"

Advanced Cryptics Dictionary License

"AFL-1.1"

Academic Free License v1.1

"AFL-1.2"

Academic Free License v1.2

"AFL-2.0"

Academic Free License v2.0

"AFL-2.1"

Academic Free License v2.1

"AFL-3.0"

Academic Free License v3.0

"Afmparse"

Afmparse License

"AGPL-1.0"

Affero General Public License v1.0

"AGPL-1.0-only"

Affero General Public License v1.0 only

"AGPL-1.0-or-later"

Affero General Public License v1.0 or later

"AGPL-3.0"

GNU Affero General Public License v3.0

"AGPL-3.0-only"

GNU Affero General Public License v3.0 only

"AGPL-3.0-or-later"

GNU Affero General Public License v3.0 or later

"Aladdin"

Aladdin Free Public License

"ALGLIB-Documentation"

ALGLIB Documentation License

"AMD-newlib"

AMD newlib License

"AMDPLPA"

AMD's plpa_map.c License

"AML"

Apple MIT License

"AML-glslang"

AML glslang variant License

"AMPAS"

Academy of Motion Picture Arts and Sciences BSD

"ANTLR-PD"

ANTLR Software Rights Notice

"ANTLR-PD-fallback"

ANTLR Software Rights Notice with license fallback

"any-OSI"

Any OSI License

"any-OSI-perl-modules"

Any OSI License - Perl Modules

"Apache-1.0"

Apache License 1.0

"Apache-1.1"

Apache License 1.1

"Apache-2.0"

Apache License 2.0

"APAFML"

Adobe Postscript AFM License

"APL-1.0"

Adaptive Public License 1.0

"App-s2p"

App::s2p License

"APSL-1.0"

Apple Public Source License 1.0

"APSL-1.1"

Apple Public Source License 1.1

"APSL-1.2"

Apple Public Source License 1.2

"APSL-2.0"

Apple Public Source License 2.0

"Arphic-1999"

Arphic Public License

"Artistic-1.0"

Artistic License 1.0

"Artistic-1.0-cl8"

Artistic License 1.0 w/clause 8

"Artistic-1.0-Perl"

Artistic License 1.0 (Perl)

"Artistic-2.0"

Artistic License 2.0

"Artistic-dist"

Artistic License 1.0 (dist)

"Aspell-RU"

Aspell Russian License

"ASWF-Digital-Assets-1.0"

ASWF Digital Assets License version 1.0

"ASWF-Digital-Assets-1.1"

ASWF Digital Assets License 1.1

"Baekmuk"

Baekmuk License

"Bahyph"

Bahyph License

"Barr"

Barr License

"bcrypt-Solar-Designer"

bcrypt Solar Designer License

"Beerware"

Beerware License

"Bitstream-Charter"

Bitstream Charter Font License

"Bitstream-Vera"

Bitstream Vera Font License

"BitTorrent-1.0"

BitTorrent Open Source License v1.0

"BitTorrent-1.1"

BitTorrent Open Source License v1.1

"blessing"

SQLite Blessing

"BlueOak-1.0.0"

Blue Oak Model License 1.0.0

"Boehm-GC"

Boehm-Demers-Weiser GC License

"Boehm-GC-without-fee"

Boehm-Demers-Weiser GC License (without fee)

"BOLA-1.1"

Buena Onda License Agreement v1.1

"Borceux"

Borceux license

"Brian-Gladman-2-Clause"

Brian Gladman 2-Clause License

"Brian-Gladman-3-Clause"

Brian Gladman 3-Clause License

"BSD-1-Clause"

BSD 1-Clause License

"BSD-2-Clause"

BSD 2-Clause "Simplified" License

"BSD-2-Clause-Darwin"

BSD 2-Clause - Ian Darwin variant

"BSD-2-Clause-first-lines"

BSD 2-Clause - first lines requirement

"BSD-2-Clause-FreeBSD"

BSD 2-Clause FreeBSD License

"BSD-2-Clause-NetBSD"

BSD 2-Clause NetBSD License

"BSD-2-Clause-Patent"

BSD-2-Clause Plus Patent License

"BSD-2-Clause-pkgconf-disclaimer"

BSD 2-Clause pkgconf disclaimer variant

"BSD-2-Clause-Views"

BSD 2-Clause with views sentence

"BSD-3-Clause"

BSD 3-Clause "New" or "Revised" License

"BSD-3-Clause-acpica"

BSD 3-Clause acpica variant

"BSD-3-Clause-Attribution"

BSD with attribution

"BSD-3-Clause-Clear"

BSD 3-Clause Clear License

"BSD-3-Clause-flex"

BSD 3-Clause Flex variant

"BSD-3-Clause-HP"

Hewlett-Packard BSD variant license

"BSD-3-Clause-LBNL"

Lawrence Berkeley National Labs BSD variant license

"BSD-3-Clause-Modification"

BSD 3-Clause Modification

"BSD-3-Clause-No-Military-License"

BSD 3-Clause No Military License

"BSD-3-Clause-No-Nuclear-License"

BSD 3-Clause No Nuclear License

"BSD-3-Clause-No-Nuclear-License-2014"

BSD 3-Clause No Nuclear License 2014

"BSD-3-Clause-No-Nuclear-Warranty"

BSD 3-Clause No Nuclear Warranty

"BSD-3-Clause-Open-MPI"

BSD 3-Clause Open MPI variant

"BSD-3-Clause-Sun"

BSD 3-Clause Sun Microsystems

"BSD-3-Clause-Tso"

BSD 3-Clause Tso variant

"BSD-4-Clause"

BSD 4-Clause "Original" or "Old" License

"BSD-4-Clause-Shortened"

BSD 4 Clause Shortened

"BSD-4-Clause-UC"

BSD-4-Clause (University of California-Specific)

"BSD-4.3RENO"

BSD 4.3 RENO License

"BSD-4.3TAHOE"

BSD 4.3 TAHOE License

"BSD-Advertising-Acknowledgement"

BSD Advertising Acknowledgement License

"BSD-Attribution-HPND-disclaimer"

BSD with Attribution and HPND disclaimer

"BSD-Inferno-Nettverk"

BSD-Inferno-Nettverk

"BSD-Mark-Modifications"

BSD Mark Modifications License

"BSD-Protection"

BSD Protection License

"BSD-Source-beginning-file"

BSD Source Code Attribution - beginning of file variant

"BSD-Source-Code"

BSD Source Code Attribution

"BSD-Systemics"

Systemics BSD variant license

"BSD-Systemics-W3Works"

Systemics W3Works BSD variant license

"BSL-1.0"

Boost Software License 1.0

"Buddy"

Buddy License

"BUSL-1.1"

Business Source License 1.1

"bzip2-1.0.5"

bzip2 and libbzip2 License v1.0.5

"bzip2-1.0.6"

bzip2 and libbzip2 License v1.0.6

"C-UDA-1.0"

Computational Use of Data Agreement v1.0

"CAL-1.0"

Cryptographic Autonomy License 1.0

"CAL-1.0-Combined-Work-Exception"

Cryptographic Autonomy License 1.0 (Combined Work Exception)

"Caldera"

Caldera License

"Caldera-no-preamble"

Caldera License (without preamble)

"CAPEC-tou"

Common Attack Pattern Enumeration and Classification License

"Catharon"

Catharon License

"CATOSL-1.1"

Computer Associates Trusted Open Source License 1.1

"CC-BY-1.0"

Creative Commons Attribution 1.0 Generic

"CC-BY-2.0"

Creative Commons Attribution 2.0 Generic

"CC-BY-2.5"

Creative Commons Attribution 2.5 Generic

"CC-BY-2.5-AU"

Creative Commons Attribution 2.5 Australia

"CC-BY-3.0"

Creative Commons Attribution 3.0 Unported

"CC-BY-3.0-AT"

Creative Commons Attribution 3.0 Austria

"CC-BY-3.0-AU"

Creative Commons Attribution 3.0 Australia

"CC-BY-3.0-DE"

Creative Commons Attribution 3.0 Germany

"CC-BY-3.0-IGO"

Creative Commons Attribution 3.0 IGO

"CC-BY-3.0-NL"

Creative Commons Attribution 3.0 Netherlands

"CC-BY-3.0-US"

Creative Commons Attribution 3.0 United States

"CC-BY-4.0"

Creative Commons Attribution 4.0 International

"CC-BY-NC-1.0"

Creative Commons Attribution Non Commercial 1.0 Generic

"CC-BY-NC-2.0"

Creative Commons Attribution Non Commercial 2.0 Generic

"CC-BY-NC-2.5"

Creative Commons Attribution Non Commercial 2.5 Generic

"CC-BY-NC-3.0"

Creative Commons Attribution Non Commercial 3.0 Unported

"CC-BY-NC-3.0-DE"

Creative Commons Attribution Non Commercial 3.0 Germany

"CC-BY-NC-4.0"

Creative Commons Attribution Non Commercial 4.0 International

"CC-BY-NC-ND-1.0"

Creative Commons Attribution Non Commercial No Derivatives 1.0 Generic

"CC-BY-NC-ND-2.0"

Creative Commons Attribution Non Commercial No Derivatives 2.0 Generic

"CC-BY-NC-ND-2.5"

Creative Commons Attribution Non Commercial No Derivatives 2.5 Generic

"CC-BY-NC-ND-3.0"

Creative Commons Attribution Non Commercial No Derivatives 3.0 Unported

"CC-BY-NC-ND-3.0-DE"

Creative Commons Attribution Non Commercial No Derivatives 3.0 Germany

"CC-BY-NC-ND-3.0-IGO"

Creative Commons Attribution Non Commercial No Derivatives 3.0 IGO

"CC-BY-NC-ND-4.0"

Creative Commons Attribution Non Commercial No Derivatives 4.0 International

"CC-BY-NC-SA-1.0"

Creative Commons Attribution Non Commercial Share Alike 1.0 Generic

"CC-BY-NC-SA-2.0"

Creative Commons Attribution Non Commercial Share Alike 2.0 Generic

"CC-BY-NC-SA-2.0-DE"

Creative Commons Attribution Non Commercial Share Alike 2.0 Germany

"CC-BY-NC-SA-2.0-FR"

Creative Commons Attribution-NonCommercial-ShareAlike 2.0 France

"CC-BY-NC-SA-2.0-UK"

Creative Commons Attribution Non Commercial Share Alike 2.0 England and Wales

"CC-BY-NC-SA-2.5"

Creative Commons Attribution Non Commercial Share Alike 2.5 Generic

"CC-BY-NC-SA-3.0"

Creative Commons Attribution Non Commercial Share Alike 3.0 Unported

"CC-BY-NC-SA-3.0-DE"

Creative Commons Attribution Non Commercial Share Alike 3.0 Germany

"CC-BY-NC-SA-3.0-IGO"

Creative Commons Attribution Non Commercial Share Alike 3.0 IGO

"CC-BY-NC-SA-4.0"

Creative Commons Attribution Non Commercial Share Alike 4.0 International

"CC-BY-ND-1.0"

Creative Commons Attribution No Derivatives 1.0 Generic

"CC-BY-ND-2.0"

Creative Commons Attribution No Derivatives 2.0 Generic

"CC-BY-ND-2.5"

Creative Commons Attribution No Derivatives 2.5 Generic

"CC-BY-ND-3.0"

Creative Commons Attribution No Derivatives 3.0 Unported

"CC-BY-ND-3.0-DE"

Creative Commons Attribution No Derivatives 3.0 Germany

"CC-BY-ND-4.0"

Creative Commons Attribution No Derivatives 4.0 International

"CC-BY-SA-1.0"

Creative Commons Attribution Share Alike 1.0 Generic

"CC-BY-SA-2.0"

Creative Commons Attribution Share Alike 2.0 Generic

"CC-BY-SA-2.0-UK"

Creative Commons Attribution Share Alike 2.0 England and Wales

"CC-BY-SA-2.1-JP"

Creative Commons Attribution Share Alike 2.1 Japan

"CC-BY-SA-2.5"

Creative Commons Attribution Share Alike 2.5 Generic

"CC-BY-SA-3.0"

Creative Commons Attribution Share Alike 3.0 Unported

"CC-BY-SA-3.0-AT"

Creative Commons Attribution Share Alike 3.0 Austria

"CC-BY-SA-3.0-DE"

Creative Commons Attribution Share Alike 3.0 Germany

"CC-BY-SA-3.0-IGO"

Creative Commons Attribution-ShareAlike 3.0 IGO

"CC-BY-SA-4.0"

Creative Commons Attribution Share Alike 4.0 International

"CC-PDDC"

Creative Commons Public Domain Dedication and Certification

"CC-PDM-1.0"

Creative Commons Public Domain Mark 1.0 Universal

"CC-SA-1.0"

Creative Commons Share Alike 1.0 Generic

"CC0-1.0"

Creative Commons Zero v1.0 Universal

"CDDL-1.0"

Common Development and Distribution License 1.0

"CDDL-1.1"

Common Development and Distribution License 1.1

"CDL-1.0"

Common Documentation License 1.0

"CDLA-Permissive-1.0"

Community Data License Agreement Permissive 1.0

"CDLA-Permissive-2.0"

Community Data License Agreement Permissive 2.0

"CDLA-Sharing-1.0"

Community Data License Agreement Sharing 1.0

"CECILL-1.0"

CeCILL Free Software License Agreement v1.0

"CECILL-1.1"

CeCILL Free Software License Agreement v1.1

"CECILL-2.0"

CeCILL Free Software License Agreement v2.0

"CECILL-2.1"

CeCILL Free Software License Agreement v2.1

"CECILL-B"

CeCILL-B Free Software License Agreement

"CECILL-C"

CeCILL-C Free Software License Agreement

"CERN-OHL-1.1"

CERN Open Hardware Licence v1.1

"CERN-OHL-1.2"

CERN Open Hardware Licence v1.2

"CERN-OHL-P-2.0"

CERN Open Hardware Licence Version 2 - Permissive

"CERN-OHL-S-2.0"

CERN Open Hardware Licence Version 2 - Strongly Reciprocal

"CERN-OHL-W-2.0"

CERN Open Hardware Licence Version 2 - Weakly Reciprocal

"CFITSIO"

CFITSIO License

"check-cvs"

check-cvs License

"checkmk"

Checkmk License

"ClArtistic"

Clarified Artistic License

"Clips"

Clips License

"CMU-Mach"

CMU Mach License

"CMU-Mach-nodoc"

CMU Mach - no notices-in-documentation variant

"CNRI-Jython"

CNRI Jython License

"CNRI-Python"

CNRI Python License

"CNRI-Python-GPL-Compatible"

CNRI Python Open Source GPL Compatible License Agreement

"COIL-1.0"

Copyfree Open Innovation License

"Community-Spec-1.0"

Community Specification License 1.0

"Condor-1.1"

Condor Public License v1.1

"copyleft-next-0.3.0"

copyleft-next 0.3.0

"copyleft-next-0.3.1"

copyleft-next 0.3.1

"Cornell-Lossless-JPEG"

Cornell Lossless JPEG License

"CPAL-1.0"

Common Public Attribution License 1.0

"CPL-1.0"

Common Public License 1.0

"CPOL-1.02"

Code Project Open License 1.02

"Cronyx"

Cronyx License

"Crossword"

Crossword License

"CryptoSwift"

CryptoSwift License

"CrystalStacker"

CrystalStacker License

"CUA-OPL-1.0"

CUA Office Public License v1.0

"Cube"

Cube License

"curl"

curl License

"cve-tou"

Common Vulnerability Enumeration ToU License

"D-FSL-1.0"

Deutsche Freie Software Lizenz

"DEC-3-Clause"

DEC 3-Clause License

"diffmark"

diffmark license

"DL-DE-BY-2.0"

Data licence Germany – attribution – version 2.0

"DL-DE-ZERO-2.0"

Data licence Germany – zero – version 2.0

"DOC"

DOC License

"DocBook-DTD"

DocBook DTD License

"DocBook-Schema"

DocBook Schema License

"DocBook-Stylesheet"

DocBook Stylesheet License

"DocBook-XML"

DocBook XML License

"Dotseqn"

Dotseqn License

"DRL-1.0"

Detection Rule License 1.0

"DRL-1.1"

Detection Rule License 1.1

"DSDP"

DSDP License

"dtoa"

David M. Gay dtoa License

"dvipdfm"

dvipdfm License

"ECL-1.0"

Educational Community License v1.0

"ECL-2.0"

Educational Community License v2.0

"eCos-2.0"

eCos license version 2.0

"EFL-1.0"

Eiffel Forum License v1.0

"EFL-2.0"

Eiffel Forum License v2.0

"eGenix"

eGenix.com Public License 1.1.0

"Elastic-2.0"

Elastic License 2.0

"Entessa"

Entessa Public License v1.0

"EPICS"

EPICS Open License

"EPL-1.0"

Eclipse Public License 1.0

"EPL-2.0"

Eclipse Public License 2.0

"ErlPL-1.1"

Erlang Public License v1.1

"ESA-PL-permissive-2.4"

European Space Agency Public License – v2.4 – Permissive (Type 3)

"ESA-PL-strong-copyleft-2.4"

European Space Agency Public License (ESA-PL) - V2.4 - Strong Copyleft (Type 1)

"ESA-PL-weak-copyleft-2.4"

European Space Agency Public License – v2.4 – Weak Copyleft (Type 2)

"etalab-2.0"

Etalab Open License 2.0

"EUDatagrid"

EU DataGrid Software License

"EUPL-1.0"

European Union Public License 1.0

"EUPL-1.1"

European Union Public License 1.1

"EUPL-1.2"

European Union Public License 1.2

"Eurosym"

Eurosym License

"Fair"

Fair License

"FBM"

Fuzzy Bitmap License

"FDK-AAC"

Fraunhofer FDK AAC Codec Library

"Ferguson-Twofish"

Ferguson Twofish License

"Frameworx-1.0"

Frameworx Open License 1.0

"FreeBSD-DOC"

FreeBSD Documentation License

"FreeImage"

FreeImage Public License v1.0

"FSFAP"

FSF All Permissive License

"FSFAP-no-warranty-disclaimer"

FSF All Permissive License (without Warranty)

"FSFUL"

FSF Unlimited License

"FSFULLR"

FSF Unlimited License (with License Retention)

"FSFULLRSD"

FSF Unlimited License (with License Retention and Short Disclaimer)

"FSFULLRWD"

FSF Unlimited License (With License Retention and Warranty Disclaimer)

"FSL-1.1-ALv2"

Functional Source License, Version 1.1, ALv2 Future License

"FSL-1.1-MIT"

Functional Source License, Version 1.1, MIT Future License

"FTL"

Freetype Project License

"Furuseth"

Furuseth License

"fwlw"

fwlw License

"Game-Programming-Gems"

Game Programming Gems License

"GCR-docs"

Gnome GCR Documentation License

"GD"

GD License

"generic-xts"

Generic XTS License

"GFDL-1.1"

GNU Free Documentation License v1.1

"GFDL-1.1-invariants-only"

GNU Free Documentation License v1.1 only - invariants

"GFDL-1.1-invariants-or-later"

GNU Free Documentation License v1.1 or later - invariants

"GFDL-1.1-no-invariants-only"

GNU Free Documentation License v1.1 only - no invariants

"GFDL-1.1-no-invariants-or-later"

GNU Free Documentation License v1.1 or later - no invariants

"GFDL-1.1-only"

GNU Free Documentation License v1.1 only

"GFDL-1.1-or-later"

GNU Free Documentation License v1.1 or later

"GFDL-1.2"

GNU Free Documentation License v1.2

"GFDL-1.2-invariants-only"

GNU Free Documentation License v1.2 only - invariants

"GFDL-1.2-invariants-or-later"

GNU Free Documentation License v1.2 or later - invariants

"GFDL-1.2-no-invariants-only"

GNU Free Documentation License v1.2 only - no invariants

"GFDL-1.2-no-invariants-or-later"

GNU Free Documentation License v1.2 or later - no invariants

"GFDL-1.2-only"

GNU Free Documentation License v1.2 only

"GFDL-1.2-or-later"

GNU Free Documentation License v1.2 or later

"GFDL-1.3"

GNU Free Documentation License v1.3

"GFDL-1.3-invariants-only"

GNU Free Documentation License v1.3 only - invariants

"GFDL-1.3-invariants-or-later"

GNU Free Documentation License v1.3 or later - invariants

"GFDL-1.3-no-invariants-only"

GNU Free Documentation License v1.3 only - no invariants

"GFDL-1.3-no-invariants-or-later"

GNU Free Documentation License v1.3 or later - no invariants

"GFDL-1.3-only"

GNU Free Documentation License v1.3 only

"GFDL-1.3-or-later"

GNU Free Documentation License v1.3 or later

"Giftware"

Giftware License

"GL2PS"

GL2PS License

"Glide"

3dfx Glide License

"Glulxe"

Glulxe License

"GLWTPL"

Good Luck With That Public License

"gnuplot"

gnuplot License

"GPL-1.0"

GNU General Public License v1.0 only

"GPL-1.0+"

GNU General Public License v1.0 or later

"GPL-1.0-only"

GNU General Public License v1.0 only

"GPL-1.0-or-later"

GNU General Public License v1.0 or later

"GPL-2.0"

GNU General Public License v2.0 only

"GPL-2.0+"

GNU General Public License v2.0 or later

"GPL-2.0-only"

GNU General Public License v2.0 only

"GPL-2.0-or-later"

GNU General Public License v2.0 or later

"GPL-2.0-with-autoconf-exception"

GNU General Public License v2.0 w/Autoconf exception

"GPL-2.0-with-bison-exception"

GNU General Public License v2.0 w/Bison exception

"GPL-2.0-with-classpath-exception"

GNU General Public License v2.0 w/Classpath exception

"GPL-2.0-with-font-exception"

GNU General Public License v2.0 w/Font exception

"GPL-2.0-with-GCC-exception"

GNU General Public License v2.0 w/GCC Runtime Library exception

"GPL-3.0"

GNU General Public License v3.0 only

"GPL-3.0+"

GNU General Public License v3.0 or later

"GPL-3.0-only"

GNU General Public License v3.0 only

"GPL-3.0-or-later"

GNU General Public License v3.0 or later

"GPL-3.0-with-autoconf-exception"

GNU General Public License v3.0 w/Autoconf exception

"GPL-3.0-with-GCC-exception"

GNU General Public License v3.0 w/GCC Runtime Library exception

"Graphics-Gems"

Graphics Gems License

"gSOAP-1.3b"

gSOAP Public License v1.3b

"gtkbook"

gtkbook License

"Gutmann"

Gutmann License

"HaskellReport"

Haskell Language Report License

"HDF5"

HDF5 License

"hdparm"

hdparm License

"HIDAPI"

HIDAPI License

"Hippocratic-2.1"

Hippocratic License 2.1

"HP-1986"

Hewlett-Packard 1986 License

"HP-1989"

Hewlett-Packard 1989 License

"HPND"

Historical Permission Notice and Disclaimer

"HPND-DEC"

Historical Permission Notice and Disclaimer - DEC variant

"HPND-doc"

Historical Permission Notice and Disclaimer - documentation variant

"HPND-doc-sell"

Historical Permission Notice and Disclaimer - documentation sell variant

"HPND-export-US"

HPND with US Government export control warning

"HPND-export-US-acknowledgement"

HPND with US Government export control warning and acknowledgment

"HPND-export-US-modify"

HPND with US Government export control warning and modification rqmt

"HPND-export2-US"

HPND with US Government export control and 2 disclaimers

"HPND-Fenneberg-Livingston"

Historical Permission Notice and Disclaimer - Fenneberg-Livingston variant

"HPND-INRIA-IMAG"

Historical Permission Notice and Disclaimer - INRIA-IMAG variant

"HPND-Intel"

Historical Permission Notice and Disclaimer - Intel variant

"HPND-Kevlin-Henney"

Historical Permission Notice and Disclaimer - Kevlin Henney variant

"HPND-Markus-Kuhn"

Historical Permission Notice and Disclaimer - Markus Kuhn variant

"HPND-merchantability-variant"

Historical Permission Notice and Disclaimer - merchantability variant

"HPND-MIT-disclaimer"

Historical Permission Notice and Disclaimer with MIT disclaimer

"HPND-Netrek"

Historical Permission Notice and Disclaimer - Netrek variant

"HPND-Pbmplus"

Historical Permission Notice and Disclaimer - Pbmplus variant

"HPND-sell-MIT-disclaimer-xserver"

Historical Permission Notice and Disclaimer - sell xserver variant with MIT disclaimer

"HPND-sell-regexpr"

Historical Permission Notice and Disclaimer - sell regexpr variant

"HPND-sell-variant"

Historical Permission Notice and Disclaimer - sell variant

"HPND-sell-variant-critical-systems"

HPND - sell variant with safety critical systems clause

"HPND-sell-variant-MIT-disclaimer"

HPND sell variant with MIT disclaimer

"HPND-sell-variant-MIT-disclaimer-rev"

HPND sell variant with MIT disclaimer - reverse

"HPND-SMC"

Historical Permission Notice and Disclaimer - SMC variant

"HPND-UC"

Historical Permission Notice and Disclaimer - University of California variant

"HPND-UC-export-US"

Historical Permission Notice and Disclaimer - University of California, US export warning

"HTMLTIDY"

HTML Tidy License

"hyphen-bulgarian"

hyphen-bulgarian License

"IBM-pibs"

IBM PowerPC Initialization and Boot Software

"ICU"

ICU License

"IEC-Code-Components-EULA"

IEC Code Components End-user licence agreement

"IJG"

Independent JPEG Group License

"IJG-short"

Independent JPEG Group License - short

"ImageMagick"

ImageMagick License

"iMatix"

iMatix Standard Function Library Agreement

"Imlib2"

Imlib2 License

"Info-ZIP"

Info-ZIP License

"Inner-Net-2.0"

Inner Net License v2.0

"InnoSetup"

Inno Setup License

"Intel"

Intel Open Source License

"Intel-ACPI"

Intel ACPI Software License Agreement

"Interbase-1.0"

Interbase Public License v1.0

"IPA"

IPA Font License

"IPL-1.0"

IBM Public License v1.0

"ISC"

ISC License

"ISC-Veillard"

ISC Veillard variant

"ISO-permission"

ISO permission notice

"Jam"

Jam License

"JasPer-2.0"

JasPer License

"jove"

Jove License

"JPL-image"

JPL Image Use Policy

"JPNIC"

Japan Network Information Center License

"JSON"

JSON License

"Kastrup"

Kastrup License

"Kazlib"

Kazlib License

"Knuth-CTAN"

Knuth CTAN License

"LAL-1.2"

Licence Art Libre 1.2

"LAL-1.3"

Licence Art Libre 1.3

"Latex2e"

Latex2e License

"Latex2e-translated-notice"

Latex2e with translated notice permission

"Leptonica"

Leptonica License

"LGPL-2.0"

GNU Library General Public License v2 only

"LGPL-2.0+"

GNU Library General Public License v2 or later

"LGPL-2.0-only"

GNU Library General Public License v2 only

"LGPL-2.0-or-later"

GNU Library General Public License v2 or later

"LGPL-2.1"

GNU Lesser General Public License v2.1 only

"LGPL-2.1+"

GNU Lesser General Public License v2.1 or later

"LGPL-2.1-only"

GNU Lesser General Public License v2.1 only

"LGPL-2.1-or-later"

GNU Lesser General Public License v2.1 or later

"LGPL-3.0"

GNU Lesser General Public License v3.0 only

"LGPL-3.0+"

GNU Lesser General Public License v3.0 or later

"LGPL-3.0-only"

GNU Lesser General Public License v3.0 only

"LGPL-3.0-or-later"

GNU Lesser General Public License v3.0 or later

"LGPLLR"

Lesser General Public License For Linguistic Resources

"Libpng"

libpng License

"libpng-1.6.35"

PNG Reference Library License v1 (for libpng 0.5 through 1.6.35)

"libpng-2.0"

PNG Reference Library version 2

"libselinux-1.0"

libselinux public domain notice

"libtiff"

libtiff License

"libutil-David-Nugent"

libutil David Nugent License

"LiLiQ-P-1.1"

Licence Libre du Québec – Permissive version 1.1

"LiLiQ-R-1.1"

Licence Libre du Québec – Réciprocité version 1.1

"LiLiQ-Rplus-1.1"

Licence Libre du Québec – Réciprocité forte version 1.1

"Linux-man-pages-1-para"

Linux man-pages - 1 paragraph

"Linux-man-pages-copyleft"

Linux man-pages Copyleft

"Linux-man-pages-copyleft-2-para"

Linux man-pages Copyleft - 2 paragraphs

"Linux-man-pages-copyleft-var"

Linux man-pages Copyleft Variant

"Linux-OpenIB"

Linux Kernel Variant of OpenIB.org license

"LOOP"

Common Lisp LOOP License

"LPD-document"

LPD Documentation License

"LPL-1.0"

Lucent Public License Version 1.0

"LPL-1.02"

Lucent Public License v1.02

"LPPL-1.0"

LaTeX Project Public License v1.0

"LPPL-1.1"

LaTeX Project Public License v1.1

"LPPL-1.2"

LaTeX Project Public License v1.2

"LPPL-1.3a"

LaTeX Project Public License v1.3a

"LPPL-1.3c"

LaTeX Project Public License v1.3c

"lsof"

lsof License

"Lucida-Bitmap-Fonts"

Lucida Bitmap Fonts License

"LZMA-SDK-9.11-to-9.20"

LZMA SDK License (versions 9.11 to 9.20)

"LZMA-SDK-9.22"

LZMA SDK License (versions 9.22 and beyond)

"Mackerras-3-Clause"

Mackerras 3-Clause License

"Mackerras-3-Clause-acknowledgment"

Mackerras 3-Clause - acknowledgment variant

"magaz"

magaz License

"mailprio"

mailprio License

"MakeIndex"

MakeIndex License

"man2html"

man2html License

"Martin-Birgmeier"

Martin Birgmeier License

"McPhee-slideshow"

McPhee Slideshow License

"metamail"

metamail License

"Minpack"

Minpack License

"MIPS"

MIPS License

"MirOS"

The MirOS Licence

"MIT"

MIT License

"MIT-0"

MIT No Attribution

"MIT-advertising"

Enlightenment License (e16)

"MIT-Click"

MIT Click License

"MIT-CMU"

CMU License

"MIT-enna"

enna License

"MIT-feh"

feh License

"MIT-Festival"

MIT Festival Variant

"MIT-Khronos-old"

MIT Khronos - old variant

"MIT-Modern-Variant"

MIT License Modern Variant

"MIT-open-group"

MIT Open Group variant

"MIT-STK"

MIT-STK License

"MIT-testregex"

MIT testregex Variant

"MIT-Wu"

MIT Tom Wu Variant

"MITNFA"

MIT +no-false-attribs license

"MMIXware"

MMIXware License

"MMPL-1.0.1"

Minecraft Mod Public License v1.0.1

"Motosoto"

Motosoto License

"MPEG-SSG"

MPEG Software Simulation

"mpi-permissive"

mpi Permissive License

"mpich2"

mpich2 License

"MPL-1.0"

Mozilla Public License 1.0

"MPL-1.1"

Mozilla Public License 1.1

"MPL-2.0"

Mozilla Public License 2.0

"MPL-2.0-no-copyleft-exception"

Mozilla Public License 2.0 (no copyleft exception)

"mplus"

mplus Font License

"MS-LPL"

Microsoft Limited Public License

"MS-PL"

Microsoft Public License

"MS-RL"

Microsoft Reciprocal License

"MTLL"

Matrix Template Library License

"MulanPSL-1.0"

Mulan Permissive Software License, Version 1

"MulanPSL-2.0"

Mulan Permissive Software License, Version 2

"Multics"

Multics License

"Mup"

Mup License

"NAIST-2003"

Nara Institute of Science and Technology License (2003)

"NASA-1.3"

NASA Open Source Agreement 1.3

"Naumen"

Naumen Public License

"NBPL-1.0"

Net Boolean Public License v1

"NCBI-PD"

NCBI Public Domain Notice

"NCGL-UK-2.0"

Non-Commercial Government Licence

"NCL"

NCL Source Code License

"NCSA"

University of Illinois/NCSA Open Source License

"Net-SNMP"

Net-SNMP License

"NetCDF"

NetCDF license

"Newsletr"

Newsletr License

"NGPL"

Nethack General Public License

"ngrep"

ngrep License

"NICTA-1.0"

NICTA Public Software License, Version 1.0

"NIST-PD"

NIST Public Domain Notice

"NIST-PD-fallback"

NIST Public Domain Notice with license fallback

"NIST-PD-TNT"

NIST Public Domain Notice TNT variant

"NIST-Software"

NIST Software License

"NLOD-1.0"

Norwegian Licence for Open Government Data (NLOD) 1.0

"NLOD-2.0"

Norwegian Licence for Open Government Data (NLOD) 2.0

"NLPL"

No Limit Public License

"Nokia"

Nokia Open Source License

"NOSL"

Netizen Open Source License

"Noweb"

Noweb License

"NPL-1.0"

Netscape Public License v1.0

"NPL-1.1"

Netscape Public License v1.1

"NPOSL-3.0"

Non-Profit Open Software License 3.0

"NRL"

NRL License

"NTIA-PD"

NTIA Public Domain Notice

"NTP"

NTP License

"NTP-0"

NTP No Attribution

"Nunit"

Nunit License

"O-UDA-1.0"

Open Use of Data Agreement v1.0

"OAR"

OAR License

"OCCT-PL"

Open CASCADE Technology Public License

"OCLC-2.0"

OCLC Research Public License 2.0

"ODbL-1.0"

Open Data Commons Open Database License v1.0

"ODC-By-1.0"

Open Data Commons Attribution License v1.0

"OFFIS"

OFFIS License

"OFL-1.0"

SIL Open Font License 1.0

"OFL-1.0-no-RFN"

SIL Open Font License 1.0 with no Reserved Font Name

"OFL-1.0-RFN"

SIL Open Font License 1.0 with Reserved Font Name

"OFL-1.1"

SIL Open Font License 1.1

"OFL-1.1-no-RFN"

SIL Open Font License 1.1 with no Reserved Font Name

"OFL-1.1-RFN"

SIL Open Font License 1.1 with Reserved Font Name

"OGC-1.0"

OGC Software License, Version 1.0

"OGDL-Taiwan-1.0"

Taiwan Open Government Data License, version 1.0

"OGL-Canada-2.0"

Open Government Licence - Canada

"OGL-UK-1.0"

Open Government Licence v1.0

"OGL-UK-2.0"

Open Government Licence v2.0

"OGL-UK-3.0"

Open Government Licence v3.0

"OGTSL"

Open Group Test Suite License

"OLDAP-1.1"

Open LDAP Public License v1.1

"OLDAP-1.2"

Open LDAP Public License v1.2

"OLDAP-1.3"

Open LDAP Public License v1.3

"OLDAP-1.4"

Open LDAP Public License v1.4

"OLDAP-2.0"

Open LDAP Public License v2.0 (or possibly 2.0A and 2.0B)

"OLDAP-2.0.1"

Open LDAP Public License v2.0.1

"OLDAP-2.1"

Open LDAP Public License v2.1

"OLDAP-2.2"

Open LDAP Public License v2.2

"OLDAP-2.2.1"

Open LDAP Public License v2.2.1

"OLDAP-2.2.2"

Open LDAP Public License 2.2.2

"OLDAP-2.3"

Open LDAP Public License v2.3

"OLDAP-2.4"

Open LDAP Public License v2.4

"OLDAP-2.5"

Open LDAP Public License v2.5

"OLDAP-2.6"

Open LDAP Public License v2.6

"OLDAP-2.7"

Open LDAP Public License v2.7

"OLDAP-2.8"

Open LDAP Public License v2.8

"OLFL-1.3"

Open Logistics Foundation License Version 1.3

"OML"

Open Market License

"OpenMDW-1.0"

OpenMDW License Agreement v1.0

"OpenPBS-2.3"

OpenPBS v2.3 Software License

"OpenSSL"

OpenSSL License

"OpenSSL-standalone"

OpenSSL License - standalone

"OpenVision"

OpenVision License

"OPL-1.0"

Open Public License v1.0

"OPL-UK-3.0"

United Kingdom Open Parliament Licence v3.0

"OPUBL-1.0"

Open Publication License v1.0

"OSC-1.0"

OSC License 1.0

"OSET-PL-2.1"

OSET Public License version 2.1

"OSL-1.0"

Open Software License 1.0

"OSL-1.1"

Open Software License 1.1

"OSL-2.0"

Open Software License 2.0

"OSL-2.1"

Open Software License 2.1

"OSL-3.0"

Open Software License 3.0

"OSSP"

OSSP License

"PADL"

PADL License

"ParaType-Free-Font-1.3"

ParaType Free Font Licensing Agreement v1.3

"Parity-6.0.0"

The Parity Public License 6.0.0

"Parity-7.0.0"

The Parity Public License 7.0.0

"PDDL-1.0"

Open Data Commons Public Domain Dedication & License 1.0

"PHP-3.0"

PHP License v3.0

"PHP-3.01"

PHP License v3.01

"Pixar"

Pixar License

"pkgconf"

pkgconf License

"Plexus"

Plexus Classworlds License

"pnmstitch"

pnmstitch License

"PolyForm-Noncommercial-1.0.0"

PolyForm Noncommercial License 1.0.0

"PolyForm-Small-Business-1.0.0"

PolyForm Small Business License 1.0.0

"PostgreSQL"

PostgreSQL License

"PPL"

Peer Production License

"PSF-2.0"

Python Software Foundation License 2.0

"psfrag"

psfrag License

"psutils"

psutils License

"Python-2.0"

Python License 2.0

"Python-2.0.1"

Python License 2.0.1

"python-ldap"

Python ldap License

"Qhull"

Qhull License

"QPL-1.0"

Q Public License 1.0

"QPL-1.0-INRIA-2004"

Q Public License 1.0 - INRIA 2004 variant

"radvd"

radvd License

"Rdisc"

Rdisc License

"RHeCos-1.1"

Red Hat eCos Public License v1.1

"RPL-1.1"

Reciprocal Public License 1.1

"RPL-1.5"

Reciprocal Public License 1.5

"RPSL-1.0"

RealNetworks Public Source License v1.0

"RSA-MD"

RSA Message-Digest License

"RSCPL"

Ricoh Source Code Public License

"Ruby"

Ruby License

"Ruby-pty"

Ruby pty extension license

"SAX-PD"

Sax Public Domain Notice

"SAX-PD-2.0"

Sax Public Domain Notice 2.0

"Saxpath"

Saxpath License

"SCEA"

SCEA Shared Source License

"SchemeReport"

Scheme Language Report License

"Sendmail"

Sendmail License

"Sendmail-8.23"

Sendmail License 8.23

"Sendmail-Open-Source-1.1"

Sendmail Open Source License v1.1

"SGI-B-1.0"

SGI Free Software License B v1.0

"SGI-B-1.1"

SGI Free Software License B v1.1

"SGI-B-2.0"

SGI Free Software License B v2.0

"SGI-OpenGL"

SGI OpenGL License

"SGMLUG-PM"

SGMLUG Parser Materials License

"SGP4"

SGP4 Permission Notice

"SHL-0.5"

Solderpad Hardware License v0.5

"SHL-0.51"

Solderpad Hardware License, Version 0.51

"SimPL-2.0"

Simple Public License 2.0

"SISSL"

Sun Industry Standards Source License v1.1

"SISSL-1.2"

Sun Industry Standards Source License v1.2

"SL"

SL License

"Sleepycat"

Sleepycat License

"SMAIL-GPL"

SMAIL General Public License

"SMLNJ"

Standard ML of New Jersey License

"SMPPL"

Secure Messaging Protocol Public License

"SNIA"

SNIA Public License 1.1

"snprintf"

snprintf License

"SOFA"

SOFA Software License

"softSurfer"

softSurfer License

"Soundex"

Soundex License

"Spencer-86"

Spencer License 86

"Spencer-94"

Spencer License 94

"Spencer-99"

Spencer License 99

"SPL-1.0"

Sun Public License v1.0

"ssh-keyscan"

ssh-keyscan License

"SSH-OpenSSH"

SSH OpenSSH license

"SSH-short"

SSH short notice

"SSLeay-standalone"

SSLeay License - standalone

"SSPL-1.0"

Server Side Public License, v 1

"StandardML-NJ"

Standard ML of New Jersey License

"SugarCRM-1.1.3"

SugarCRM Public License v1.1.3

"SUL-1.0"

Sustainable Use License v1.0

"Sun-PPP"

Sun PPP License

"Sun-PPP-2000"

Sun PPP License (2000)

"SunPro"

SunPro License

"SWL"

Scheme Widget Library (SWL) Software License Agreement

"swrule"

swrule License

"Symlinks"

Symlinks License

"TAPR-OHL-1.0"

TAPR Open Hardware License v1.0

"TCL"

TCL/TK License

"TCP-wrappers"

TCP Wrappers License

"TekHVC"

TekHVC License

"TermReadKey"

TermReadKey License

"TGPPL-1.0"

Transitive Grace Period Public Licence 1.0

"ThirdEye"

ThirdEye License

"threeparttable"

threeparttable License

"TMate"

TMate Open Source License

"TORQUE-1.1"

TORQUE v2.5+ Software License v1.1

"TOSL"

Trusster Open Source License

"TPDL"

Time::ParseDate License

"TPL-1.0"

THOR Public License 1.0

"TrustedQSL"

TrustedQSL License

"TTWL"

Text-Tabs+Wrap License

"TTYP0"

TTYP0 License

"TU-Berlin-1.0"

Technische Universitaet Berlin License 1.0

"TU-Berlin-2.0"

Technische Universitaet Berlin License 2.0

"Ubuntu-font-1.0"

Ubuntu Font Licence v1.0

"UCAR"

UCAR License

"UCL-1.0"

Upstream Compatibility License v1.0

"ulem"

ulem License

"UMich-Merit"

Michigan/Merit Networks License

"Unicode-3.0"

Unicode License v3

"Unicode-DFS-2015"

Unicode License Agreement - Data Files and Software (2015)

"Unicode-DFS-2016"

Unicode License Agreement - Data Files and Software (2016)

"Unicode-TOU"

Unicode Terms of Use

"UnixCrypt"

UnixCrypt License

"Unlicense"

The Unlicense

"Unlicense-libtelnet"

Unlicense - libtelnet variant

"Unlicense-libwhirlpool"

Unlicense - libwhirlpool variant

"UnRAR"

UnRAR License

"UPL-1.0"

Universal Permissive License v1.0

"URT-RLE"

Utah Raster Toolkit Run Length Encoded License

"Vim"

Vim License

"Vixie-Cron"

Vixie Cron License

"VOSTROM"

VOSTROM Public License for Open Source

"VSL-1.0"

Vovida Software License v1.0

"W3C"

W3C Software Notice and License (2002-12-31)

"W3C-19980720"

W3C Software Notice and License (1998-07-20)

"W3C-20150513"

W3C Software Notice and Document License (2015-05-13)

"w3m"

w3m License

"Watcom-1.0"

Sybase Open Watcom Public License 1.0

"Widget-Workshop"

Widget Workshop License

"WordNet"

WordNet License

"Wsuipa"

Wsuipa License

"WTFNMFPL"

Do What The F*ck You Want To But It's Not My Fault Public License

"WTFPL"

Do What The F*ck You Want To Public License

"wwl"

WWL License

"wxWindows"

wxWindows Library License

"X11"

X11 License

"X11-distribute-modifications-variant"

X11 License Distribution Modification Variant

"X11-no-permit-persons"

X11 no permit persons clause

"X11-swapped"

X11 swapped final paragraphs

"Xdebug-1.03"

Xdebug License v 1.03

"Xerox"

Xerox License

"Xfig"

Xfig License

"XFree86-1.1"

XFree86 License 1.1

"xinetd"

xinetd License

"xkeyboard-config-Zinoviev"

xkeyboard-config Zinoviev License

"xlock"

xlock License

"Xnet"

X.Net License

"xpp"

XPP License

"XSkat"

XSkat License

"xzoom"

xzoom License

"YPL-1.0"

Yahoo! Public License v1.0

"YPL-1.1"

Yahoo! Public License v1.1

"Zed"

Zed License

"Zeeff"

Zeeff License

"Zend-2.0"

Zend License v2.0

"Zimbra-1.3"

Zimbra Public License v1.3

"Zimbra-1.4"

Zimbra Public License v1.4

"Zlib"

zlib License

"zlib-acknowledgement"

zlib/libpng License with Acknowledgement

"ZPL-1.1"

Zope Public License 1.1

"ZPL-2.0"

Zope Public License 2.0

"ZPL-2.1"

Zope Public License 2.1

"389-exception"

389 Directory Server Exception

"Asterisk-exception"

Asterisk exception

"Asterisk-linking-protocols-exception"

Asterisk linking protocols exception

"Autoconf-exception-2.0"

Autoconf exception 2.0

"Autoconf-exception-3.0"

Autoconf exception 3.0

"Autoconf-exception-generic"

Autoconf generic exception

"Autoconf-exception-generic-3.0"

Autoconf generic exception for GPL-3.0

"Autoconf-exception-macro"

Autoconf macro exception

"Bison-exception-1.24"

Bison exception 1.24

"Bison-exception-2.2"

Bison exception 2.2

"Bootloader-exception"

Bootloader Distribution Exception

"CGAL-linking-exception"

CGAL Linking Exception

"Classpath-exception-2.0"

Classpath exception 2.0

"Classpath-exception-2.0-short"

Classpath exception 2.0 - short

"CLISP-exception-2.0"

CLISP exception 2.0

"cryptsetup-OpenSSL-exception"

cryptsetup OpenSSL exception

"Digia-Qt-LGPL-exception-1.1"

Digia Qt LGPL Exception version 1.1

"DigiRule-FOSS-exception"

DigiRule FOSS License Exception

"eCos-exception-2.0"

eCos exception 2.0

"erlang-otp-linking-exception"

Erlang/OTP Linking Exception

"Fawkes-Runtime-exception"

Fawkes Runtime Exception

"FLTK-exception"

FLTK exception

"fmt-exception"

fmt exception

"Font-exception-2.0"

Font exception 2.0

"freertos-exception-2.0"

FreeRTOS Exception 2.0

"GCC-exception-2.0"

GCC Runtime Library exception 2.0

"GCC-exception-2.0-note"

GCC Runtime Library exception 2.0 - note variant

"GCC-exception-3.1"

GCC Runtime Library exception 3.1

"Gmsh-exception"

Gmsh exception

"GNAT-exception"

GNAT exception

"GNOME-examples-exception"

GNOME examples exception

"GNU-compiler-exception"

GNU Compiler Exception

"gnu-javamail-exception"

GNU JavaMail exception

"GPL-3.0-389-ds-base-exception"

GPL-3.0 389 DS Base Exception

"GPL-3.0-interface-exception"

GPL-3.0 Interface Exception

"GPL-3.0-linking-exception"

GPL-3.0 Linking Exception

"GPL-3.0-linking-source-exception"

GPL-3.0 Linking Exception (with Corresponding Source)

"GPL-CC-1.0"

GPL Cooperation Commitment 1.0

"GStreamer-exception-2005"

GStreamer Exception (2005)

"GStreamer-exception-2008"

GStreamer Exception (2008)

"harbour-exception"

harbour exception

"i2p-gpl-java-exception"

i2p GPL+Java Exception

"Independent-modules-exception"

Independent Module Linking exception

"KiCad-libraries-exception"

KiCad Libraries Exception

"kvirc-openssl-exception"

kvirc OpenSSL Exception

"LGPL-3.0-linking-exception"

LGPL-3.0 Linking Exception

"libpri-OpenH323-exception"

libpri OpenH323 exception

"Libtool-exception"

Libtool Exception

"Linux-syscall-note"

Linux Syscall Note

"LLGPL"

LLGPL Preamble

"LLVM-exception"

LLVM Exception

"LZMA-exception"

LZMA exception

"mif-exception"

Macros and Inline Functions Exception

"mxml-exception"

mxml Exception

"Nokia-Qt-exception-1.1"

Nokia Qt LGPL exception 1.1

"OCaml-LGPL-linking-exception"

OCaml LGPL Linking Exception

"OCCT-exception-1.0"

Open CASCADE Exception 1.0

"OpenJDK-assembly-exception-1.0"

OpenJDK Assembly exception 1.0

"openvpn-openssl-exception"

OpenVPN OpenSSL Exception

"PCRE2-exception"

PCRE2 exception

"polyparse-exception"

Polyparse Exception

"PS-or-PDF-font-exception-20170817"

PS/PDF font exception (2017-08-17)

"QPL-1.0-INRIA-2004-exception"

INRIA QPL 1.0 2004 variant exception

"Qt-GPL-exception-1.0"

Qt GPL exception 1.0

"Qt-LGPL-exception-1.1"

Qt LGPL exception 1.1

"Qwt-exception-1.0"

Qwt exception 1.0

"romic-exception"

Romic Exception

"RRDtool-FLOSS-exception-2.0"

RRDtool FLOSS exception 2.0

"rsync-linking-exception"

rsync Linking Exception

"SANE-exception"

SANE Exception

"SHL-2.0"

Solderpad Hardware License v2.0

"SHL-2.1"

Solderpad Hardware License v2.1

"Simple-Library-Usage-exception"

Simple Library Usage Exception

"sqlitestudio-OpenSSL-exception"

sqlitestudio OpenSSL exception

"stunnel-exception"

stunnel Exception

"SWI-exception"

SWI exception

"Swift-exception"

Swift Exception

"Texinfo-exception"

Texinfo exception

"u-boot-exception-2.0"

U-Boot exception 2.0

"UBDL-exception"

Unmodified Binary Distribution exception

"Universal-FOSS-exception-1.0"

Universal FOSS Exception, Version 1.0

"vsftpd-openssl-exception"

vsftpd OpenSSL exception

"WxWindows-exception-3.1"

WxWindows Library Exception 3.1

"x11vnc-openssl-exception"

x11vnc OpenSSL Exception


Example:

"Apache-2.0"

Type: string

If SPDX does not define the license used, this field may be used to provide the license name


Example:

"Acme Software License"

Type: object

An optional way to include the textual content of a license.

No Additional Properties

Type: string Default: "text/plain"

Specifies the content type of the text. Defaults to text/plain if not specified.

Type: enum (of string)

Specifies the optional encoding the text is represented in.

Must be one of:

  • "base64"

Type: string

The attachment data. Proactive controls such as input validation and sanitization should be employed to prevent misuse of attachment text.

Type: stringFormat: iri-reference

The URL to the license file. If specified, a 'license' externalReference should also be specified for completeness


Example:

"https://www.apache.org/licenses/LICENSE-2.0.txt"

Type: string

Examples:

"Apache-2.0 AND (MIT OR GPL-2.0-only)"

"GPL-3.0-only WITH Classpath-exception-2.0"

Type: object

Specifies optional release notes.

No Additional Properties

Type: string

The software versioning type the release note describes.


Examples:

"major"

"minor"

"patch"

"pre-release"

"internal"

Type: string

The title of the release.

Type: stringFormat: iri-reference

The URL to an image that may be prominently displayed with the release note.

Type: stringFormat: iri-reference

The URL to an image that may be used in messaging on social media platforms.

Type: string

A short description of the release.

Type: stringFormat: date-time

The date and time (timestamp) when the release note was created.

Type: array of string

One or more alternate names the release may be referred to. This may include unofficial terms used by development and marketing teams (e.g. code names).

No Additional Items

Each item of this array must be:

Type: string

Type: array of string

One or more tags that may aid in search or retrieval of the release note.

No Additional Items

Each item of this array must be:

Type: string

Type: array

A collection of issues that have been resolved.

No Additional Items

Each item of this array must be:

Type: object

An individual issue that has been resolved.

No Additional Properties

Type: enum (of string)

Specifies the type of issue

Must be one of:

  • "defect"
  • "enhancement"
  • "security"

Type: string

The identifier of the issue assigned by the source of the issue

Type: string

The name of the issue

Type: string

A description of the issue

Type: object

The source of the issue where it is documented

No Additional Properties

Type: string

The name of the source. For example 'National Vulnerability Database', 'NVD', and 'Apache'

Type: stringFormat: iri-reference

The url of the issue documentation as provided by the source

Type: array of string

A collection of URL's for reference. Multiple URLs are allowed.

No Additional Items

Each item of this array must be:

Type: stringFormat: iri-reference

Example:

"https://example.com"

Type: array

Zero or more release notes containing the locale and content. Multiple note objects may be specified to support release notes in a wide variety of languages.

No Additional Items

Each item of this array must be:

Type: object

A note containing the locale and content.

No Additional Properties

Type: string

The ISO-639 (or higher) language code and optional ISO-3166 (or higher) country code. Examples include: "en", "en-US", "fr" and "fr-CA"

Must match regular expression: ^([a-z]{2})(-[A-Z]{2})?$

Type: object

Specifies the full content of the release note.

No Additional Properties

Type: string Default: "text/plain"

Specifies the content type of the text. Defaults to text/plain if not specified.

Type: enum (of string)

Specifies the optional encoding the text is represented in.

Must be one of:

  • "base64"

Type: string

The attachment data. Proactive controls such as input validation and sanitization should be employed to prevent misuse of attachment text.

Type: array

Provides the ability to document properties in a name-value store. This provides flexibility to include data not officially supported in the standard without having to use additional namespaces or create extensions. Unlike key-value stores, properties support duplicate names, each potentially having different values. Property names of interest to the general public are encouraged to be registered in the CycloneDX Property Taxonomy. Formal registration is OPTIONAL.

No Additional Items

Each item of this array must be:

Type: object

Type: string

The name of the property. Duplicate names are allowed, each potentially having a different value.

Type: string

The value of the property.

Type: array

Provides the ability to document properties in a name-value store. This provides flexibility to include data not officially supported in the standard without having to use additional namespaces or create extensions. Unlike key-value stores, properties support duplicate names, each potentially having different values. Property names of interest to the general public are encouraged to be registered in the CycloneDX Property Taxonomy. Formal registration is OPTIONAL.

No Additional Items

Each item of this array must be:

Type: object

Type: string

The name of the property. Duplicate names are allowed, each potentially having a different value.

Type: string

The value of the property.

Type: object

Enveloped signature in JSON Signature Format (JSF).

Type: object
No Additional Properties

Type: array

Unique top level property for Multiple Signatures. (multisignature)

No Additional Items

Each item of this array must be:

Type: object
No Additional Properties


Type: enum (of string)

Signature algorithm. The currently recognized JWA [RFC7518] and RFC8037 [RFC8037] asymmetric key algorithms. Note: Unlike RFC8037 [RFC8037] JSF requires explicit Ed* algorithm names instead of "EdDSA".

Must be one of:

  • "RS256"
  • "RS384"
  • "RS512"
  • "PS256"
  • "PS384"
  • "PS512"
  • "ES256"
  • "ES384"
  • "ES512"
  • "Ed25519"
  • "Ed448"
  • "HS256"
  • "HS384"
  • "HS512"
Type: stringFormat: uri

Signature algorithm. Note: If proprietary signature algorithms are added, they must be expressed as URIs.

Type: string

Optional. Application specific string identifying the signature key.

Type: object

Optional. Public key object.

Type: object

If the conditions in the "If" tab are respected, then the conditions in the "Then" tab should be respected. Otherwise, the conditions in the "Else" tab should be respected.

Type: object

Type: const
Type: object
No Additional Properties

Type: enum (of string)

Key type indicator.

Must be one of:

  • "EC"
  • "OKP"
  • "RSA"

Type: enum (of string)

EC curve name.

Must be one of:

  • "P-256"
  • "P-384"
  • "P-521"

Type: string

EC curve point X. The length of this field must be the full size of a coordinate for the curve specified in the "crv" parameter. For example, if the value of "crv" is "P-521", the decoded argument must be 66 bytes.

Type: string

EC curve point Y. The length of this field must be the full size of a coordinate for the curve specified in the "crv" parameter. For example, if the value of "crv" is "P-256", the decoded argument must be 32 bytes.

Type: object

If the conditions in the "If" tab are respected, then the conditions in the "Then" tab should be respected. Otherwise, the conditions in the "Else" tab should be respected.

Type: object

Type: const
Type: object
No Additional Properties

Type: enum (of string)

Key type indicator.

Must be one of:

  • "EC"
  • "OKP"
  • "RSA"

Type: enum (of string)

EdDSA curve name.

Must be one of:

  • "Ed25519"
  • "Ed448"

Type: string

EdDSA curve point X. The length of this field must be the full size of a coordinate for the curve specified in the "crv" parameter. For example, if the value of "crv" is "Ed25519", the decoded argument must be 32 bytes.

Type: object

If the conditions in the "If" tab are respected, then the conditions in the "Then" tab should be respected. Otherwise, the conditions in the "Else" tab should be respected.

Type: object

Type: const
Type: object
No Additional Properties

Type: enum (of string)

Key type indicator.

Must be one of:

  • "EC"
  • "OKP"
  • "RSA"

Type: string

RSA modulus.

Type: string

RSA exponent.

Type: enum (of string)

Key type indicator.

Must be one of:

  • "EC"
  • "OKP"
  • "RSA"

Additional Properties of any type are allowed.

Type: object

Type: array of string

Optional. Sorted array of X.509 [RFC5280] certificates, where the first element must contain the signature certificate. The certificate path must be contiguous but is not required to be complete.

No Additional Items

Each item of this array must be:

Type: string

Type: array of string

Optional. Array holding the names of one or more application level properties that must be excluded from the signature process. Note that the "excludes" property itself, must also be excluded from the signature process. Since both the "excludes" property and the associated data it points to are unsigned, a conforming JSF implementation must provide options for specifying which properties to accept.

No Additional Items

Each item of this array must be:

Type: string

Type: string

The signature data. Note that the binary representation must follow the JWA [RFC7518] specifications.

Type: object
No Additional Properties

Type: array

Unique top level property for Signature Chains. (signaturechain)

No Additional Items

Each item of this array must be:

Type: object
No Additional Properties


Type: enum (of string)

Signature algorithm. The currently recognized JWA [RFC7518] and RFC8037 [RFC8037] asymmetric key algorithms. Note: Unlike RFC8037 [RFC8037] JSF requires explicit Ed* algorithm names instead of "EdDSA".

Must be one of:

  • "RS256"
  • "RS384"
  • "RS512"
  • "PS256"
  • "PS384"
  • "PS512"
  • "ES256"
  • "ES384"
  • "ES512"
  • "Ed25519"
  • "Ed448"
  • "HS256"
  • "HS384"
  • "HS512"
Type: stringFormat: uri

Signature algorithm. Note: If proprietary signature algorithms are added, they must be expressed as URIs.

Type: string

Optional. Application specific string identifying the signature key.

Type: object

Optional. Public key object.

Type: object

If the conditions in the "If" tab are respected, then the conditions in the "Then" tab should be respected. Otherwise, the conditions in the "Else" tab should be respected.

Type: object

Type: const
Type: object
No Additional Properties

Type: enum (of string)

Key type indicator.

Must be one of:

  • "EC"
  • "OKP"
  • "RSA"

Type: enum (of string)

EC curve name.

Must be one of:

  • "P-256"
  • "P-384"
  • "P-521"

Type: string

EC curve point X. The length of this field must be the full size of a coordinate for the curve specified in the "crv" parameter. For example, if the value of "crv" is "P-521", the decoded argument must be 66 bytes.

Type: string

EC curve point Y. The length of this field must be the full size of a coordinate for the curve specified in the "crv" parameter. For example, if the value of "crv" is "P-256", the decoded argument must be 32 bytes.

Type: object

If the conditions in the "If" tab are respected, then the conditions in the "Then" tab should be respected. Otherwise, the conditions in the "Else" tab should be respected.

Type: object

Type: const
Type: object
No Additional Properties

Type: enum (of string)

Key type indicator.

Must be one of:

  • "EC"
  • "OKP"
  • "RSA"

Type: enum (of string)

EdDSA curve name.

Must be one of:

  • "Ed25519"
  • "Ed448"

Type: string

EdDSA curve point X. The length of this field must be the full size of a coordinate for the curve specified in the "crv" parameter. For example, if the value of "crv" is "Ed25519", the decoded argument must be 32 bytes.

Type: object

If the conditions in the "If" tab are respected, then the conditions in the "Then" tab should be respected. Otherwise, the conditions in the "Else" tab should be respected.

Type: object

Type: const
Type: object
No Additional Properties

Type: enum (of string)

Key type indicator.

Must be one of:

  • "EC"
  • "OKP"
  • "RSA"

Type: string

RSA modulus.

Type: string

RSA exponent.

Type: enum (of string)

Key type indicator.

Must be one of:

  • "EC"
  • "OKP"
  • "RSA"

Additional Properties of any type are allowed.

Type: object

Type: array of string

Optional. Sorted array of X.509 [RFC5280] certificates, where the first element must contain the signature certificate. The certificate path must be contiguous but is not required to be complete.

No Additional Items

Each item of this array must be:

Type: string

Type: array of string

Optional. Array holding the names of one or more application level properties that must be excluded from the signature process. Note that the "excludes" property itself, must also be excluded from the signature process. Since both the "excludes" property and the associated data it points to are unsigned, a conforming JSF implementation must provide options for specifying which properties to accept.

No Additional Items

Each item of this array must be:

Type: string

Type: string

The signature data. Note that the binary representation must follow the JWA [RFC7518] specifications.

Type: object

Unique top level property for simple signatures. (signaturecore)

No Additional Properties


Type: enum (of string)

Signature algorithm. The currently recognized JWA [RFC7518] and RFC8037 [RFC8037] asymmetric key algorithms. Note: Unlike RFC8037 [RFC8037] JSF requires explicit Ed* algorithm names instead of "EdDSA".

Must be one of:

  • "RS256"
  • "RS384"
  • "RS512"
  • "PS256"
  • "PS384"
  • "PS512"
  • "ES256"
  • "ES384"
  • "ES512"
  • "Ed25519"
  • "Ed448"
  • "HS256"
  • "HS384"
  • "HS512"
Type: stringFormat: uri

Signature algorithm. Note: If proprietary signature algorithms are added, they must be expressed as URIs.

Type: string

Optional. Application specific string identifying the signature key.

Type: object

Optional. Public key object.

Type: object

If the conditions in the "If" tab are respected, then the conditions in the "Then" tab should be respected. Otherwise, the conditions in the "Else" tab should be respected.

Type: object

Type: const
Type: object
No Additional Properties

Type: enum (of string)

Key type indicator.

Must be one of:

  • "EC"
  • "OKP"
  • "RSA"

Type: enum (of string)

EC curve name.

Must be one of:

  • "P-256"
  • "P-384"
  • "P-521"

Type: string

EC curve point X. The length of this field must be the full size of a coordinate for the curve specified in the "crv" parameter. For example, if the value of "crv" is "P-521", the decoded argument must be 66 bytes.

Type: string

EC curve point Y. The length of this field must be the full size of a coordinate for the curve specified in the "crv" parameter. For example, if the value of "crv" is "P-256", the decoded argument must be 32 bytes.

Type: object

If the conditions in the "If" tab are respected, then the conditions in the "Then" tab should be respected. Otherwise, the conditions in the "Else" tab should be respected.

Type: object

Type: const
Type: object
No Additional Properties

Type: enum (of string)

Key type indicator.

Must be one of:

  • "EC"
  • "OKP"
  • "RSA"

Type: enum (of string)

EdDSA curve name.

Must be one of:

  • "Ed25519"
  • "Ed448"

Type: string

EdDSA curve point X. The length of this field must be the full size of a coordinate for the curve specified in the "crv" parameter. For example, if the value of "crv" is "Ed25519", the decoded argument must be 32 bytes.

Type: object

If the conditions in the "If" tab are respected, then the conditions in the "Then" tab should be respected. Otherwise, the conditions in the "Else" tab should be respected.

Type: object

Type: const
Type: object
No Additional Properties

Type: enum (of string)

Key type indicator.

Must be one of:

  • "EC"
  • "OKP"
  • "RSA"

Type: string

RSA modulus.

Type: string

RSA exponent.

Type: enum (of string)

Key type indicator.

Must be one of:

  • "EC"
  • "OKP"
  • "RSA"

Additional Properties of any type are allowed.

Type: object

Type: array of string

Optional. Sorted array of X.509 [RFC5280] certificates, where the first element must contain the signature certificate. The certificate path must be contiguous but is not required to be complete.

No Additional Items

Each item of this array must be:

Type: string

Type: array of string

Optional. Array holding the names of one or more application level properties that must be excluded from the signature process. Note that the "excludes" property itself, must also be excluded from the signature process. Since both the "excludes" property and the associated data it points to are unsigned, a conforming JSF implementation must provide options for specifying which properties to accept.

No Additional Items

Each item of this array must be:

Type: string

Type: string

The signature data. Note that the binary representation must follow the JWA [RFC7518] specifications.

Type: object

The organization that manufactured the component that the BOM describes.

No Additional Properties

Type: string

The name of the organization


Example:

"Example Inc."

Type: array of string

The URL of the organization. Multiple URLs are allowed.

No Additional Items

Each item of this array must be:

Type: stringFormat: iri-reference

Example:

"https://example.com"

Type: array

A contact at the organization. Multiple contacts are allowed.

No Additional Items

Each item of this array must be:

Type: object
No Additional Properties

Type: string

The name of a contact


Example:

"Contact name"

Type: stringFormat: idn-email

The email address of the contact.


Example:

Type: string

The phone number of the contact.


Example:

"800-555-1212"

Type: object

The organization that supplied the component that the BOM describes. The supplier may often be the manufacturer, but may also be a distributor or repackager.

No Additional Properties

Type: string

The name of the organization


Example:

"Example Inc."

Type: array of string

The URL of the organization. Multiple URLs are allowed.

No Additional Items

Each item of this array must be:

Type: stringFormat: iri-reference

Example:

"https://example.com"

Type: array

A contact at the organization. Multiple contacts are allowed.

No Additional Items

Each item of this array must be:

Type: object
No Additional Properties

Type: string

The name of a contact


Example:

"Contact name"

Type: stringFormat: idn-email

The email address of the contact.


Example:

Type: string

The phone number of the contact.


Example:

"800-555-1212"

Type: array
No Additional Items

Each item of this array must be:

Type: object
No Additional Properties

Type: object

The following properties are required:

  • license
Type: object

The following properties are required:

  • expression

Type: object
No Additional Properties

Type: object

The following properties are required:

  • id
Type: object

The following properties are required:

  • name

Type: enum (of string)

A valid SPDX license ID

Must be one of:

NameDescription
"0BSD"

BSD Zero Clause License

"3D-Slicer-1.0"

3D Slicer License v1.0

"AAL"

Attribution Assurance License

"Abstyles"

Abstyles License

"AdaCore-doc"

AdaCore Doc License

"Adobe-2006"

Adobe Systems Incorporated Source Code License Agreement

"Adobe-Display-PostScript"

Adobe Display PostScript License

"Adobe-Glyph"

Adobe Glyph List License

"Adobe-Utopia"

Adobe Utopia Font License

"ADSL"

Amazon Digital Services License

"Advanced-Cryptics-Dictionary"

Advanced Cryptics Dictionary License

"AFL-1.1"

Academic Free License v1.1

"AFL-1.2"

Academic Free License v1.2

"AFL-2.0"

Academic Free License v2.0

"AFL-2.1"

Academic Free License v2.1

"AFL-3.0"

Academic Free License v3.0

"Afmparse"

Afmparse License

"AGPL-1.0"

Affero General Public License v1.0

"AGPL-1.0-only"

Affero General Public License v1.0 only

"AGPL-1.0-or-later"

Affero General Public License v1.0 or later

"AGPL-3.0"

GNU Affero General Public License v3.0

"AGPL-3.0-only"

GNU Affero General Public License v3.0 only

"AGPL-3.0-or-later"

GNU Affero General Public License v3.0 or later

"Aladdin"

Aladdin Free Public License

"ALGLIB-Documentation"

ALGLIB Documentation License

"AMD-newlib"

AMD newlib License

"AMDPLPA"

AMD's plpa_map.c License

"AML"

Apple MIT License

"AML-glslang"

AML glslang variant License

"AMPAS"

Academy of Motion Picture Arts and Sciences BSD

"ANTLR-PD"

ANTLR Software Rights Notice

"ANTLR-PD-fallback"

ANTLR Software Rights Notice with license fallback

"any-OSI"

Any OSI License

"any-OSI-perl-modules"

Any OSI License - Perl Modules

"Apache-1.0"

Apache License 1.0

"Apache-1.1"

Apache License 1.1

"Apache-2.0"

Apache License 2.0

"APAFML"

Adobe Postscript AFM License

"APL-1.0"

Adaptive Public License 1.0

"App-s2p"

App::s2p License

"APSL-1.0"

Apple Public Source License 1.0

"APSL-1.1"

Apple Public Source License 1.1

"APSL-1.2"

Apple Public Source License 1.2

"APSL-2.0"

Apple Public Source License 2.0

"Arphic-1999"

Arphic Public License

"Artistic-1.0"

Artistic License 1.0

"Artistic-1.0-cl8"

Artistic License 1.0 w/clause 8

"Artistic-1.0-Perl"

Artistic License 1.0 (Perl)

"Artistic-2.0"

Artistic License 2.0

"Artistic-dist"

Artistic License 1.0 (dist)

"Aspell-RU"

Aspell Russian License

"ASWF-Digital-Assets-1.0"

ASWF Digital Assets License version 1.0

"ASWF-Digital-Assets-1.1"

ASWF Digital Assets License 1.1

"Baekmuk"

Baekmuk License

"Bahyph"

Bahyph License

"Barr"

Barr License

"bcrypt-Solar-Designer"

bcrypt Solar Designer License

"Beerware"

Beerware License

"Bitstream-Charter"

Bitstream Charter Font License

"Bitstream-Vera"

Bitstream Vera Font License

"BitTorrent-1.0"

BitTorrent Open Source License v1.0

"BitTorrent-1.1"

BitTorrent Open Source License v1.1

"blessing"

SQLite Blessing

"BlueOak-1.0.0"

Blue Oak Model License 1.0.0

"Boehm-GC"

Boehm-Demers-Weiser GC License

"Boehm-GC-without-fee"

Boehm-Demers-Weiser GC License (without fee)

"BOLA-1.1"

Buena Onda License Agreement v1.1

"Borceux"

Borceux license

"Brian-Gladman-2-Clause"

Brian Gladman 2-Clause License

"Brian-Gladman-3-Clause"

Brian Gladman 3-Clause License

"BSD-1-Clause"

BSD 1-Clause License

"BSD-2-Clause"

BSD 2-Clause "Simplified" License

"BSD-2-Clause-Darwin"

BSD 2-Clause - Ian Darwin variant

"BSD-2-Clause-first-lines"

BSD 2-Clause - first lines requirement

"BSD-2-Clause-FreeBSD"

BSD 2-Clause FreeBSD License

"BSD-2-Clause-NetBSD"

BSD 2-Clause NetBSD License

"BSD-2-Clause-Patent"

BSD-2-Clause Plus Patent License

"BSD-2-Clause-pkgconf-disclaimer"

BSD 2-Clause pkgconf disclaimer variant

"BSD-2-Clause-Views"

BSD 2-Clause with views sentence

"BSD-3-Clause"

BSD 3-Clause "New" or "Revised" License

"BSD-3-Clause-acpica"

BSD 3-Clause acpica variant

"BSD-3-Clause-Attribution"

BSD with attribution

"BSD-3-Clause-Clear"

BSD 3-Clause Clear License

"BSD-3-Clause-flex"

BSD 3-Clause Flex variant

"BSD-3-Clause-HP"

Hewlett-Packard BSD variant license

"BSD-3-Clause-LBNL"

Lawrence Berkeley National Labs BSD variant license

"BSD-3-Clause-Modification"

BSD 3-Clause Modification

"BSD-3-Clause-No-Military-License"

BSD 3-Clause No Military License

"BSD-3-Clause-No-Nuclear-License"

BSD 3-Clause No Nuclear License

"BSD-3-Clause-No-Nuclear-License-2014"

BSD 3-Clause No Nuclear License 2014

"BSD-3-Clause-No-Nuclear-Warranty"

BSD 3-Clause No Nuclear Warranty

"BSD-3-Clause-Open-MPI"

BSD 3-Clause Open MPI variant

"BSD-3-Clause-Sun"

BSD 3-Clause Sun Microsystems

"BSD-3-Clause-Tso"

BSD 3-Clause Tso variant

"BSD-4-Clause"

BSD 4-Clause "Original" or "Old" License

"BSD-4-Clause-Shortened"

BSD 4 Clause Shortened

"BSD-4-Clause-UC"

BSD-4-Clause (University of California-Specific)

"BSD-4.3RENO"

BSD 4.3 RENO License

"BSD-4.3TAHOE"

BSD 4.3 TAHOE License

"BSD-Advertising-Acknowledgement"

BSD Advertising Acknowledgement License

"BSD-Attribution-HPND-disclaimer"

BSD with Attribution and HPND disclaimer

"BSD-Inferno-Nettverk"

BSD-Inferno-Nettverk

"BSD-Mark-Modifications"

BSD Mark Modifications License

"BSD-Protection"

BSD Protection License

"BSD-Source-beginning-file"

BSD Source Code Attribution - beginning of file variant

"BSD-Source-Code"

BSD Source Code Attribution

"BSD-Systemics"

Systemics BSD variant license

"BSD-Systemics-W3Works"

Systemics W3Works BSD variant license

"BSL-1.0"

Boost Software License 1.0

"Buddy"

Buddy License

"BUSL-1.1"

Business Source License 1.1

"bzip2-1.0.5"

bzip2 and libbzip2 License v1.0.5

"bzip2-1.0.6"

bzip2 and libbzip2 License v1.0.6

"C-UDA-1.0"

Computational Use of Data Agreement v1.0

"CAL-1.0"

Cryptographic Autonomy License 1.0

"CAL-1.0-Combined-Work-Exception"

Cryptographic Autonomy License 1.0 (Combined Work Exception)

"Caldera"

Caldera License

"Caldera-no-preamble"

Caldera License (without preamble)

"CAPEC-tou"

Common Attack Pattern Enumeration and Classification License

"Catharon"

Catharon License

"CATOSL-1.1"

Computer Associates Trusted Open Source License 1.1

"CC-BY-1.0"

Creative Commons Attribution 1.0 Generic

"CC-BY-2.0"

Creative Commons Attribution 2.0 Generic

"CC-BY-2.5"

Creative Commons Attribution 2.5 Generic

"CC-BY-2.5-AU"

Creative Commons Attribution 2.5 Australia

"CC-BY-3.0"

Creative Commons Attribution 3.0 Unported

"CC-BY-3.0-AT"

Creative Commons Attribution 3.0 Austria

"CC-BY-3.0-AU"

Creative Commons Attribution 3.0 Australia

"CC-BY-3.0-DE"

Creative Commons Attribution 3.0 Germany

"CC-BY-3.0-IGO"

Creative Commons Attribution 3.0 IGO

"CC-BY-3.0-NL"

Creative Commons Attribution 3.0 Netherlands

"CC-BY-3.0-US"

Creative Commons Attribution 3.0 United States

"CC-BY-4.0"

Creative Commons Attribution 4.0 International

"CC-BY-NC-1.0"

Creative Commons Attribution Non Commercial 1.0 Generic

"CC-BY-NC-2.0"

Creative Commons Attribution Non Commercial 2.0 Generic

"CC-BY-NC-2.5"

Creative Commons Attribution Non Commercial 2.5 Generic

"CC-BY-NC-3.0"

Creative Commons Attribution Non Commercial 3.0 Unported

"CC-BY-NC-3.0-DE"

Creative Commons Attribution Non Commercial 3.0 Germany

"CC-BY-NC-4.0"

Creative Commons Attribution Non Commercial 4.0 International

"CC-BY-NC-ND-1.0"

Creative Commons Attribution Non Commercial No Derivatives 1.0 Generic

"CC-BY-NC-ND-2.0"

Creative Commons Attribution Non Commercial No Derivatives 2.0 Generic

"CC-BY-NC-ND-2.5"

Creative Commons Attribution Non Commercial No Derivatives 2.5 Generic

"CC-BY-NC-ND-3.0"

Creative Commons Attribution Non Commercial No Derivatives 3.0 Unported

"CC-BY-NC-ND-3.0-DE"

Creative Commons Attribution Non Commercial No Derivatives 3.0 Germany

"CC-BY-NC-ND-3.0-IGO"

Creative Commons Attribution Non Commercial No Derivatives 3.0 IGO

"CC-BY-NC-ND-4.0"

Creative Commons Attribution Non Commercial No Derivatives 4.0 International

"CC-BY-NC-SA-1.0"

Creative Commons Attribution Non Commercial Share Alike 1.0 Generic

"CC-BY-NC-SA-2.0"

Creative Commons Attribution Non Commercial Share Alike 2.0 Generic

"CC-BY-NC-SA-2.0-DE"

Creative Commons Attribution Non Commercial Share Alike 2.0 Germany

"CC-BY-NC-SA-2.0-FR"

Creative Commons Attribution-NonCommercial-ShareAlike 2.0 France

"CC-BY-NC-SA-2.0-UK"

Creative Commons Attribution Non Commercial Share Alike 2.0 England and Wales

"CC-BY-NC-SA-2.5"

Creative Commons Attribution Non Commercial Share Alike 2.5 Generic

"CC-BY-NC-SA-3.0"

Creative Commons Attribution Non Commercial Share Alike 3.0 Unported

"CC-BY-NC-SA-3.0-DE"

Creative Commons Attribution Non Commercial Share Alike 3.0 Germany

"CC-BY-NC-SA-3.0-IGO"

Creative Commons Attribution Non Commercial Share Alike 3.0 IGO

"CC-BY-NC-SA-4.0"

Creative Commons Attribution Non Commercial Share Alike 4.0 International

"CC-BY-ND-1.0"

Creative Commons Attribution No Derivatives 1.0 Generic

"CC-BY-ND-2.0"

Creative Commons Attribution No Derivatives 2.0 Generic

"CC-BY-ND-2.5"

Creative Commons Attribution No Derivatives 2.5 Generic

"CC-BY-ND-3.0"

Creative Commons Attribution No Derivatives 3.0 Unported

"CC-BY-ND-3.0-DE"

Creative Commons Attribution No Derivatives 3.0 Germany

"CC-BY-ND-4.0"

Creative Commons Attribution No Derivatives 4.0 International

"CC-BY-SA-1.0"

Creative Commons Attribution Share Alike 1.0 Generic

"CC-BY-SA-2.0"

Creative Commons Attribution Share Alike 2.0 Generic

"CC-BY-SA-2.0-UK"

Creative Commons Attribution Share Alike 2.0 England and Wales

"CC-BY-SA-2.1-JP"

Creative Commons Attribution Share Alike 2.1 Japan

"CC-BY-SA-2.5"

Creative Commons Attribution Share Alike 2.5 Generic

"CC-BY-SA-3.0"

Creative Commons Attribution Share Alike 3.0 Unported

"CC-BY-SA-3.0-AT"

Creative Commons Attribution Share Alike 3.0 Austria

"CC-BY-SA-3.0-DE"

Creative Commons Attribution Share Alike 3.0 Germany

"CC-BY-SA-3.0-IGO"

Creative Commons Attribution-ShareAlike 3.0 IGO

"CC-BY-SA-4.0"

Creative Commons Attribution Share Alike 4.0 International

"CC-PDDC"

Creative Commons Public Domain Dedication and Certification

"CC-PDM-1.0"

Creative Commons Public Domain Mark 1.0 Universal

"CC-SA-1.0"

Creative Commons Share Alike 1.0 Generic

"CC0-1.0"

Creative Commons Zero v1.0 Universal

"CDDL-1.0"

Common Development and Distribution License 1.0

"CDDL-1.1"

Common Development and Distribution License 1.1

"CDL-1.0"

Common Documentation License 1.0

"CDLA-Permissive-1.0"

Community Data License Agreement Permissive 1.0

"CDLA-Permissive-2.0"

Community Data License Agreement Permissive 2.0

"CDLA-Sharing-1.0"

Community Data License Agreement Sharing 1.0

"CECILL-1.0"

CeCILL Free Software License Agreement v1.0

"CECILL-1.1"

CeCILL Free Software License Agreement v1.1

"CECILL-2.0"

CeCILL Free Software License Agreement v2.0

"CECILL-2.1"

CeCILL Free Software License Agreement v2.1

"CECILL-B"

CeCILL-B Free Software License Agreement

"CECILL-C"

CeCILL-C Free Software License Agreement

"CERN-OHL-1.1"

CERN Open Hardware Licence v1.1

"CERN-OHL-1.2"

CERN Open Hardware Licence v1.2

"CERN-OHL-P-2.0"

CERN Open Hardware Licence Version 2 - Permissive

"CERN-OHL-S-2.0"

CERN Open Hardware Licence Version 2 - Strongly Reciprocal

"CERN-OHL-W-2.0"

CERN Open Hardware Licence Version 2 - Weakly Reciprocal

"CFITSIO"

CFITSIO License

"check-cvs"

check-cvs License

"checkmk"

Checkmk License

"ClArtistic"

Clarified Artistic License

"Clips"

Clips License

"CMU-Mach"

CMU Mach License

"CMU-Mach-nodoc"

CMU Mach - no notices-in-documentation variant

"CNRI-Jython"

CNRI Jython License

"CNRI-Python"

CNRI Python License

"CNRI-Python-GPL-Compatible"

CNRI Python Open Source GPL Compatible License Agreement

"COIL-1.0"

Copyfree Open Innovation License

"Community-Spec-1.0"

Community Specification License 1.0

"Condor-1.1"

Condor Public License v1.1

"copyleft-next-0.3.0"

copyleft-next 0.3.0

"copyleft-next-0.3.1"

copyleft-next 0.3.1

"Cornell-Lossless-JPEG"

Cornell Lossless JPEG License

"CPAL-1.0"

Common Public Attribution License 1.0

"CPL-1.0"

Common Public License 1.0

"CPOL-1.02"

Code Project Open License 1.02

"Cronyx"

Cronyx License

"Crossword"

Crossword License

"CryptoSwift"

CryptoSwift License

"CrystalStacker"

CrystalStacker License

"CUA-OPL-1.0"

CUA Office Public License v1.0

"Cube"

Cube License

"curl"

curl License

"cve-tou"

Common Vulnerability Enumeration ToU License

"D-FSL-1.0"

Deutsche Freie Software Lizenz

"DEC-3-Clause"

DEC 3-Clause License

"diffmark"

diffmark license

"DL-DE-BY-2.0"

Data licence Germany – attribution – version 2.0

"DL-DE-ZERO-2.0"

Data licence Germany – zero – version 2.0

"DOC"

DOC License

"DocBook-DTD"

DocBook DTD License

"DocBook-Schema"

DocBook Schema License

"DocBook-Stylesheet"

DocBook Stylesheet License

"DocBook-XML"

DocBook XML License

"Dotseqn"

Dotseqn License

"DRL-1.0"

Detection Rule License 1.0

"DRL-1.1"

Detection Rule License 1.1

"DSDP"

DSDP License

"dtoa"

David M. Gay dtoa License

"dvipdfm"

dvipdfm License

"ECL-1.0"

Educational Community License v1.0

"ECL-2.0"

Educational Community License v2.0

"eCos-2.0"

eCos license version 2.0

"EFL-1.0"

Eiffel Forum License v1.0

"EFL-2.0"

Eiffel Forum License v2.0

"eGenix"

eGenix.com Public License 1.1.0

"Elastic-2.0"

Elastic License 2.0

"Entessa"

Entessa Public License v1.0

"EPICS"

EPICS Open License

"EPL-1.0"

Eclipse Public License 1.0

"EPL-2.0"

Eclipse Public License 2.0

"ErlPL-1.1"

Erlang Public License v1.1

"ESA-PL-permissive-2.4"

European Space Agency Public License – v2.4 – Permissive (Type 3)

"ESA-PL-strong-copyleft-2.4"

European Space Agency Public License (ESA-PL) - V2.4 - Strong Copyleft (Type 1)

"ESA-PL-weak-copyleft-2.4"

European Space Agency Public License – v2.4 – Weak Copyleft (Type 2)

"etalab-2.0"

Etalab Open License 2.0

"EUDatagrid"

EU DataGrid Software License

"EUPL-1.0"

European Union Public License 1.0

"EUPL-1.1"

European Union Public License 1.1

"EUPL-1.2"

European Union Public License 1.2

"Eurosym"

Eurosym License

"Fair"

Fair License

"FBM"

Fuzzy Bitmap License

"FDK-AAC"

Fraunhofer FDK AAC Codec Library

"Ferguson-Twofish"

Ferguson Twofish License

"Frameworx-1.0"

Frameworx Open License 1.0

"FreeBSD-DOC"

FreeBSD Documentation License

"FreeImage"

FreeImage Public License v1.0

"FSFAP"

FSF All Permissive License

"FSFAP-no-warranty-disclaimer"

FSF All Permissive License (without Warranty)

"FSFUL"

FSF Unlimited License

"FSFULLR"

FSF Unlimited License (with License Retention)

"FSFULLRSD"

FSF Unlimited License (with License Retention and Short Disclaimer)

"FSFULLRWD"

FSF Unlimited License (With License Retention and Warranty Disclaimer)

"FSL-1.1-ALv2"

Functional Source License, Version 1.1, ALv2 Future License

"FSL-1.1-MIT"

Functional Source License, Version 1.1, MIT Future License

"FTL"

Freetype Project License

"Furuseth"

Furuseth License

"fwlw"

fwlw License

"Game-Programming-Gems"

Game Programming Gems License

"GCR-docs"

Gnome GCR Documentation License

"GD"

GD License

"generic-xts"

Generic XTS License

"GFDL-1.1"

GNU Free Documentation License v1.1

"GFDL-1.1-invariants-only"

GNU Free Documentation License v1.1 only - invariants

"GFDL-1.1-invariants-or-later"

GNU Free Documentation License v1.1 or later - invariants

"GFDL-1.1-no-invariants-only"

GNU Free Documentation License v1.1 only - no invariants

"GFDL-1.1-no-invariants-or-later"

GNU Free Documentation License v1.1 or later - no invariants

"GFDL-1.1-only"

GNU Free Documentation License v1.1 only

"GFDL-1.1-or-later"

GNU Free Documentation License v1.1 or later

"GFDL-1.2"

GNU Free Documentation License v1.2

"GFDL-1.2-invariants-only"

GNU Free Documentation License v1.2 only - invariants

"GFDL-1.2-invariants-or-later"

GNU Free Documentation License v1.2 or later - invariants

"GFDL-1.2-no-invariants-only"

GNU Free Documentation License v1.2 only - no invariants

"GFDL-1.2-no-invariants-or-later"

GNU Free Documentation License v1.2 or later - no invariants

"GFDL-1.2-only"

GNU Free Documentation License v1.2 only

"GFDL-1.2-or-later"

GNU Free Documentation License v1.2 or later

"GFDL-1.3"

GNU Free Documentation License v1.3

"GFDL-1.3-invariants-only"

GNU Free Documentation License v1.3 only - invariants

"GFDL-1.3-invariants-or-later"

GNU Free Documentation License v1.3 or later - invariants

"GFDL-1.3-no-invariants-only"

GNU Free Documentation License v1.3 only - no invariants

"GFDL-1.3-no-invariants-or-later"

GNU Free Documentation License v1.3 or later - no invariants

"GFDL-1.3-only"

GNU Free Documentation License v1.3 only

"GFDL-1.3-or-later"

GNU Free Documentation License v1.3 or later

"Giftware"

Giftware License

"GL2PS"

GL2PS License

"Glide"

3dfx Glide License

"Glulxe"

Glulxe License

"GLWTPL"

Good Luck With That Public License

"gnuplot"

gnuplot License

"GPL-1.0"

GNU General Public License v1.0 only

"GPL-1.0+"

GNU General Public License v1.0 or later

"GPL-1.0-only"

GNU General Public License v1.0 only

"GPL-1.0-or-later"

GNU General Public License v1.0 or later

"GPL-2.0"

GNU General Public License v2.0 only

"GPL-2.0+"

GNU General Public License v2.0 or later

"GPL-2.0-only"

GNU General Public License v2.0 only

"GPL-2.0-or-later"

GNU General Public License v2.0 or later

"GPL-2.0-with-autoconf-exception"

GNU General Public License v2.0 w/Autoconf exception

"GPL-2.0-with-bison-exception"

GNU General Public License v2.0 w/Bison exception

"GPL-2.0-with-classpath-exception"

GNU General Public License v2.0 w/Classpath exception

"GPL-2.0-with-font-exception"

GNU General Public License v2.0 w/Font exception

"GPL-2.0-with-GCC-exception"

GNU General Public License v2.0 w/GCC Runtime Library exception

"GPL-3.0"

GNU General Public License v3.0 only

"GPL-3.0+"

GNU General Public License v3.0 or later

"GPL-3.0-only"

GNU General Public License v3.0 only

"GPL-3.0-or-later"

GNU General Public License v3.0 or later

"GPL-3.0-with-autoconf-exception"

GNU General Public License v3.0 w/Autoconf exception

"GPL-3.0-with-GCC-exception"

GNU General Public License v3.0 w/GCC Runtime Library exception

"Graphics-Gems"

Graphics Gems License

"gSOAP-1.3b"

gSOAP Public License v1.3b

"gtkbook"

gtkbook License

"Gutmann"

Gutmann License

"HaskellReport"

Haskell Language Report License

"HDF5"

HDF5 License

"hdparm"

hdparm License

"HIDAPI"

HIDAPI License

"Hippocratic-2.1"

Hippocratic License 2.1

"HP-1986"

Hewlett-Packard 1986 License

"HP-1989"

Hewlett-Packard 1989 License

"HPND"

Historical Permission Notice and Disclaimer

"HPND-DEC"

Historical Permission Notice and Disclaimer - DEC variant

"HPND-doc"

Historical Permission Notice and Disclaimer - documentation variant

"HPND-doc-sell"

Historical Permission Notice and Disclaimer - documentation sell variant

"HPND-export-US"

HPND with US Government export control warning

"HPND-export-US-acknowledgement"

HPND with US Government export control warning and acknowledgment

"HPND-export-US-modify"

HPND with US Government export control warning and modification rqmt

"HPND-export2-US"

HPND with US Government export control and 2 disclaimers

"HPND-Fenneberg-Livingston"

Historical Permission Notice and Disclaimer - Fenneberg-Livingston variant

"HPND-INRIA-IMAG"

Historical Permission Notice and Disclaimer - INRIA-IMAG variant

"HPND-Intel"

Historical Permission Notice and Disclaimer - Intel variant

"HPND-Kevlin-Henney"

Historical Permission Notice and Disclaimer - Kevlin Henney variant

"HPND-Markus-Kuhn"

Historical Permission Notice and Disclaimer - Markus Kuhn variant

"HPND-merchantability-variant"

Historical Permission Notice and Disclaimer - merchantability variant

"HPND-MIT-disclaimer"

Historical Permission Notice and Disclaimer with MIT disclaimer

"HPND-Netrek"

Historical Permission Notice and Disclaimer - Netrek variant

"HPND-Pbmplus"

Historical Permission Notice and Disclaimer - Pbmplus variant

"HPND-sell-MIT-disclaimer-xserver"

Historical Permission Notice and Disclaimer - sell xserver variant with MIT disclaimer

"HPND-sell-regexpr"

Historical Permission Notice and Disclaimer - sell regexpr variant

"HPND-sell-variant"

Historical Permission Notice and Disclaimer - sell variant

"HPND-sell-variant-critical-systems"

HPND - sell variant with safety critical systems clause

"HPND-sell-variant-MIT-disclaimer"

HPND sell variant with MIT disclaimer

"HPND-sell-variant-MIT-disclaimer-rev"

HPND sell variant with MIT disclaimer - reverse

"HPND-SMC"

Historical Permission Notice and Disclaimer - SMC variant

"HPND-UC"

Historical Permission Notice and Disclaimer - University of California variant

"HPND-UC-export-US"

Historical Permission Notice and Disclaimer - University of California, US export warning

"HTMLTIDY"

HTML Tidy License

"hyphen-bulgarian"

hyphen-bulgarian License

"IBM-pibs"

IBM PowerPC Initialization and Boot Software

"ICU"

ICU License

"IEC-Code-Components-EULA"

IEC Code Components End-user licence agreement

"IJG"

Independent JPEG Group License

"IJG-short"

Independent JPEG Group License - short

"ImageMagick"

ImageMagick License

"iMatix"

iMatix Standard Function Library Agreement

"Imlib2"

Imlib2 License

"Info-ZIP"

Info-ZIP License

"Inner-Net-2.0"

Inner Net License v2.0

"InnoSetup"

Inno Setup License

"Intel"

Intel Open Source License

"Intel-ACPI"

Intel ACPI Software License Agreement

"Interbase-1.0"

Interbase Public License v1.0

"IPA"

IPA Font License

"IPL-1.0"

IBM Public License v1.0

"ISC"

ISC License

"ISC-Veillard"

ISC Veillard variant

"ISO-permission"

ISO permission notice

"Jam"

Jam License

"JasPer-2.0"

JasPer License

"jove"

Jove License

"JPL-image"

JPL Image Use Policy

"JPNIC"

Japan Network Information Center License

"JSON"

JSON License

"Kastrup"

Kastrup License

"Kazlib"

Kazlib License

"Knuth-CTAN"

Knuth CTAN License

"LAL-1.2"

Licence Art Libre 1.2

"LAL-1.3"

Licence Art Libre 1.3

"Latex2e"

Latex2e License

"Latex2e-translated-notice"

Latex2e with translated notice permission

"Leptonica"

Leptonica License

"LGPL-2.0"

GNU Library General Public License v2 only

"LGPL-2.0+"

GNU Library General Public License v2 or later

"LGPL-2.0-only"

GNU Library General Public License v2 only

"LGPL-2.0-or-later"

GNU Library General Public License v2 or later

"LGPL-2.1"

GNU Lesser General Public License v2.1 only

"LGPL-2.1+"

GNU Lesser General Public License v2.1 or later

"LGPL-2.1-only"

GNU Lesser General Public License v2.1 only

"LGPL-2.1-or-later"

GNU Lesser General Public License v2.1 or later

"LGPL-3.0"

GNU Lesser General Public License v3.0 only

"LGPL-3.0+"

GNU Lesser General Public License v3.0 or later

"LGPL-3.0-only"

GNU Lesser General Public License v3.0 only

"LGPL-3.0-or-later"

GNU Lesser General Public License v3.0 or later

"LGPLLR"

Lesser General Public License For Linguistic Resources

"Libpng"

libpng License

"libpng-1.6.35"

PNG Reference Library License v1 (for libpng 0.5 through 1.6.35)

"libpng-2.0"

PNG Reference Library version 2

"libselinux-1.0"

libselinux public domain notice

"libtiff"

libtiff License

"libutil-David-Nugent"

libutil David Nugent License

"LiLiQ-P-1.1"

Licence Libre du Québec – Permissive version 1.1

"LiLiQ-R-1.1"

Licence Libre du Québec – Réciprocité version 1.1

"LiLiQ-Rplus-1.1"

Licence Libre du Québec – Réciprocité forte version 1.1

"Linux-man-pages-1-para"

Linux man-pages - 1 paragraph

"Linux-man-pages-copyleft"

Linux man-pages Copyleft

"Linux-man-pages-copyleft-2-para"

Linux man-pages Copyleft - 2 paragraphs

"Linux-man-pages-copyleft-var"

Linux man-pages Copyleft Variant

"Linux-OpenIB"

Linux Kernel Variant of OpenIB.org license

"LOOP"

Common Lisp LOOP License

"LPD-document"

LPD Documentation License

"LPL-1.0"

Lucent Public License Version 1.0

"LPL-1.02"

Lucent Public License v1.02

"LPPL-1.0"

LaTeX Project Public License v1.0

"LPPL-1.1"

LaTeX Project Public License v1.1

"LPPL-1.2"

LaTeX Project Public License v1.2

"LPPL-1.3a"

LaTeX Project Public License v1.3a

"LPPL-1.3c"

LaTeX Project Public License v1.3c

"lsof"

lsof License

"Lucida-Bitmap-Fonts"

Lucida Bitmap Fonts License

"LZMA-SDK-9.11-to-9.20"

LZMA SDK License (versions 9.11 to 9.20)

"LZMA-SDK-9.22"

LZMA SDK License (versions 9.22 and beyond)

"Mackerras-3-Clause"

Mackerras 3-Clause License

"Mackerras-3-Clause-acknowledgment"

Mackerras 3-Clause - acknowledgment variant

"magaz"

magaz License

"mailprio"

mailprio License

"MakeIndex"

MakeIndex License

"man2html"

man2html License

"Martin-Birgmeier"

Martin Birgmeier License

"McPhee-slideshow"

McPhee Slideshow License

"metamail"

metamail License

"Minpack"

Minpack License

"MIPS"

MIPS License

"MirOS"

The MirOS Licence

"MIT"

MIT License

"MIT-0"

MIT No Attribution

"MIT-advertising"

Enlightenment License (e16)

"MIT-Click"

MIT Click License

"MIT-CMU"

CMU License

"MIT-enna"

enna License

"MIT-feh"

feh License

"MIT-Festival"

MIT Festival Variant

"MIT-Khronos-old"

MIT Khronos - old variant

"MIT-Modern-Variant"

MIT License Modern Variant

"MIT-open-group"

MIT Open Group variant

"MIT-STK"

MIT-STK License

"MIT-testregex"

MIT testregex Variant

"MIT-Wu"

MIT Tom Wu Variant

"MITNFA"

MIT +no-false-attribs license

"MMIXware"

MMIXware License

"MMPL-1.0.1"

Minecraft Mod Public License v1.0.1

"Motosoto"

Motosoto License

"MPEG-SSG"

MPEG Software Simulation

"mpi-permissive"

mpi Permissive License

"mpich2"

mpich2 License

"MPL-1.0"

Mozilla Public License 1.0

"MPL-1.1"

Mozilla Public License 1.1

"MPL-2.0"

Mozilla Public License 2.0

"MPL-2.0-no-copyleft-exception"

Mozilla Public License 2.0 (no copyleft exception)

"mplus"

mplus Font License

"MS-LPL"

Microsoft Limited Public License

"MS-PL"

Microsoft Public License

"MS-RL"

Microsoft Reciprocal License

"MTLL"

Matrix Template Library License

"MulanPSL-1.0"

Mulan Permissive Software License, Version 1

"MulanPSL-2.0"

Mulan Permissive Software License, Version 2

"Multics"

Multics License

"Mup"

Mup License

"NAIST-2003"

Nara Institute of Science and Technology License (2003)

"NASA-1.3"

NASA Open Source Agreement 1.3

"Naumen"

Naumen Public License

"NBPL-1.0"

Net Boolean Public License v1

"NCBI-PD"

NCBI Public Domain Notice

"NCGL-UK-2.0"

Non-Commercial Government Licence

"NCL"

NCL Source Code License

"NCSA"

University of Illinois/NCSA Open Source License

"Net-SNMP"

Net-SNMP License

"NetCDF"

NetCDF license

"Newsletr"

Newsletr License

"NGPL"

Nethack General Public License

"ngrep"

ngrep License

"NICTA-1.0"

NICTA Public Software License, Version 1.0

"NIST-PD"

NIST Public Domain Notice

"NIST-PD-fallback"

NIST Public Domain Notice with license fallback

"NIST-PD-TNT"

NIST Public Domain Notice TNT variant

"NIST-Software"

NIST Software License

"NLOD-1.0"

Norwegian Licence for Open Government Data (NLOD) 1.0

"NLOD-2.0"

Norwegian Licence for Open Government Data (NLOD) 2.0

"NLPL"

No Limit Public License

"Nokia"

Nokia Open Source License

"NOSL"

Netizen Open Source License

"Noweb"

Noweb License

"NPL-1.0"

Netscape Public License v1.0

"NPL-1.1"

Netscape Public License v1.1

"NPOSL-3.0"

Non-Profit Open Software License 3.0

"NRL"

NRL License

"NTIA-PD"

NTIA Public Domain Notice

"NTP"

NTP License

"NTP-0"

NTP No Attribution

"Nunit"

Nunit License

"O-UDA-1.0"

Open Use of Data Agreement v1.0

"OAR"

OAR License

"OCCT-PL"

Open CASCADE Technology Public License

"OCLC-2.0"

OCLC Research Public License 2.0

"ODbL-1.0"

Open Data Commons Open Database License v1.0

"ODC-By-1.0"

Open Data Commons Attribution License v1.0

"OFFIS"

OFFIS License

"OFL-1.0"

SIL Open Font License 1.0

"OFL-1.0-no-RFN"

SIL Open Font License 1.0 with no Reserved Font Name

"OFL-1.0-RFN"

SIL Open Font License 1.0 with Reserved Font Name

"OFL-1.1"

SIL Open Font License 1.1

"OFL-1.1-no-RFN"

SIL Open Font License 1.1 with no Reserved Font Name

"OFL-1.1-RFN"

SIL Open Font License 1.1 with Reserved Font Name

"OGC-1.0"

OGC Software License, Version 1.0

"OGDL-Taiwan-1.0"

Taiwan Open Government Data License, version 1.0

"OGL-Canada-2.0"

Open Government Licence - Canada

"OGL-UK-1.0"

Open Government Licence v1.0

"OGL-UK-2.0"

Open Government Licence v2.0

"OGL-UK-3.0"

Open Government Licence v3.0

"OGTSL"

Open Group Test Suite License

"OLDAP-1.1"

Open LDAP Public License v1.1

"OLDAP-1.2"

Open LDAP Public License v1.2

"OLDAP-1.3"

Open LDAP Public License v1.3

"OLDAP-1.4"

Open LDAP Public License v1.4

"OLDAP-2.0"

Open LDAP Public License v2.0 (or possibly 2.0A and 2.0B)

"OLDAP-2.0.1"

Open LDAP Public License v2.0.1

"OLDAP-2.1"

Open LDAP Public License v2.1

"OLDAP-2.2"

Open LDAP Public License v2.2

"OLDAP-2.2.1"

Open LDAP Public License v2.2.1

"OLDAP-2.2.2"

Open LDAP Public License 2.2.2

"OLDAP-2.3"

Open LDAP Public License v2.3

"OLDAP-2.4"

Open LDAP Public License v2.4

"OLDAP-2.5"

Open LDAP Public License v2.5

"OLDAP-2.6"

Open LDAP Public License v2.6

"OLDAP-2.7"

Open LDAP Public License v2.7

"OLDAP-2.8"

Open LDAP Public License v2.8

"OLFL-1.3"

Open Logistics Foundation License Version 1.3

"OML"

Open Market License

"OpenMDW-1.0"

OpenMDW License Agreement v1.0

"OpenPBS-2.3"

OpenPBS v2.3 Software License

"OpenSSL"

OpenSSL License

"OpenSSL-standalone"

OpenSSL License - standalone

"OpenVision"

OpenVision License

"OPL-1.0"

Open Public License v1.0

"OPL-UK-3.0"

United Kingdom Open Parliament Licence v3.0

"OPUBL-1.0"

Open Publication License v1.0

"OSC-1.0"

OSC License 1.0

"OSET-PL-2.1"

OSET Public License version 2.1

"OSL-1.0"

Open Software License 1.0

"OSL-1.1"

Open Software License 1.1

"OSL-2.0"

Open Software License 2.0

"OSL-2.1"

Open Software License 2.1

"OSL-3.0"

Open Software License 3.0

"OSSP"

OSSP License

"PADL"

PADL License

"ParaType-Free-Font-1.3"

ParaType Free Font Licensing Agreement v1.3

"Parity-6.0.0"

The Parity Public License 6.0.0

"Parity-7.0.0"

The Parity Public License 7.0.0

"PDDL-1.0"

Open Data Commons Public Domain Dedication & License 1.0

"PHP-3.0"

PHP License v3.0

"PHP-3.01"

PHP License v3.01

"Pixar"

Pixar License

"pkgconf"

pkgconf License

"Plexus"

Plexus Classworlds License

"pnmstitch"

pnmstitch License

"PolyForm-Noncommercial-1.0.0"

PolyForm Noncommercial License 1.0.0

"PolyForm-Small-Business-1.0.0"

PolyForm Small Business License 1.0.0

"PostgreSQL"

PostgreSQL License

"PPL"

Peer Production License

"PSF-2.0"

Python Software Foundation License 2.0

"psfrag"

psfrag License

"psutils"

psutils License

"Python-2.0"

Python License 2.0

"Python-2.0.1"

Python License 2.0.1

"python-ldap"

Python ldap License

"Qhull"

Qhull License

"QPL-1.0"

Q Public License 1.0

"QPL-1.0-INRIA-2004"

Q Public License 1.0 - INRIA 2004 variant

"radvd"

radvd License

"Rdisc"

Rdisc License

"RHeCos-1.1"

Red Hat eCos Public License v1.1

"RPL-1.1"

Reciprocal Public License 1.1

"RPL-1.5"

Reciprocal Public License 1.5

"RPSL-1.0"

RealNetworks Public Source License v1.0

"RSA-MD"

RSA Message-Digest License

"RSCPL"

Ricoh Source Code Public License

"Ruby"

Ruby License

"Ruby-pty"

Ruby pty extension license

"SAX-PD"

Sax Public Domain Notice

"SAX-PD-2.0"

Sax Public Domain Notice 2.0

"Saxpath"

Saxpath License

"SCEA"

SCEA Shared Source License

"SchemeReport"

Scheme Language Report License

"Sendmail"

Sendmail License

"Sendmail-8.23"

Sendmail License 8.23

"Sendmail-Open-Source-1.1"

Sendmail Open Source License v1.1

"SGI-B-1.0"

SGI Free Software License B v1.0

"SGI-B-1.1"

SGI Free Software License B v1.1

"SGI-B-2.0"

SGI Free Software License B v2.0

"SGI-OpenGL"

SGI OpenGL License

"SGMLUG-PM"

SGMLUG Parser Materials License

"SGP4"

SGP4 Permission Notice

"SHL-0.5"

Solderpad Hardware License v0.5

"SHL-0.51"

Solderpad Hardware License, Version 0.51

"SimPL-2.0"

Simple Public License 2.0

"SISSL"

Sun Industry Standards Source License v1.1

"SISSL-1.2"

Sun Industry Standards Source License v1.2

"SL"

SL License

"Sleepycat"

Sleepycat License

"SMAIL-GPL"

SMAIL General Public License

"SMLNJ"

Standard ML of New Jersey License

"SMPPL"

Secure Messaging Protocol Public License

"SNIA"

SNIA Public License 1.1

"snprintf"

snprintf License

"SOFA"

SOFA Software License

"softSurfer"

softSurfer License

"Soundex"

Soundex License

"Spencer-86"

Spencer License 86

"Spencer-94"

Spencer License 94

"Spencer-99"

Spencer License 99

"SPL-1.0"

Sun Public License v1.0

"ssh-keyscan"

ssh-keyscan License

"SSH-OpenSSH"

SSH OpenSSH license

"SSH-short"

SSH short notice

"SSLeay-standalone"

SSLeay License - standalone

"SSPL-1.0"

Server Side Public License, v 1

"StandardML-NJ"

Standard ML of New Jersey License

"SugarCRM-1.1.3"

SugarCRM Public License v1.1.3

"SUL-1.0"

Sustainable Use License v1.0

"Sun-PPP"

Sun PPP License

"Sun-PPP-2000"

Sun PPP License (2000)

"SunPro"

SunPro License

"SWL"

Scheme Widget Library (SWL) Software License Agreement

"swrule"

swrule License

"Symlinks"

Symlinks License

"TAPR-OHL-1.0"

TAPR Open Hardware License v1.0

"TCL"

TCL/TK License

"TCP-wrappers"

TCP Wrappers License

"TekHVC"

TekHVC License

"TermReadKey"

TermReadKey License

"TGPPL-1.0"

Transitive Grace Period Public Licence 1.0

"ThirdEye"

ThirdEye License

"threeparttable"

threeparttable License

"TMate"

TMate Open Source License

"TORQUE-1.1"

TORQUE v2.5+ Software License v1.1

"TOSL"

Trusster Open Source License

"TPDL"

Time::ParseDate License

"TPL-1.0"

THOR Public License 1.0

"TrustedQSL"

TrustedQSL License

"TTWL"

Text-Tabs+Wrap License

"TTYP0"

TTYP0 License

"TU-Berlin-1.0"

Technische Universitaet Berlin License 1.0

"TU-Berlin-2.0"

Technische Universitaet Berlin License 2.0

"Ubuntu-font-1.0"

Ubuntu Font Licence v1.0

"UCAR"

UCAR License

"UCL-1.0"

Upstream Compatibility License v1.0

"ulem"

ulem License

"UMich-Merit"

Michigan/Merit Networks License

"Unicode-3.0"

Unicode License v3

"Unicode-DFS-2015"

Unicode License Agreement - Data Files and Software (2015)

"Unicode-DFS-2016"

Unicode License Agreement - Data Files and Software (2016)

"Unicode-TOU"

Unicode Terms of Use

"UnixCrypt"

UnixCrypt License

"Unlicense"

The Unlicense

"Unlicense-libtelnet"

Unlicense - libtelnet variant

"Unlicense-libwhirlpool"

Unlicense - libwhirlpool variant

"UnRAR"

UnRAR License

"UPL-1.0"

Universal Permissive License v1.0

"URT-RLE"

Utah Raster Toolkit Run Length Encoded License

"Vim"

Vim License

"Vixie-Cron"

Vixie Cron License

"VOSTROM"

VOSTROM Public License for Open Source

"VSL-1.0"

Vovida Software License v1.0

"W3C"

W3C Software Notice and License (2002-12-31)

"W3C-19980720"

W3C Software Notice and License (1998-07-20)

"W3C-20150513"

W3C Software Notice and Document License (2015-05-13)

"w3m"

w3m License

"Watcom-1.0"

Sybase Open Watcom Public License 1.0

"Widget-Workshop"

Widget Workshop License

"WordNet"

WordNet License

"Wsuipa"

Wsuipa License

"WTFNMFPL"

Do What The F*ck You Want To But It's Not My Fault Public License

"WTFPL"

Do What The F*ck You Want To Public License

"wwl"

WWL License

"wxWindows"

wxWindows Library License

"X11"

X11 License

"X11-distribute-modifications-variant"

X11 License Distribution Modification Variant

"X11-no-permit-persons"

X11 no permit persons clause

"X11-swapped"

X11 swapped final paragraphs

"Xdebug-1.03"

Xdebug License v 1.03

"Xerox"

Xerox License

"Xfig"

Xfig License

"XFree86-1.1"

XFree86 License 1.1

"xinetd"

xinetd License

"xkeyboard-config-Zinoviev"

xkeyboard-config Zinoviev License

"xlock"

xlock License

"Xnet"

X.Net License

"xpp"

XPP License

"XSkat"

XSkat License

"xzoom"

xzoom License

"YPL-1.0"

Yahoo! Public License v1.0

"YPL-1.1"

Yahoo! Public License v1.1

"Zed"

Zed License

"Zeeff"

Zeeff License

"Zend-2.0"

Zend License v2.0

"Zimbra-1.3"

Zimbra Public License v1.3

"Zimbra-1.4"

Zimbra Public License v1.4

"Zlib"

zlib License

"zlib-acknowledgement"

zlib/libpng License with Acknowledgement

"ZPL-1.1"

Zope Public License 1.1

"ZPL-2.0"

Zope Public License 2.0

"ZPL-2.1"

Zope Public License 2.1

"389-exception"

389 Directory Server Exception

"Asterisk-exception"

Asterisk exception

"Asterisk-linking-protocols-exception"

Asterisk linking protocols exception

"Autoconf-exception-2.0"

Autoconf exception 2.0

"Autoconf-exception-3.0"

Autoconf exception 3.0

"Autoconf-exception-generic"

Autoconf generic exception

"Autoconf-exception-generic-3.0"

Autoconf generic exception for GPL-3.0

"Autoconf-exception-macro"

Autoconf macro exception

"Bison-exception-1.24"

Bison exception 1.24

"Bison-exception-2.2"

Bison exception 2.2

"Bootloader-exception"

Bootloader Distribution Exception

"CGAL-linking-exception"

CGAL Linking Exception

"Classpath-exception-2.0"

Classpath exception 2.0

"Classpath-exception-2.0-short"

Classpath exception 2.0 - short

"CLISP-exception-2.0"

CLISP exception 2.0

"cryptsetup-OpenSSL-exception"

cryptsetup OpenSSL exception

"Digia-Qt-LGPL-exception-1.1"

Digia Qt LGPL Exception version 1.1

"DigiRule-FOSS-exception"

DigiRule FOSS License Exception

"eCos-exception-2.0"

eCos exception 2.0

"erlang-otp-linking-exception"

Erlang/OTP Linking Exception

"Fawkes-Runtime-exception"

Fawkes Runtime Exception

"FLTK-exception"

FLTK exception

"fmt-exception"

fmt exception

"Font-exception-2.0"

Font exception 2.0

"freertos-exception-2.0"

FreeRTOS Exception 2.0

"GCC-exception-2.0"

GCC Runtime Library exception 2.0

"GCC-exception-2.0-note"

GCC Runtime Library exception 2.0 - note variant

"GCC-exception-3.1"

GCC Runtime Library exception 3.1

"Gmsh-exception"

Gmsh exception

"GNAT-exception"

GNAT exception

"GNOME-examples-exception"

GNOME examples exception

"GNU-compiler-exception"

GNU Compiler Exception

"gnu-javamail-exception"

GNU JavaMail exception

"GPL-3.0-389-ds-base-exception"

GPL-3.0 389 DS Base Exception

"GPL-3.0-interface-exception"

GPL-3.0 Interface Exception

"GPL-3.0-linking-exception"

GPL-3.0 Linking Exception

"GPL-3.0-linking-source-exception"

GPL-3.0 Linking Exception (with Corresponding Source)

"GPL-CC-1.0"

GPL Cooperation Commitment 1.0

"GStreamer-exception-2005"

GStreamer Exception (2005)

"GStreamer-exception-2008"

GStreamer Exception (2008)

"harbour-exception"

harbour exception

"i2p-gpl-java-exception"

i2p GPL+Java Exception

"Independent-modules-exception"

Independent Module Linking exception

"KiCad-libraries-exception"

KiCad Libraries Exception

"kvirc-openssl-exception"

kvirc OpenSSL Exception

"LGPL-3.0-linking-exception"

LGPL-3.0 Linking Exception

"libpri-OpenH323-exception"

libpri OpenH323 exception

"Libtool-exception"

Libtool Exception

"Linux-syscall-note"

Linux Syscall Note

"LLGPL"

LLGPL Preamble

"LLVM-exception"

LLVM Exception

"LZMA-exception"

LZMA exception

"mif-exception"

Macros and Inline Functions Exception

"mxml-exception"

mxml Exception

"Nokia-Qt-exception-1.1"

Nokia Qt LGPL exception 1.1

"OCaml-LGPL-linking-exception"

OCaml LGPL Linking Exception

"OCCT-exception-1.0"

Open CASCADE Exception 1.0

"OpenJDK-assembly-exception-1.0"

OpenJDK Assembly exception 1.0

"openvpn-openssl-exception"

OpenVPN OpenSSL Exception

"PCRE2-exception"

PCRE2 exception

"polyparse-exception"

Polyparse Exception

"PS-or-PDF-font-exception-20170817"

PS/PDF font exception (2017-08-17)

"QPL-1.0-INRIA-2004-exception"

INRIA QPL 1.0 2004 variant exception

"Qt-GPL-exception-1.0"

Qt GPL exception 1.0

"Qt-LGPL-exception-1.1"

Qt LGPL exception 1.1

"Qwt-exception-1.0"

Qwt exception 1.0

"romic-exception"

Romic Exception

"RRDtool-FLOSS-exception-2.0"

RRDtool FLOSS exception 2.0

"rsync-linking-exception"

rsync Linking Exception

"SANE-exception"

SANE Exception

"SHL-2.0"

Solderpad Hardware License v2.0

"SHL-2.1"

Solderpad Hardware License v2.1

"Simple-Library-Usage-exception"

Simple Library Usage Exception

"sqlitestudio-OpenSSL-exception"

sqlitestudio OpenSSL exception

"stunnel-exception"

stunnel Exception

"SWI-exception"

SWI exception

"Swift-exception"

Swift Exception

"Texinfo-exception"

Texinfo exception

"u-boot-exception-2.0"

U-Boot exception 2.0

"UBDL-exception"

Unmodified Binary Distribution exception

"Universal-FOSS-exception-1.0"

Universal FOSS Exception, Version 1.0

"vsftpd-openssl-exception"

vsftpd OpenSSL exception

"WxWindows-exception-3.1"

WxWindows Library Exception 3.1

"x11vnc-openssl-exception"

x11vnc OpenSSL Exception


Example:

"Apache-2.0"

Type: string

If SPDX does not define the license used, this field may be used to provide the license name


Example:

"Acme Software License"

Type: object

An optional way to include the textual content of a license.

No Additional Properties

Type: string Default: "text/plain"

Specifies the content type of the text. Defaults to text/plain if not specified.

Type: enum (of string)

Specifies the optional encoding the text is represented in.

Must be one of:

  • "base64"

Type: string

The attachment data. Proactive controls such as input validation and sanitization should be employed to prevent misuse of attachment text.

Type: stringFormat: iri-reference

The URL to the license file. If specified, a 'license' externalReference should also be specified for completeness


Example:

"https://www.apache.org/licenses/LICENSE-2.0.txt"

Type: string

Examples:

"Apache-2.0 AND (MIT OR GPL-2.0-only)"

"GPL-3.0-only WITH Classpath-exception-2.0"

Type: array

Provides the ability to document properties in a name-value store. This provides flexibility to include data not officially supported in the standard without having to use additional namespaces or create extensions. Unlike key-value stores, properties support duplicate names, each potentially having different values. Property names of interest to the general public are encouraged to be registered in the CycloneDX Property Taxonomy. Formal registration is OPTIONAL.

No Additional Items

Each item of this array must be:

Type: object

Type: string

The name of the property. Duplicate names are allowed, each potentially having a different value.

Type: string

The value of the property.

Type: array

A list of software and hardware components.

All items must be unique

No Additional Items

Each item of this array must be:

Type: object
No Additional Properties

Type: enum (of string)

Specifies the type of component. For software components, classify as application if no more specific appropriate classification is available or cannot be determined for the component. Types include:

Must be one of:

  • "application"
  • "framework"
  • "library"
  • "container"
  • "operating-system"
  • "device"
  • "firmware"
  • "file"

Example:

"library"

Type: string

The optional mime-type of the component. When used on file components, the mime-type can provide additional context about the kind of file being represented such as an image, font, or executable. Some library or framework components may also have an associated mime-type.

Must match regular expression: ^[-+a-z0-9.]+/[-+a-z0-9.]+$
Example:

"image/jpeg"

Type: string

An optional identifier which can be used to reference the component elsewhere in the BOM. Every bom-ref MUST be unique within the BOM.

Type: object

The organization that supplied the component. The supplier may often be the manufacturer, but may also be a distributor or repackager.

No Additional Properties

Type: string

The name of the organization


Example:

"Example Inc."

Type: array of string

The URL of the organization. Multiple URLs are allowed.

No Additional Items

Each item of this array must be:

Type: stringFormat: iri-reference

Example:

"https://example.com"

Type: array

A contact at the organization. Multiple contacts are allowed.

No Additional Items

Each item of this array must be:

Type: object
No Additional Properties

Type: string

The name of a contact


Example:

"Contact name"

Type: stringFormat: idn-email

The email address of the contact.


Example:

Type: string

The phone number of the contact.


Example:

"800-555-1212"

Type: string

The person(s) or organization(s) that authored the component


Example:

"Acme Inc"

Type: string

The person(s) or organization(s) that published the component


Example:

"Acme Inc"

Type: string

The grouping name or identifier. This will often be a shortened, single name of the company or project that produced the component, or the source package or domain name. Whitespace and special characters should be avoided. Examples include: apache, org.apache.commons, and apache.org.


Example:

"com.acme"

Type: string

The name of the component. This will often be a shortened, single name of the component. Examples: commons-lang3 and jquery


Example:

"tomcat-catalina"

Type: string

The component version. The version should ideally comply with semantic versioning but is not enforced.


Example:

"9.0.14"

Type: string

Specifies a description for the component

Type: enum (of string) Default: "required"

Specifies the scope of the component. If scope is not specified, 'required' scope SHOULD be assumed by the consumer of the BOM.

Must be one of:

  • "required"
  • "optional"
  • "excluded"

Type: array
No Additional Items

Each item of this array must be:

Type: object
No Additional Properties

Type: enum (of string)

Must be one of:

  • "MD5"
  • "SHA-1"
  • "SHA-256"
  • "SHA-384"
  • "SHA-512"
  • "SHA3-256"
  • "SHA3-384"
  • "SHA3-512"
  • "BLAKE2b-256"
  • "BLAKE2b-384"
  • "BLAKE2b-512"
  • "BLAKE3"

Type: string
Must match regular expression: ^([a-fA-F0-9]{32}|[a-fA-F0-9]{40}|[a-fA-F0-9]{64}|[a-fA-F0-9]{96}|[a-fA-F0-9]{128})$
Example:

"3942447fac867ae5cdb3229b658f4d48"

Type: array
No Additional Items

Each item of this array must be:

Type: object
No Additional Properties

Type: object

The following properties are required:

  • license
Type: object

The following properties are required:

  • expression

Type: object
No Additional Properties

Type: object

The following properties are required:

  • id
Type: object

The following properties are required:

  • name

Type: enum (of string)

A valid SPDX license ID

Must be one of:

NameDescription
"0BSD"

BSD Zero Clause License

"3D-Slicer-1.0"

3D Slicer License v1.0

"AAL"

Attribution Assurance License

"Abstyles"

Abstyles License

"AdaCore-doc"

AdaCore Doc License

"Adobe-2006"

Adobe Systems Incorporated Source Code License Agreement

"Adobe-Display-PostScript"

Adobe Display PostScript License

"Adobe-Glyph"

Adobe Glyph List License

"Adobe-Utopia"

Adobe Utopia Font License

"ADSL"

Amazon Digital Services License

"Advanced-Cryptics-Dictionary"

Advanced Cryptics Dictionary License

"AFL-1.1"

Academic Free License v1.1

"AFL-1.2"

Academic Free License v1.2

"AFL-2.0"

Academic Free License v2.0

"AFL-2.1"

Academic Free License v2.1

"AFL-3.0"

Academic Free License v3.0

"Afmparse"

Afmparse License

"AGPL-1.0"

Affero General Public License v1.0

"AGPL-1.0-only"

Affero General Public License v1.0 only

"AGPL-1.0-or-later"

Affero General Public License v1.0 or later

"AGPL-3.0"

GNU Affero General Public License v3.0

"AGPL-3.0-only"

GNU Affero General Public License v3.0 only

"AGPL-3.0-or-later"

GNU Affero General Public License v3.0 or later

"Aladdin"

Aladdin Free Public License

"ALGLIB-Documentation"

ALGLIB Documentation License

"AMD-newlib"

AMD newlib License

"AMDPLPA"

AMD's plpa_map.c License

"AML"

Apple MIT License

"AML-glslang"

AML glslang variant License

"AMPAS"

Academy of Motion Picture Arts and Sciences BSD

"ANTLR-PD"

ANTLR Software Rights Notice

"ANTLR-PD-fallback"

ANTLR Software Rights Notice with license fallback

"any-OSI"

Any OSI License

"any-OSI-perl-modules"

Any OSI License - Perl Modules

"Apache-1.0"

Apache License 1.0

"Apache-1.1"

Apache License 1.1

"Apache-2.0"

Apache License 2.0

"APAFML"

Adobe Postscript AFM License

"APL-1.0"

Adaptive Public License 1.0

"App-s2p"

App::s2p License

"APSL-1.0"

Apple Public Source License 1.0

"APSL-1.1"

Apple Public Source License 1.1

"APSL-1.2"

Apple Public Source License 1.2

"APSL-2.0"

Apple Public Source License 2.0

"Arphic-1999"

Arphic Public License

"Artistic-1.0"

Artistic License 1.0

"Artistic-1.0-cl8"

Artistic License 1.0 w/clause 8

"Artistic-1.0-Perl"

Artistic License 1.0 (Perl)

"Artistic-2.0"

Artistic License 2.0

"Artistic-dist"

Artistic License 1.0 (dist)

"Aspell-RU"

Aspell Russian License

"ASWF-Digital-Assets-1.0"

ASWF Digital Assets License version 1.0

"ASWF-Digital-Assets-1.1"

ASWF Digital Assets License 1.1

"Baekmuk"

Baekmuk License

"Bahyph"

Bahyph License

"Barr"

Barr License

"bcrypt-Solar-Designer"

bcrypt Solar Designer License

"Beerware"

Beerware License

"Bitstream-Charter"

Bitstream Charter Font License

"Bitstream-Vera"

Bitstream Vera Font License

"BitTorrent-1.0"

BitTorrent Open Source License v1.0

"BitTorrent-1.1"

BitTorrent Open Source License v1.1

"blessing"

SQLite Blessing

"BlueOak-1.0.0"

Blue Oak Model License 1.0.0

"Boehm-GC"

Boehm-Demers-Weiser GC License

"Boehm-GC-without-fee"

Boehm-Demers-Weiser GC License (without fee)

"BOLA-1.1"

Buena Onda License Agreement v1.1

"Borceux"

Borceux license

"Brian-Gladman-2-Clause"

Brian Gladman 2-Clause License

"Brian-Gladman-3-Clause"

Brian Gladman 3-Clause License

"BSD-1-Clause"

BSD 1-Clause License

"BSD-2-Clause"

BSD 2-Clause "Simplified" License

"BSD-2-Clause-Darwin"

BSD 2-Clause - Ian Darwin variant

"BSD-2-Clause-first-lines"

BSD 2-Clause - first lines requirement

"BSD-2-Clause-FreeBSD"

BSD 2-Clause FreeBSD License

"BSD-2-Clause-NetBSD"

BSD 2-Clause NetBSD License

"BSD-2-Clause-Patent"

BSD-2-Clause Plus Patent License

"BSD-2-Clause-pkgconf-disclaimer"

BSD 2-Clause pkgconf disclaimer variant

"BSD-2-Clause-Views"

BSD 2-Clause with views sentence

"BSD-3-Clause"

BSD 3-Clause "New" or "Revised" License

"BSD-3-Clause-acpica"

BSD 3-Clause acpica variant

"BSD-3-Clause-Attribution"

BSD with attribution

"BSD-3-Clause-Clear"

BSD 3-Clause Clear License

"BSD-3-Clause-flex"

BSD 3-Clause Flex variant

"BSD-3-Clause-HP"

Hewlett-Packard BSD variant license

"BSD-3-Clause-LBNL"

Lawrence Berkeley National Labs BSD variant license

"BSD-3-Clause-Modification"

BSD 3-Clause Modification

"BSD-3-Clause-No-Military-License"

BSD 3-Clause No Military License

"BSD-3-Clause-No-Nuclear-License"

BSD 3-Clause No Nuclear License

"BSD-3-Clause-No-Nuclear-License-2014"

BSD 3-Clause No Nuclear License 2014

"BSD-3-Clause-No-Nuclear-Warranty"

BSD 3-Clause No Nuclear Warranty

"BSD-3-Clause-Open-MPI"

BSD 3-Clause Open MPI variant

"BSD-3-Clause-Sun"

BSD 3-Clause Sun Microsystems

"BSD-3-Clause-Tso"

BSD 3-Clause Tso variant

"BSD-4-Clause"

BSD 4-Clause "Original" or "Old" License

"BSD-4-Clause-Shortened"

BSD 4 Clause Shortened

"BSD-4-Clause-UC"

BSD-4-Clause (University of California-Specific)

"BSD-4.3RENO"

BSD 4.3 RENO License

"BSD-4.3TAHOE"

BSD 4.3 TAHOE License

"BSD-Advertising-Acknowledgement"

BSD Advertising Acknowledgement License

"BSD-Attribution-HPND-disclaimer"

BSD with Attribution and HPND disclaimer

"BSD-Inferno-Nettverk"

BSD-Inferno-Nettverk

"BSD-Mark-Modifications"

BSD Mark Modifications License

"BSD-Protection"

BSD Protection License

"BSD-Source-beginning-file"

BSD Source Code Attribution - beginning of file variant

"BSD-Source-Code"

BSD Source Code Attribution

"BSD-Systemics"

Systemics BSD variant license

"BSD-Systemics-W3Works"

Systemics W3Works BSD variant license

"BSL-1.0"

Boost Software License 1.0

"Buddy"

Buddy License

"BUSL-1.1"

Business Source License 1.1

"bzip2-1.0.5"

bzip2 and libbzip2 License v1.0.5

"bzip2-1.0.6"

bzip2 and libbzip2 License v1.0.6

"C-UDA-1.0"

Computational Use of Data Agreement v1.0

"CAL-1.0"

Cryptographic Autonomy License 1.0

"CAL-1.0-Combined-Work-Exception"

Cryptographic Autonomy License 1.0 (Combined Work Exception)

"Caldera"

Caldera License

"Caldera-no-preamble"

Caldera License (without preamble)

"CAPEC-tou"

Common Attack Pattern Enumeration and Classification License

"Catharon"

Catharon License

"CATOSL-1.1"

Computer Associates Trusted Open Source License 1.1

"CC-BY-1.0"

Creative Commons Attribution 1.0 Generic

"CC-BY-2.0"

Creative Commons Attribution 2.0 Generic

"CC-BY-2.5"

Creative Commons Attribution 2.5 Generic

"CC-BY-2.5-AU"

Creative Commons Attribution 2.5 Australia

"CC-BY-3.0"

Creative Commons Attribution 3.0 Unported

"CC-BY-3.0-AT"

Creative Commons Attribution 3.0 Austria

"CC-BY-3.0-AU"

Creative Commons Attribution 3.0 Australia

"CC-BY-3.0-DE"

Creative Commons Attribution 3.0 Germany

"CC-BY-3.0-IGO"

Creative Commons Attribution 3.0 IGO

"CC-BY-3.0-NL"

Creative Commons Attribution 3.0 Netherlands

"CC-BY-3.0-US"

Creative Commons Attribution 3.0 United States

"CC-BY-4.0"

Creative Commons Attribution 4.0 International

"CC-BY-NC-1.0"

Creative Commons Attribution Non Commercial 1.0 Generic

"CC-BY-NC-2.0"

Creative Commons Attribution Non Commercial 2.0 Generic

"CC-BY-NC-2.5"

Creative Commons Attribution Non Commercial 2.5 Generic

"CC-BY-NC-3.0"

Creative Commons Attribution Non Commercial 3.0 Unported

"CC-BY-NC-3.0-DE"

Creative Commons Attribution Non Commercial 3.0 Germany

"CC-BY-NC-4.0"

Creative Commons Attribution Non Commercial 4.0 International

"CC-BY-NC-ND-1.0"

Creative Commons Attribution Non Commercial No Derivatives 1.0 Generic

"CC-BY-NC-ND-2.0"

Creative Commons Attribution Non Commercial No Derivatives 2.0 Generic

"CC-BY-NC-ND-2.5"

Creative Commons Attribution Non Commercial No Derivatives 2.5 Generic

"CC-BY-NC-ND-3.0"

Creative Commons Attribution Non Commercial No Derivatives 3.0 Unported

"CC-BY-NC-ND-3.0-DE"

Creative Commons Attribution Non Commercial No Derivatives 3.0 Germany

"CC-BY-NC-ND-3.0-IGO"

Creative Commons Attribution Non Commercial No Derivatives 3.0 IGO

"CC-BY-NC-ND-4.0"

Creative Commons Attribution Non Commercial No Derivatives 4.0 International

"CC-BY-NC-SA-1.0"

Creative Commons Attribution Non Commercial Share Alike 1.0 Generic

"CC-BY-NC-SA-2.0"

Creative Commons Attribution Non Commercial Share Alike 2.0 Generic

"CC-BY-NC-SA-2.0-DE"

Creative Commons Attribution Non Commercial Share Alike 2.0 Germany

"CC-BY-NC-SA-2.0-FR"

Creative Commons Attribution-NonCommercial-ShareAlike 2.0 France

"CC-BY-NC-SA-2.0-UK"

Creative Commons Attribution Non Commercial Share Alike 2.0 England and Wales

"CC-BY-NC-SA-2.5"

Creative Commons Attribution Non Commercial Share Alike 2.5 Generic

"CC-BY-NC-SA-3.0"

Creative Commons Attribution Non Commercial Share Alike 3.0 Unported

"CC-BY-NC-SA-3.0-DE"

Creative Commons Attribution Non Commercial Share Alike 3.0 Germany

"CC-BY-NC-SA-3.0-IGO"

Creative Commons Attribution Non Commercial Share Alike 3.0 IGO

"CC-BY-NC-SA-4.0"

Creative Commons Attribution Non Commercial Share Alike 4.0 International

"CC-BY-ND-1.0"

Creative Commons Attribution No Derivatives 1.0 Generic

"CC-BY-ND-2.0"

Creative Commons Attribution No Derivatives 2.0 Generic

"CC-BY-ND-2.5"

Creative Commons Attribution No Derivatives 2.5 Generic

"CC-BY-ND-3.0"

Creative Commons Attribution No Derivatives 3.0 Unported

"CC-BY-ND-3.0-DE"

Creative Commons Attribution No Derivatives 3.0 Germany

"CC-BY-ND-4.0"

Creative Commons Attribution No Derivatives 4.0 International

"CC-BY-SA-1.0"

Creative Commons Attribution Share Alike 1.0 Generic

"CC-BY-SA-2.0"

Creative Commons Attribution Share Alike 2.0 Generic

"CC-BY-SA-2.0-UK"

Creative Commons Attribution Share Alike 2.0 England and Wales

"CC-BY-SA-2.1-JP"

Creative Commons Attribution Share Alike 2.1 Japan

"CC-BY-SA-2.5"

Creative Commons Attribution Share Alike 2.5 Generic

"CC-BY-SA-3.0"

Creative Commons Attribution Share Alike 3.0 Unported

"CC-BY-SA-3.0-AT"

Creative Commons Attribution Share Alike 3.0 Austria

"CC-BY-SA-3.0-DE"

Creative Commons Attribution Share Alike 3.0 Germany

"CC-BY-SA-3.0-IGO"

Creative Commons Attribution-ShareAlike 3.0 IGO

"CC-BY-SA-4.0"

Creative Commons Attribution Share Alike 4.0 International

"CC-PDDC"

Creative Commons Public Domain Dedication and Certification

"CC-PDM-1.0"

Creative Commons Public Domain Mark 1.0 Universal

"CC-SA-1.0"

Creative Commons Share Alike 1.0 Generic

"CC0-1.0"

Creative Commons Zero v1.0 Universal

"CDDL-1.0"

Common Development and Distribution License 1.0

"CDDL-1.1"

Common Development and Distribution License 1.1

"CDL-1.0"

Common Documentation License 1.0

"CDLA-Permissive-1.0"

Community Data License Agreement Permissive 1.0

"CDLA-Permissive-2.0"

Community Data License Agreement Permissive 2.0

"CDLA-Sharing-1.0"

Community Data License Agreement Sharing 1.0

"CECILL-1.0"

CeCILL Free Software License Agreement v1.0

"CECILL-1.1"

CeCILL Free Software License Agreement v1.1

"CECILL-2.0"

CeCILL Free Software License Agreement v2.0

"CECILL-2.1"

CeCILL Free Software License Agreement v2.1

"CECILL-B"

CeCILL-B Free Software License Agreement

"CECILL-C"

CeCILL-C Free Software License Agreement

"CERN-OHL-1.1"

CERN Open Hardware Licence v1.1

"CERN-OHL-1.2"

CERN Open Hardware Licence v1.2

"CERN-OHL-P-2.0"

CERN Open Hardware Licence Version 2 - Permissive

"CERN-OHL-S-2.0"

CERN Open Hardware Licence Version 2 - Strongly Reciprocal

"CERN-OHL-W-2.0"

CERN Open Hardware Licence Version 2 - Weakly Reciprocal

"CFITSIO"

CFITSIO License

"check-cvs"

check-cvs License

"checkmk"

Checkmk License

"ClArtistic"

Clarified Artistic License

"Clips"

Clips License

"CMU-Mach"

CMU Mach License

"CMU-Mach-nodoc"

CMU Mach - no notices-in-documentation variant

"CNRI-Jython"

CNRI Jython License

"CNRI-Python"

CNRI Python License

"CNRI-Python-GPL-Compatible"

CNRI Python Open Source GPL Compatible License Agreement

"COIL-1.0"

Copyfree Open Innovation License

"Community-Spec-1.0"

Community Specification License 1.0

"Condor-1.1"

Condor Public License v1.1

"copyleft-next-0.3.0"

copyleft-next 0.3.0

"copyleft-next-0.3.1"

copyleft-next 0.3.1

"Cornell-Lossless-JPEG"

Cornell Lossless JPEG License

"CPAL-1.0"

Common Public Attribution License 1.0

"CPL-1.0"

Common Public License 1.0

"CPOL-1.02"

Code Project Open License 1.02

"Cronyx"

Cronyx License

"Crossword"

Crossword License

"CryptoSwift"

CryptoSwift License

"CrystalStacker"

CrystalStacker License

"CUA-OPL-1.0"

CUA Office Public License v1.0

"Cube"

Cube License

"curl"

curl License

"cve-tou"

Common Vulnerability Enumeration ToU License

"D-FSL-1.0"

Deutsche Freie Software Lizenz

"DEC-3-Clause"

DEC 3-Clause License

"diffmark"

diffmark license

"DL-DE-BY-2.0"

Data licence Germany – attribution – version 2.0

"DL-DE-ZERO-2.0"

Data licence Germany – zero – version 2.0

"DOC"

DOC License

"DocBook-DTD"

DocBook DTD License

"DocBook-Schema"

DocBook Schema License

"DocBook-Stylesheet"

DocBook Stylesheet License

"DocBook-XML"

DocBook XML License

"Dotseqn"

Dotseqn License

"DRL-1.0"

Detection Rule License 1.0

"DRL-1.1"

Detection Rule License 1.1

"DSDP"

DSDP License

"dtoa"

David M. Gay dtoa License

"dvipdfm"

dvipdfm License

"ECL-1.0"

Educational Community License v1.0

"ECL-2.0"

Educational Community License v2.0

"eCos-2.0"

eCos license version 2.0

"EFL-1.0"

Eiffel Forum License v1.0

"EFL-2.0"

Eiffel Forum License v2.0

"eGenix"

eGenix.com Public License 1.1.0

"Elastic-2.0"

Elastic License 2.0

"Entessa"

Entessa Public License v1.0

"EPICS"

EPICS Open License

"EPL-1.0"

Eclipse Public License 1.0

"EPL-2.0"

Eclipse Public License 2.0

"ErlPL-1.1"

Erlang Public License v1.1

"ESA-PL-permissive-2.4"

European Space Agency Public License – v2.4 – Permissive (Type 3)

"ESA-PL-strong-copyleft-2.4"

European Space Agency Public License (ESA-PL) - V2.4 - Strong Copyleft (Type 1)

"ESA-PL-weak-copyleft-2.4"

European Space Agency Public License – v2.4 – Weak Copyleft (Type 2)

"etalab-2.0"

Etalab Open License 2.0

"EUDatagrid"

EU DataGrid Software License

"EUPL-1.0"

European Union Public License 1.0

"EUPL-1.1"

European Union Public License 1.1

"EUPL-1.2"

European Union Public License 1.2

"Eurosym"

Eurosym License

"Fair"

Fair License

"FBM"

Fuzzy Bitmap License

"FDK-AAC"

Fraunhofer FDK AAC Codec Library

"Ferguson-Twofish"

Ferguson Twofish License

"Frameworx-1.0"

Frameworx Open License 1.0

"FreeBSD-DOC"

FreeBSD Documentation License

"FreeImage"

FreeImage Public License v1.0

"FSFAP"

FSF All Permissive License

"FSFAP-no-warranty-disclaimer"

FSF All Permissive License (without Warranty)

"FSFUL"

FSF Unlimited License

"FSFULLR"

FSF Unlimited License (with License Retention)

"FSFULLRSD"

FSF Unlimited License (with License Retention and Short Disclaimer)

"FSFULLRWD"

FSF Unlimited License (With License Retention and Warranty Disclaimer)

"FSL-1.1-ALv2"

Functional Source License, Version 1.1, ALv2 Future License

"FSL-1.1-MIT"

Functional Source License, Version 1.1, MIT Future License

"FTL"

Freetype Project License

"Furuseth"

Furuseth License

"fwlw"

fwlw License

"Game-Programming-Gems"

Game Programming Gems License

"GCR-docs"

Gnome GCR Documentation License

"GD"

GD License

"generic-xts"

Generic XTS License

"GFDL-1.1"

GNU Free Documentation License v1.1

"GFDL-1.1-invariants-only"

GNU Free Documentation License v1.1 only - invariants

"GFDL-1.1-invariants-or-later"

GNU Free Documentation License v1.1 or later - invariants

"GFDL-1.1-no-invariants-only"

GNU Free Documentation License v1.1 only - no invariants

"GFDL-1.1-no-invariants-or-later"

GNU Free Documentation License v1.1 or later - no invariants

"GFDL-1.1-only"

GNU Free Documentation License v1.1 only

"GFDL-1.1-or-later"

GNU Free Documentation License v1.1 or later

"GFDL-1.2"

GNU Free Documentation License v1.2

"GFDL-1.2-invariants-only"

GNU Free Documentation License v1.2 only - invariants

"GFDL-1.2-invariants-or-later"

GNU Free Documentation License v1.2 or later - invariants

"GFDL-1.2-no-invariants-only"

GNU Free Documentation License v1.2 only - no invariants

"GFDL-1.2-no-invariants-or-later"

GNU Free Documentation License v1.2 or later - no invariants

"GFDL-1.2-only"

GNU Free Documentation License v1.2 only

"GFDL-1.2-or-later"

GNU Free Documentation License v1.2 or later

"GFDL-1.3"

GNU Free Documentation License v1.3

"GFDL-1.3-invariants-only"

GNU Free Documentation License v1.3 only - invariants

"GFDL-1.3-invariants-or-later"

GNU Free Documentation License v1.3 or later - invariants

"GFDL-1.3-no-invariants-only"

GNU Free Documentation License v1.3 only - no invariants

"GFDL-1.3-no-invariants-or-later"

GNU Free Documentation License v1.3 or later - no invariants

"GFDL-1.3-only"

GNU Free Documentation License v1.3 only

"GFDL-1.3-or-later"

GNU Free Documentation License v1.3 or later

"Giftware"

Giftware License

"GL2PS"

GL2PS License

"Glide"

3dfx Glide License

"Glulxe"

Glulxe License

"GLWTPL"

Good Luck With That Public License

"gnuplot"

gnuplot License

"GPL-1.0"

GNU General Public License v1.0 only

"GPL-1.0+"

GNU General Public License v1.0 or later

"GPL-1.0-only"

GNU General Public License v1.0 only

"GPL-1.0-or-later"

GNU General Public License v1.0 or later

"GPL-2.0"

GNU General Public License v2.0 only

"GPL-2.0+"

GNU General Public License v2.0 or later

"GPL-2.0-only"

GNU General Public License v2.0 only

"GPL-2.0-or-later"

GNU General Public License v2.0 or later

"GPL-2.0-with-autoconf-exception"

GNU General Public License v2.0 w/Autoconf exception

"GPL-2.0-with-bison-exception"

GNU General Public License v2.0 w/Bison exception

"GPL-2.0-with-classpath-exception"

GNU General Public License v2.0 w/Classpath exception

"GPL-2.0-with-font-exception"

GNU General Public License v2.0 w/Font exception

"GPL-2.0-with-GCC-exception"

GNU General Public License v2.0 w/GCC Runtime Library exception

"GPL-3.0"

GNU General Public License v3.0 only

"GPL-3.0+"

GNU General Public License v3.0 or later

"GPL-3.0-only"

GNU General Public License v3.0 only

"GPL-3.0-or-later"

GNU General Public License v3.0 or later

"GPL-3.0-with-autoconf-exception"

GNU General Public License v3.0 w/Autoconf exception

"GPL-3.0-with-GCC-exception"

GNU General Public License v3.0 w/GCC Runtime Library exception

"Graphics-Gems"

Graphics Gems License

"gSOAP-1.3b"

gSOAP Public License v1.3b

"gtkbook"

gtkbook License

"Gutmann"

Gutmann License

"HaskellReport"

Haskell Language Report License

"HDF5"

HDF5 License

"hdparm"

hdparm License

"HIDAPI"

HIDAPI License

"Hippocratic-2.1"

Hippocratic License 2.1

"HP-1986"

Hewlett-Packard 1986 License

"HP-1989"

Hewlett-Packard 1989 License

"HPND"

Historical Permission Notice and Disclaimer

"HPND-DEC"

Historical Permission Notice and Disclaimer - DEC variant

"HPND-doc"

Historical Permission Notice and Disclaimer - documentation variant

"HPND-doc-sell"

Historical Permission Notice and Disclaimer - documentation sell variant

"HPND-export-US"

HPND with US Government export control warning

"HPND-export-US-acknowledgement"

HPND with US Government export control warning and acknowledgment

"HPND-export-US-modify"

HPND with US Government export control warning and modification rqmt

"HPND-export2-US"

HPND with US Government export control and 2 disclaimers

"HPND-Fenneberg-Livingston"

Historical Permission Notice and Disclaimer - Fenneberg-Livingston variant

"HPND-INRIA-IMAG"

Historical Permission Notice and Disclaimer - INRIA-IMAG variant

"HPND-Intel"

Historical Permission Notice and Disclaimer - Intel variant

"HPND-Kevlin-Henney"

Historical Permission Notice and Disclaimer - Kevlin Henney variant

"HPND-Markus-Kuhn"

Historical Permission Notice and Disclaimer - Markus Kuhn variant

"HPND-merchantability-variant"

Historical Permission Notice and Disclaimer - merchantability variant

"HPND-MIT-disclaimer"

Historical Permission Notice and Disclaimer with MIT disclaimer

"HPND-Netrek"

Historical Permission Notice and Disclaimer - Netrek variant

"HPND-Pbmplus"

Historical Permission Notice and Disclaimer - Pbmplus variant

"HPND-sell-MIT-disclaimer-xserver"

Historical Permission Notice and Disclaimer - sell xserver variant with MIT disclaimer

"HPND-sell-regexpr"

Historical Permission Notice and Disclaimer - sell regexpr variant

"HPND-sell-variant"

Historical Permission Notice and Disclaimer - sell variant

"HPND-sell-variant-critical-systems"

HPND - sell variant with safety critical systems clause

"HPND-sell-variant-MIT-disclaimer"

HPND sell variant with MIT disclaimer

"HPND-sell-variant-MIT-disclaimer-rev"

HPND sell variant with MIT disclaimer - reverse

"HPND-SMC"

Historical Permission Notice and Disclaimer - SMC variant

"HPND-UC"

Historical Permission Notice and Disclaimer - University of California variant

"HPND-UC-export-US"

Historical Permission Notice and Disclaimer - University of California, US export warning

"HTMLTIDY"

HTML Tidy License

"hyphen-bulgarian"

hyphen-bulgarian License

"IBM-pibs"

IBM PowerPC Initialization and Boot Software

"ICU"

ICU License

"IEC-Code-Components-EULA"

IEC Code Components End-user licence agreement

"IJG"

Independent JPEG Group License

"IJG-short"

Independent JPEG Group License - short

"ImageMagick"

ImageMagick License

"iMatix"

iMatix Standard Function Library Agreement

"Imlib2"

Imlib2 License

"Info-ZIP"

Info-ZIP License

"Inner-Net-2.0"

Inner Net License v2.0

"InnoSetup"

Inno Setup License

"Intel"

Intel Open Source License

"Intel-ACPI"

Intel ACPI Software License Agreement

"Interbase-1.0"

Interbase Public License v1.0

"IPA"

IPA Font License

"IPL-1.0"

IBM Public License v1.0

"ISC"

ISC License

"ISC-Veillard"

ISC Veillard variant

"ISO-permission"

ISO permission notice

"Jam"

Jam License

"JasPer-2.0"

JasPer License

"jove"

Jove License

"JPL-image"

JPL Image Use Policy

"JPNIC"

Japan Network Information Center License

"JSON"

JSON License

"Kastrup"

Kastrup License

"Kazlib"

Kazlib License

"Knuth-CTAN"

Knuth CTAN License

"LAL-1.2"

Licence Art Libre 1.2

"LAL-1.3"

Licence Art Libre 1.3

"Latex2e"

Latex2e License

"Latex2e-translated-notice"

Latex2e with translated notice permission

"Leptonica"

Leptonica License

"LGPL-2.0"

GNU Library General Public License v2 only

"LGPL-2.0+"

GNU Library General Public License v2 or later

"LGPL-2.0-only"

GNU Library General Public License v2 only

"LGPL-2.0-or-later"

GNU Library General Public License v2 or later

"LGPL-2.1"

GNU Lesser General Public License v2.1 only

"LGPL-2.1+"

GNU Lesser General Public License v2.1 or later

"LGPL-2.1-only"

GNU Lesser General Public License v2.1 only

"LGPL-2.1-or-later"

GNU Lesser General Public License v2.1 or later

"LGPL-3.0"

GNU Lesser General Public License v3.0 only

"LGPL-3.0+"

GNU Lesser General Public License v3.0 or later

"LGPL-3.0-only"

GNU Lesser General Public License v3.0 only

"LGPL-3.0-or-later"

GNU Lesser General Public License v3.0 or later

"LGPLLR"

Lesser General Public License For Linguistic Resources

"Libpng"

libpng License

"libpng-1.6.35"

PNG Reference Library License v1 (for libpng 0.5 through 1.6.35)

"libpng-2.0"

PNG Reference Library version 2

"libselinux-1.0"

libselinux public domain notice

"libtiff"

libtiff License

"libutil-David-Nugent"

libutil David Nugent License

"LiLiQ-P-1.1"

Licence Libre du Québec – Permissive version 1.1

"LiLiQ-R-1.1"

Licence Libre du Québec – Réciprocité version 1.1

"LiLiQ-Rplus-1.1"

Licence Libre du Québec – Réciprocité forte version 1.1

"Linux-man-pages-1-para"

Linux man-pages - 1 paragraph

"Linux-man-pages-copyleft"

Linux man-pages Copyleft

"Linux-man-pages-copyleft-2-para"

Linux man-pages Copyleft - 2 paragraphs

"Linux-man-pages-copyleft-var"

Linux man-pages Copyleft Variant

"Linux-OpenIB"

Linux Kernel Variant of OpenIB.org license

"LOOP"

Common Lisp LOOP License

"LPD-document"

LPD Documentation License

"LPL-1.0"

Lucent Public License Version 1.0

"LPL-1.02"

Lucent Public License v1.02

"LPPL-1.0"

LaTeX Project Public License v1.0

"LPPL-1.1"

LaTeX Project Public License v1.1

"LPPL-1.2"

LaTeX Project Public License v1.2

"LPPL-1.3a"

LaTeX Project Public License v1.3a

"LPPL-1.3c"

LaTeX Project Public License v1.3c

"lsof"

lsof License

"Lucida-Bitmap-Fonts"

Lucida Bitmap Fonts License

"LZMA-SDK-9.11-to-9.20"

LZMA SDK License (versions 9.11 to 9.20)

"LZMA-SDK-9.22"

LZMA SDK License (versions 9.22 and beyond)

"Mackerras-3-Clause"

Mackerras 3-Clause License

"Mackerras-3-Clause-acknowledgment"

Mackerras 3-Clause - acknowledgment variant

"magaz"

magaz License

"mailprio"

mailprio License

"MakeIndex"

MakeIndex License

"man2html"

man2html License

"Martin-Birgmeier"

Martin Birgmeier License

"McPhee-slideshow"

McPhee Slideshow License

"metamail"

metamail License

"Minpack"

Minpack License

"MIPS"

MIPS License

"MirOS"

The MirOS Licence

"MIT"

MIT License

"MIT-0"

MIT No Attribution

"MIT-advertising"

Enlightenment License (e16)

"MIT-Click"

MIT Click License

"MIT-CMU"

CMU License

"MIT-enna"

enna License

"MIT-feh"

feh License

"MIT-Festival"

MIT Festival Variant

"MIT-Khronos-old"

MIT Khronos - old variant

"MIT-Modern-Variant"

MIT License Modern Variant

"MIT-open-group"

MIT Open Group variant

"MIT-STK"

MIT-STK License

"MIT-testregex"

MIT testregex Variant

"MIT-Wu"

MIT Tom Wu Variant

"MITNFA"

MIT +no-false-attribs license

"MMIXware"

MMIXware License

"MMPL-1.0.1"

Minecraft Mod Public License v1.0.1

"Motosoto"

Motosoto License

"MPEG-SSG"

MPEG Software Simulation

"mpi-permissive"

mpi Permissive License

"mpich2"

mpich2 License

"MPL-1.0"

Mozilla Public License 1.0

"MPL-1.1"

Mozilla Public License 1.1

"MPL-2.0"

Mozilla Public License 2.0

"MPL-2.0-no-copyleft-exception"

Mozilla Public License 2.0 (no copyleft exception)

"mplus"

mplus Font License

"MS-LPL"

Microsoft Limited Public License

"MS-PL"

Microsoft Public License

"MS-RL"

Microsoft Reciprocal License

"MTLL"

Matrix Template Library License

"MulanPSL-1.0"

Mulan Permissive Software License, Version 1

"MulanPSL-2.0"

Mulan Permissive Software License, Version 2

"Multics"

Multics License

"Mup"

Mup License

"NAIST-2003"

Nara Institute of Science and Technology License (2003)

"NASA-1.3"

NASA Open Source Agreement 1.3

"Naumen"

Naumen Public License

"NBPL-1.0"

Net Boolean Public License v1

"NCBI-PD"

NCBI Public Domain Notice

"NCGL-UK-2.0"

Non-Commercial Government Licence

"NCL"

NCL Source Code License

"NCSA"

University of Illinois/NCSA Open Source License

"Net-SNMP"

Net-SNMP License

"NetCDF"

NetCDF license

"Newsletr"

Newsletr License

"NGPL"

Nethack General Public License

"ngrep"

ngrep License

"NICTA-1.0"

NICTA Public Software License, Version 1.0

"NIST-PD"

NIST Public Domain Notice

"NIST-PD-fallback"

NIST Public Domain Notice with license fallback

"NIST-PD-TNT"

NIST Public Domain Notice TNT variant

"NIST-Software"

NIST Software License

"NLOD-1.0"

Norwegian Licence for Open Government Data (NLOD) 1.0

"NLOD-2.0"

Norwegian Licence for Open Government Data (NLOD) 2.0

"NLPL"

No Limit Public License

"Nokia"

Nokia Open Source License

"NOSL"

Netizen Open Source License

"Noweb"

Noweb License

"NPL-1.0"

Netscape Public License v1.0

"NPL-1.1"

Netscape Public License v1.1

"NPOSL-3.0"

Non-Profit Open Software License 3.0

"NRL"

NRL License

"NTIA-PD"

NTIA Public Domain Notice

"NTP"

NTP License

"NTP-0"

NTP No Attribution

"Nunit"

Nunit License

"O-UDA-1.0"

Open Use of Data Agreement v1.0

"OAR"

OAR License

"OCCT-PL"

Open CASCADE Technology Public License

"OCLC-2.0"

OCLC Research Public License 2.0

"ODbL-1.0"

Open Data Commons Open Database License v1.0

"ODC-By-1.0"

Open Data Commons Attribution License v1.0

"OFFIS"

OFFIS License

"OFL-1.0"

SIL Open Font License 1.0

"OFL-1.0-no-RFN"

SIL Open Font License 1.0 with no Reserved Font Name

"OFL-1.0-RFN"

SIL Open Font License 1.0 with Reserved Font Name

"OFL-1.1"

SIL Open Font License 1.1

"OFL-1.1-no-RFN"

SIL Open Font License 1.1 with no Reserved Font Name

"OFL-1.1-RFN"

SIL Open Font License 1.1 with Reserved Font Name

"OGC-1.0"

OGC Software License, Version 1.0

"OGDL-Taiwan-1.0"

Taiwan Open Government Data License, version 1.0

"OGL-Canada-2.0"

Open Government Licence - Canada

"OGL-UK-1.0"

Open Government Licence v1.0

"OGL-UK-2.0"

Open Government Licence v2.0

"OGL-UK-3.0"

Open Government Licence v3.0

"OGTSL"

Open Group Test Suite License

"OLDAP-1.1"

Open LDAP Public License v1.1

"OLDAP-1.2"

Open LDAP Public License v1.2

"OLDAP-1.3"

Open LDAP Public License v1.3

"OLDAP-1.4"

Open LDAP Public License v1.4

"OLDAP-2.0"

Open LDAP Public License v2.0 (or possibly 2.0A and 2.0B)

"OLDAP-2.0.1"

Open LDAP Public License v2.0.1

"OLDAP-2.1"

Open LDAP Public License v2.1

"OLDAP-2.2"

Open LDAP Public License v2.2

"OLDAP-2.2.1"

Open LDAP Public License v2.2.1

"OLDAP-2.2.2"

Open LDAP Public License 2.2.2

"OLDAP-2.3"

Open LDAP Public License v2.3

"OLDAP-2.4"

Open LDAP Public License v2.4

"OLDAP-2.5"

Open LDAP Public License v2.5

"OLDAP-2.6"

Open LDAP Public License v2.6

"OLDAP-2.7"

Open LDAP Public License v2.7

"OLDAP-2.8"

Open LDAP Public License v2.8

"OLFL-1.3"

Open Logistics Foundation License Version 1.3

"OML"

Open Market License

"OpenMDW-1.0"

OpenMDW License Agreement v1.0

"OpenPBS-2.3"

OpenPBS v2.3 Software License

"OpenSSL"

OpenSSL License

"OpenSSL-standalone"

OpenSSL License - standalone

"OpenVision"

OpenVision License

"OPL-1.0"

Open Public License v1.0

"OPL-UK-3.0"

United Kingdom Open Parliament Licence v3.0

"OPUBL-1.0"

Open Publication License v1.0

"OSC-1.0"

OSC License 1.0

"OSET-PL-2.1"

OSET Public License version 2.1

"OSL-1.0"

Open Software License 1.0

"OSL-1.1"

Open Software License 1.1

"OSL-2.0"

Open Software License 2.0

"OSL-2.1"

Open Software License 2.1

"OSL-3.0"

Open Software License 3.0

"OSSP"

OSSP License

"PADL"

PADL License

"ParaType-Free-Font-1.3"

ParaType Free Font Licensing Agreement v1.3

"Parity-6.0.0"

The Parity Public License 6.0.0

"Parity-7.0.0"

The Parity Public License 7.0.0

"PDDL-1.0"

Open Data Commons Public Domain Dedication & License 1.0

"PHP-3.0"

PHP License v3.0

"PHP-3.01"

PHP License v3.01

"Pixar"

Pixar License

"pkgconf"

pkgconf License

"Plexus"

Plexus Classworlds License

"pnmstitch"

pnmstitch License

"PolyForm-Noncommercial-1.0.0"

PolyForm Noncommercial License 1.0.0

"PolyForm-Small-Business-1.0.0"

PolyForm Small Business License 1.0.0

"PostgreSQL"

PostgreSQL License

"PPL"

Peer Production License

"PSF-2.0"

Python Software Foundation License 2.0

"psfrag"

psfrag License

"psutils"

psutils License

"Python-2.0"

Python License 2.0

"Python-2.0.1"

Python License 2.0.1

"python-ldap"

Python ldap License

"Qhull"

Qhull License

"QPL-1.0"

Q Public License 1.0

"QPL-1.0-INRIA-2004"

Q Public License 1.0 - INRIA 2004 variant

"radvd"

radvd License

"Rdisc"

Rdisc License

"RHeCos-1.1"

Red Hat eCos Public License v1.1

"RPL-1.1"

Reciprocal Public License 1.1

"RPL-1.5"

Reciprocal Public License 1.5

"RPSL-1.0"

RealNetworks Public Source License v1.0

"RSA-MD"

RSA Message-Digest License

"RSCPL"

Ricoh Source Code Public License

"Ruby"

Ruby License

"Ruby-pty"

Ruby pty extension license

"SAX-PD"

Sax Public Domain Notice

"SAX-PD-2.0"

Sax Public Domain Notice 2.0

"Saxpath"

Saxpath License

"SCEA"

SCEA Shared Source License

"SchemeReport"

Scheme Language Report License

"Sendmail"

Sendmail License

"Sendmail-8.23"

Sendmail License 8.23

"Sendmail-Open-Source-1.1"

Sendmail Open Source License v1.1

"SGI-B-1.0"

SGI Free Software License B v1.0

"SGI-B-1.1"

SGI Free Software License B v1.1

"SGI-B-2.0"

SGI Free Software License B v2.0

"SGI-OpenGL"

SGI OpenGL License

"SGMLUG-PM"

SGMLUG Parser Materials License

"SGP4"

SGP4 Permission Notice

"SHL-0.5"

Solderpad Hardware License v0.5

"SHL-0.51"

Solderpad Hardware License, Version 0.51

"SimPL-2.0"

Simple Public License 2.0

"SISSL"

Sun Industry Standards Source License v1.1

"SISSL-1.2"

Sun Industry Standards Source License v1.2

"SL"

SL License

"Sleepycat"

Sleepycat License

"SMAIL-GPL"

SMAIL General Public License

"SMLNJ"

Standard ML of New Jersey License

"SMPPL"

Secure Messaging Protocol Public License

"SNIA"

SNIA Public License 1.1

"snprintf"

snprintf License

"SOFA"

SOFA Software License

"softSurfer"

softSurfer License

"Soundex"

Soundex License

"Spencer-86"

Spencer License 86

"Spencer-94"

Spencer License 94

"Spencer-99"

Spencer License 99

"SPL-1.0"

Sun Public License v1.0

"ssh-keyscan"

ssh-keyscan License

"SSH-OpenSSH"

SSH OpenSSH license

"SSH-short"

SSH short notice

"SSLeay-standalone"

SSLeay License - standalone

"SSPL-1.0"

Server Side Public License, v 1

"StandardML-NJ"

Standard ML of New Jersey License

"SugarCRM-1.1.3"

SugarCRM Public License v1.1.3

"SUL-1.0"

Sustainable Use License v1.0

"Sun-PPP"

Sun PPP License

"Sun-PPP-2000"

Sun PPP License (2000)

"SunPro"

SunPro License

"SWL"

Scheme Widget Library (SWL) Software License Agreement

"swrule"

swrule License

"Symlinks"

Symlinks License

"TAPR-OHL-1.0"

TAPR Open Hardware License v1.0

"TCL"

TCL/TK License

"TCP-wrappers"

TCP Wrappers License

"TekHVC"

TekHVC License

"TermReadKey"

TermReadKey License

"TGPPL-1.0"

Transitive Grace Period Public Licence 1.0

"ThirdEye"

ThirdEye License

"threeparttable"

threeparttable License

"TMate"

TMate Open Source License

"TORQUE-1.1"

TORQUE v2.5+ Software License v1.1

"TOSL"

Trusster Open Source License

"TPDL"

Time::ParseDate License

"TPL-1.0"

THOR Public License 1.0

"TrustedQSL"

TrustedQSL License

"TTWL"

Text-Tabs+Wrap License

"TTYP0"

TTYP0 License

"TU-Berlin-1.0"

Technische Universitaet Berlin License 1.0

"TU-Berlin-2.0"

Technische Universitaet Berlin License 2.0

"Ubuntu-font-1.0"

Ubuntu Font Licence v1.0

"UCAR"

UCAR License

"UCL-1.0"

Upstream Compatibility License v1.0

"ulem"

ulem License

"UMich-Merit"

Michigan/Merit Networks License

"Unicode-3.0"

Unicode License v3

"Unicode-DFS-2015"

Unicode License Agreement - Data Files and Software (2015)

"Unicode-DFS-2016"

Unicode License Agreement - Data Files and Software (2016)

"Unicode-TOU"

Unicode Terms of Use

"UnixCrypt"

UnixCrypt License

"Unlicense"

The Unlicense

"Unlicense-libtelnet"

Unlicense - libtelnet variant

"Unlicense-libwhirlpool"

Unlicense - libwhirlpool variant

"UnRAR"

UnRAR License

"UPL-1.0"

Universal Permissive License v1.0

"URT-RLE"

Utah Raster Toolkit Run Length Encoded License

"Vim"

Vim License

"Vixie-Cron"

Vixie Cron License

"VOSTROM"

VOSTROM Public License for Open Source

"VSL-1.0"

Vovida Software License v1.0

"W3C"

W3C Software Notice and License (2002-12-31)

"W3C-19980720"

W3C Software Notice and License (1998-07-20)

"W3C-20150513"

W3C Software Notice and Document License (2015-05-13)

"w3m"

w3m License

"Watcom-1.0"

Sybase Open Watcom Public License 1.0

"Widget-Workshop"

Widget Workshop License

"WordNet"

WordNet License

"Wsuipa"

Wsuipa License

"WTFNMFPL"

Do What The F*ck You Want To But It's Not My Fault Public License

"WTFPL"

Do What The F*ck You Want To Public License

"wwl"

WWL License

"wxWindows"

wxWindows Library License

"X11"

X11 License

"X11-distribute-modifications-variant"

X11 License Distribution Modification Variant

"X11-no-permit-persons"

X11 no permit persons clause

"X11-swapped"

X11 swapped final paragraphs

"Xdebug-1.03"

Xdebug License v 1.03

"Xerox"

Xerox License

"Xfig"

Xfig License

"XFree86-1.1"

XFree86 License 1.1

"xinetd"

xinetd License

"xkeyboard-config-Zinoviev"

xkeyboard-config Zinoviev License

"xlock"

xlock License

"Xnet"

X.Net License

"xpp"

XPP License

"XSkat"

XSkat License

"xzoom"

xzoom License

"YPL-1.0"

Yahoo! Public License v1.0

"YPL-1.1"

Yahoo! Public License v1.1

"Zed"

Zed License

"Zeeff"

Zeeff License

"Zend-2.0"

Zend License v2.0

"Zimbra-1.3"

Zimbra Public License v1.3

"Zimbra-1.4"

Zimbra Public License v1.4

"Zlib"

zlib License

"zlib-acknowledgement"

zlib/libpng License with Acknowledgement

"ZPL-1.1"

Zope Public License 1.1

"ZPL-2.0"

Zope Public License 2.0

"ZPL-2.1"

Zope Public License 2.1

"389-exception"

389 Directory Server Exception

"Asterisk-exception"

Asterisk exception

"Asterisk-linking-protocols-exception"

Asterisk linking protocols exception

"Autoconf-exception-2.0"

Autoconf exception 2.0

"Autoconf-exception-3.0"

Autoconf exception 3.0

"Autoconf-exception-generic"

Autoconf generic exception

"Autoconf-exception-generic-3.0"

Autoconf generic exception for GPL-3.0

"Autoconf-exception-macro"

Autoconf macro exception

"Bison-exception-1.24"

Bison exception 1.24

"Bison-exception-2.2"

Bison exception 2.2

"Bootloader-exception"

Bootloader Distribution Exception

"CGAL-linking-exception"

CGAL Linking Exception

"Classpath-exception-2.0"

Classpath exception 2.0

"Classpath-exception-2.0-short"

Classpath exception 2.0 - short

"CLISP-exception-2.0"

CLISP exception 2.0

"cryptsetup-OpenSSL-exception"

cryptsetup OpenSSL exception

"Digia-Qt-LGPL-exception-1.1"

Digia Qt LGPL Exception version 1.1

"DigiRule-FOSS-exception"

DigiRule FOSS License Exception

"eCos-exception-2.0"

eCos exception 2.0

"erlang-otp-linking-exception"

Erlang/OTP Linking Exception

"Fawkes-Runtime-exception"

Fawkes Runtime Exception

"FLTK-exception"

FLTK exception

"fmt-exception"

fmt exception

"Font-exception-2.0"

Font exception 2.0

"freertos-exception-2.0"

FreeRTOS Exception 2.0

"GCC-exception-2.0"

GCC Runtime Library exception 2.0

"GCC-exception-2.0-note"

GCC Runtime Library exception 2.0 - note variant

"GCC-exception-3.1"

GCC Runtime Library exception 3.1

"Gmsh-exception"

Gmsh exception

"GNAT-exception"

GNAT exception

"GNOME-examples-exception"

GNOME examples exception

"GNU-compiler-exception"

GNU Compiler Exception

"gnu-javamail-exception"

GNU JavaMail exception

"GPL-3.0-389-ds-base-exception"

GPL-3.0 389 DS Base Exception

"GPL-3.0-interface-exception"

GPL-3.0 Interface Exception

"GPL-3.0-linking-exception"

GPL-3.0 Linking Exception

"GPL-3.0-linking-source-exception"

GPL-3.0 Linking Exception (with Corresponding Source)

"GPL-CC-1.0"

GPL Cooperation Commitment 1.0

"GStreamer-exception-2005"

GStreamer Exception (2005)

"GStreamer-exception-2008"

GStreamer Exception (2008)

"harbour-exception"

harbour exception

"i2p-gpl-java-exception"

i2p GPL+Java Exception

"Independent-modules-exception"

Independent Module Linking exception

"KiCad-libraries-exception"

KiCad Libraries Exception

"kvirc-openssl-exception"

kvirc OpenSSL Exception

"LGPL-3.0-linking-exception"

LGPL-3.0 Linking Exception

"libpri-OpenH323-exception"

libpri OpenH323 exception

"Libtool-exception"

Libtool Exception

"Linux-syscall-note"

Linux Syscall Note

"LLGPL"

LLGPL Preamble

"LLVM-exception"

LLVM Exception

"LZMA-exception"

LZMA exception

"mif-exception"

Macros and Inline Functions Exception

"mxml-exception"

mxml Exception

"Nokia-Qt-exception-1.1"

Nokia Qt LGPL exception 1.1

"OCaml-LGPL-linking-exception"

OCaml LGPL Linking Exception

"OCCT-exception-1.0"

Open CASCADE Exception 1.0

"OpenJDK-assembly-exception-1.0"

OpenJDK Assembly exception 1.0

"openvpn-openssl-exception"

OpenVPN OpenSSL Exception

"PCRE2-exception"

PCRE2 exception

"polyparse-exception"

Polyparse Exception

"PS-or-PDF-font-exception-20170817"

PS/PDF font exception (2017-08-17)

"QPL-1.0-INRIA-2004-exception"

INRIA QPL 1.0 2004 variant exception

"Qt-GPL-exception-1.0"

Qt GPL exception 1.0

"Qt-LGPL-exception-1.1"

Qt LGPL exception 1.1

"Qwt-exception-1.0"

Qwt exception 1.0

"romic-exception"

Romic Exception

"RRDtool-FLOSS-exception-2.0"

RRDtool FLOSS exception 2.0

"rsync-linking-exception"

rsync Linking Exception

"SANE-exception"

SANE Exception

"SHL-2.0"

Solderpad Hardware License v2.0

"SHL-2.1"

Solderpad Hardware License v2.1

"Simple-Library-Usage-exception"

Simple Library Usage Exception

"sqlitestudio-OpenSSL-exception"

sqlitestudio OpenSSL exception

"stunnel-exception"

stunnel Exception

"SWI-exception"

SWI exception

"Swift-exception"

Swift Exception

"Texinfo-exception"

Texinfo exception

"u-boot-exception-2.0"

U-Boot exception 2.0

"UBDL-exception"

Unmodified Binary Distribution exception

"Universal-FOSS-exception-1.0"

Universal FOSS Exception, Version 1.0

"vsftpd-openssl-exception"

vsftpd OpenSSL exception

"WxWindows-exception-3.1"

WxWindows Library Exception 3.1

"x11vnc-openssl-exception"

x11vnc OpenSSL Exception


Example:

"Apache-2.0"

Type: string

If SPDX does not define the license used, this field may be used to provide the license name


Example:

"Acme Software License"

Type: object

An optional way to include the textual content of a license.

No Additional Properties

Type: string Default: "text/plain"

Specifies the content type of the text. Defaults to text/plain if not specified.

Type: enum (of string)

Specifies the optional encoding the text is represented in.

Must be one of:

  • "base64"

Type: string

The attachment data. Proactive controls such as input validation and sanitization should be employed to prevent misuse of attachment text.

Type: stringFormat: iri-reference

The URL to the license file. If specified, a 'license' externalReference should also be specified for completeness


Example:

"https://www.apache.org/licenses/LICENSE-2.0.txt"

Type: string

Examples:

"Apache-2.0 AND (MIT OR GPL-2.0-only)"

"GPL-3.0-only WITH Classpath-exception-2.0"

Type: string

Specifies a well-formed CPE name that conforms to the CPE 2.2 or 2.3 specification. See https://nvd.nist.gov/products/cpe


Example:

"cpe:2.3:a:acme:component_framework:-:*:*:*:*:*:*:*"

Type: string

Specifies the package-url (purl). The purl, if specified, MUST be valid and conform to the specification defined at: https://github.com/package-url/purl-spec


Example:

"pkg:maven/com.acme/[email protected]?packaging=jar"

Type: object

Specifies metadata and content for ISO-IEC 19770-2 Software Identification (SWID) Tags.

No Additional Properties

Type: string

Maps to the tagId of a SoftwareIdentity.

Type: string

Maps to the name of a SoftwareIdentity.

Type: string Default: "0.0"

Maps to the version of a SoftwareIdentity.

Type: integer Default: 0

Maps to the tagVersion of a SoftwareIdentity.

Type: boolean Default: false

Maps to the patch of a SoftwareIdentity.

Type: object

Specifies the metadata and content of the SWID tag.

No Additional Properties

Type: string Default: "text/plain"

Specifies the content type of the text. Defaults to text/plain if not specified.

Type: enum (of string)

Specifies the optional encoding the text is represented in.

Must be one of:

  • "base64"

Type: string

The attachment data. Proactive controls such as input validation and sanitization should be employed to prevent misuse of attachment text.

Type: stringFormat: iri-reference

The URL to the SWID file.

Type: boolean

[Deprecated] - DO NOT USE. This will be removed in a future version. Use the pedigree element instead to supply information on exactly how the component was modified. A boolean value indicating if the component has been modified from the original. A value of true indicates the component is a derivative of the original. A value of false indicates the component has not been modified from the original.

Type: object

Component pedigree is a way to document complex supply chain scenarios where components are created, distributed, modified, redistributed, combined with other components, etc. Pedigree supports viewing this complex chain from the beginning, the end, or anywhere in the middle. It also provides a way to document variants where the exact relation may not be known.

No Additional Properties

Type: array

Describes zero or more components in which a component is derived from. This is commonly used to describe forks from existing projects where the forked version contains a ancestor node containing the original component it was forked from. For example, Component A is the original component. Component B is the component being used and documented in the BOM. However, Component B contains a pedigree node with a single ancestor documenting Component A - the original component from which Component B is derived from.

No Additional Items

Each item of this array must be:

Type: object
Same definition as Component Object

Type: array

Descendants are the exact opposite of ancestors. This provides a way to document all forks (and their forks) of an original or root component.

No Additional Items

Each item of this array must be:

Type: object
Same definition as Component Object

Type: array

Variants describe relations where the relationship between the components are not known. For example, if Component A contains nearly identical code to Component B. They are both related, but it is unclear if one is derived from the other, or if they share a common ancestor.

No Additional Items

Each item of this array must be:

Type: object
Same definition as Component Object

Type: array

A list of zero or more commits which provide a trail describing how the component deviates from an ancestor, descendant, or variant.

No Additional Items

Each item of this array must be:

Type: object

Specifies an individual commit

No Additional Properties

Type: string

A unique identifier of the commit. This may be version control specific. For example, Subversion uses revision numbers whereas git uses commit hashes.

Type: stringFormat: iri-reference

The URL to the commit. This URL will typically point to a commit in a version control system.

Type: object

The author who created the changes in the commit

No Additional Properties

Type: stringFormat: date-time

The timestamp in which the action occurred

Type: string

The name of the individual who performed the action

Type: stringFormat: idn-email

The email address of the individual who performed the action

Type: object

The person who committed or pushed the commit

No Additional Properties

Type: stringFormat: date-time

The timestamp in which the action occurred

Type: string

The name of the individual who performed the action

Type: stringFormat: idn-email

The email address of the individual who performed the action

Type: string

The text description of the contents of the commit

Type: array

A list of zero or more patches describing how the component deviates from an ancestor, descendant, or variant. Patches may be complimentary to commits or may be used in place of commits.

No Additional Items

Each item of this array must be:

Type: object

Specifies an individual patch

No Additional Properties

Type: enum (of string)

Specifies the purpose for the patch including the resolution of defects, security issues, or new behavior or functionality.

Must be one of:

  • "unofficial"
  • "monkey"
  • "backport"
  • "cherry-pick"

Type: object

The patch file (or diff) that show changes. Refer to https://en.wikipedia.org/wiki/Diff

No Additional Properties

Type: object

Specifies the optional text of the diff

No Additional Properties

Type: string Default: "text/plain"

Specifies the content type of the text. Defaults to text/plain if not specified.

Type: enum (of string)

Specifies the optional encoding the text is represented in.

Must be one of:

  • "base64"

Type: string

The attachment data. Proactive controls such as input validation and sanitization should be employed to prevent misuse of attachment text.

Type: stringFormat: iri-reference

Specifies the URL to the diff

Type: array

A collection of issues the patch resolves

No Additional Items

Each item of this array must be:

Type: object

An individual issue that has been resolved.

No Additional Properties

Type: enum (of string)

Specifies the type of issue

Must be one of:

  • "defect"
  • "enhancement"
  • "security"

Type: string

The identifier of the issue assigned by the source of the issue

Type: string

The name of the issue

Type: string

A description of the issue

Type: object

The source of the issue where it is documented

No Additional Properties

Type: string

The name of the source. For example 'National Vulnerability Database', 'NVD', and 'Apache'

Type: stringFormat: iri-reference

The url of the issue documentation as provided by the source

Type: array of string

A collection of URL's for reference. Multiple URLs are allowed.

No Additional Items

Each item of this array must be:

Type: stringFormat: iri-reference

Example:

"https://example.com"

Type: string

Notes, observations, and other non-structured commentary describing the components pedigree.

Type: array

External references provide a way to document systems, sites, and information that may be relevant but which are not included with the BOM.

No Additional Items

Each item of this array must be:

Type: object

Specifies an individual external reference

No Additional Properties

Type: stringFormat: iri-reference

The URL to the external reference

Type: string

An optional comment describing the external reference

Type: enum (of string)

Specifies the type of external reference. There are built-in types to describe common references. If a type does not exist for the reference being referred to, use the "other" type.

Must be one of:

  • "vcs"
  • "issue-tracker"
  • "website"
  • "advisories"
  • "bom"
  • "mailing-list"
  • "social"
  • "chat"
  • "documentation"
  • "support"
  • "distribution"
  • "license"
  • "build-meta"
  • "build-system"
  • "release-notes"
  • "other"

Type: array

The hashes of the external reference (if applicable).

No Additional Items

Each item of this array must be:

Type: object
No Additional Properties

Type: enum (of string)

Must be one of:

  • "MD5"
  • "SHA-1"
  • "SHA-256"
  • "SHA-384"
  • "SHA-512"
  • "SHA3-256"
  • "SHA3-384"
  • "SHA3-512"
  • "BLAKE2b-256"
  • "BLAKE2b-384"
  • "BLAKE2b-512"
  • "BLAKE3"

Type: string
Must match regular expression: ^([a-fA-F0-9]{32}|[a-fA-F0-9]{40}|[a-fA-F0-9]{64}|[a-fA-F0-9]{96}|[a-fA-F0-9]{128})$
Example:

"3942447fac867ae5cdb3229b658f4d48"

Type: array

A list of software and hardware components included in the parent component. This is not a dependency tree. It provides a way to specify a hierarchical representation of component assemblies, similar to system → subsystem → parts assembly in physical supply chains.

All items must be unique

No Additional Items

Each item of this array must be:

Type: object
Same definition as Component Object

Type: object

Provides the ability to document evidence collected through various forms of extraction or analysis.

No Additional Properties

Type: array
No Additional Items

Each item of this array must be:

Type: object
No Additional Properties

Type: object

The following properties are required:

  • license
Type: object

The following properties are required:

  • expression

Type: object
No Additional Properties

Type: object

The following properties are required:

  • id
Type: object

The following properties are required:

  • name

Type: enum (of string)

A valid SPDX license ID

Must be one of:

NameDescription
"0BSD"

BSD Zero Clause License

"3D-Slicer-1.0"

3D Slicer License v1.0

"AAL"

Attribution Assurance License

"Abstyles"

Abstyles License

"AdaCore-doc"

AdaCore Doc License

"Adobe-2006"

Adobe Systems Incorporated Source Code License Agreement

"Adobe-Display-PostScript"

Adobe Display PostScript License

"Adobe-Glyph"

Adobe Glyph List License

"Adobe-Utopia"

Adobe Utopia Font License

"ADSL"

Amazon Digital Services License

"Advanced-Cryptics-Dictionary"

Advanced Cryptics Dictionary License

"AFL-1.1"

Academic Free License v1.1

"AFL-1.2"

Academic Free License v1.2

"AFL-2.0"

Academic Free License v2.0

"AFL-2.1"

Academic Free License v2.1

"AFL-3.0"

Academic Free License v3.0

"Afmparse"

Afmparse License

"AGPL-1.0"

Affero General Public License v1.0

"AGPL-1.0-only"

Affero General Public License v1.0 only

"AGPL-1.0-or-later"

Affero General Public License v1.0 or later

"AGPL-3.0"

GNU Affero General Public License v3.0

"AGPL-3.0-only"

GNU Affero General Public License v3.0 only

"AGPL-3.0-or-later"

GNU Affero General Public License v3.0 or later

"Aladdin"

Aladdin Free Public License

"ALGLIB-Documentation"

ALGLIB Documentation License

"AMD-newlib"

AMD newlib License

"AMDPLPA"

AMD's plpa_map.c License

"AML"

Apple MIT License

"AML-glslang"

AML glslang variant License

"AMPAS"

Academy of Motion Picture Arts and Sciences BSD

"ANTLR-PD"

ANTLR Software Rights Notice

"ANTLR-PD-fallback"

ANTLR Software Rights Notice with license fallback

"any-OSI"

Any OSI License

"any-OSI-perl-modules"

Any OSI License - Perl Modules

"Apache-1.0"

Apache License 1.0

"Apache-1.1"

Apache License 1.1

"Apache-2.0"

Apache License 2.0

"APAFML"

Adobe Postscript AFM License

"APL-1.0"

Adaptive Public License 1.0

"App-s2p"

App::s2p License

"APSL-1.0"

Apple Public Source License 1.0

"APSL-1.1"

Apple Public Source License 1.1

"APSL-1.2"

Apple Public Source License 1.2

"APSL-2.0"

Apple Public Source License 2.0

"Arphic-1999"

Arphic Public License

"Artistic-1.0"

Artistic License 1.0

"Artistic-1.0-cl8"

Artistic License 1.0 w/clause 8

"Artistic-1.0-Perl"

Artistic License 1.0 (Perl)

"Artistic-2.0"

Artistic License 2.0

"Artistic-dist"

Artistic License 1.0 (dist)

"Aspell-RU"

Aspell Russian License

"ASWF-Digital-Assets-1.0"

ASWF Digital Assets License version 1.0

"ASWF-Digital-Assets-1.1"

ASWF Digital Assets License 1.1

"Baekmuk"

Baekmuk License

"Bahyph"

Bahyph License

"Barr"

Barr License

"bcrypt-Solar-Designer"

bcrypt Solar Designer License

"Beerware"

Beerware License

"Bitstream-Charter"

Bitstream Charter Font License

"Bitstream-Vera"

Bitstream Vera Font License

"BitTorrent-1.0"

BitTorrent Open Source License v1.0

"BitTorrent-1.1"

BitTorrent Open Source License v1.1

"blessing"

SQLite Blessing

"BlueOak-1.0.0"

Blue Oak Model License 1.0.0

"Boehm-GC"

Boehm-Demers-Weiser GC License

"Boehm-GC-without-fee"

Boehm-Demers-Weiser GC License (without fee)

"BOLA-1.1"

Buena Onda License Agreement v1.1

"Borceux"

Borceux license

"Brian-Gladman-2-Clause"

Brian Gladman 2-Clause License

"Brian-Gladman-3-Clause"

Brian Gladman 3-Clause License

"BSD-1-Clause"

BSD 1-Clause License

"BSD-2-Clause"

BSD 2-Clause "Simplified" License

"BSD-2-Clause-Darwin"

BSD 2-Clause - Ian Darwin variant

"BSD-2-Clause-first-lines"

BSD 2-Clause - first lines requirement

"BSD-2-Clause-FreeBSD"

BSD 2-Clause FreeBSD License

"BSD-2-Clause-NetBSD"

BSD 2-Clause NetBSD License

"BSD-2-Clause-Patent"

BSD-2-Clause Plus Patent License

"BSD-2-Clause-pkgconf-disclaimer"

BSD 2-Clause pkgconf disclaimer variant

"BSD-2-Clause-Views"

BSD 2-Clause with views sentence

"BSD-3-Clause"

BSD 3-Clause "New" or "Revised" License

"BSD-3-Clause-acpica"

BSD 3-Clause acpica variant

"BSD-3-Clause-Attribution"

BSD with attribution

"BSD-3-Clause-Clear"

BSD 3-Clause Clear License

"BSD-3-Clause-flex"

BSD 3-Clause Flex variant

"BSD-3-Clause-HP"

Hewlett-Packard BSD variant license

"BSD-3-Clause-LBNL"

Lawrence Berkeley National Labs BSD variant license

"BSD-3-Clause-Modification"

BSD 3-Clause Modification

"BSD-3-Clause-No-Military-License"

BSD 3-Clause No Military License

"BSD-3-Clause-No-Nuclear-License"

BSD 3-Clause No Nuclear License

"BSD-3-Clause-No-Nuclear-License-2014"

BSD 3-Clause No Nuclear License 2014

"BSD-3-Clause-No-Nuclear-Warranty"

BSD 3-Clause No Nuclear Warranty

"BSD-3-Clause-Open-MPI"

BSD 3-Clause Open MPI variant

"BSD-3-Clause-Sun"

BSD 3-Clause Sun Microsystems

"BSD-3-Clause-Tso"

BSD 3-Clause Tso variant

"BSD-4-Clause"

BSD 4-Clause "Original" or "Old" License

"BSD-4-Clause-Shortened"

BSD 4 Clause Shortened

"BSD-4-Clause-UC"

BSD-4-Clause (University of California-Specific)

"BSD-4.3RENO"

BSD 4.3 RENO License

"BSD-4.3TAHOE"

BSD 4.3 TAHOE License

"BSD-Advertising-Acknowledgement"

BSD Advertising Acknowledgement License

"BSD-Attribution-HPND-disclaimer"

BSD with Attribution and HPND disclaimer

"BSD-Inferno-Nettverk"

BSD-Inferno-Nettverk

"BSD-Mark-Modifications"

BSD Mark Modifications License

"BSD-Protection"

BSD Protection License

"BSD-Source-beginning-file"

BSD Source Code Attribution - beginning of file variant

"BSD-Source-Code"

BSD Source Code Attribution

"BSD-Systemics"

Systemics BSD variant license

"BSD-Systemics-W3Works"

Systemics W3Works BSD variant license

"BSL-1.0"

Boost Software License 1.0

"Buddy"

Buddy License

"BUSL-1.1"

Business Source License 1.1

"bzip2-1.0.5"

bzip2 and libbzip2 License v1.0.5

"bzip2-1.0.6"

bzip2 and libbzip2 License v1.0.6

"C-UDA-1.0"

Computational Use of Data Agreement v1.0

"CAL-1.0"

Cryptographic Autonomy License 1.0

"CAL-1.0-Combined-Work-Exception"

Cryptographic Autonomy License 1.0 (Combined Work Exception)

"Caldera"

Caldera License

"Caldera-no-preamble"

Caldera License (without preamble)

"CAPEC-tou"

Common Attack Pattern Enumeration and Classification License

"Catharon"

Catharon License

"CATOSL-1.1"

Computer Associates Trusted Open Source License 1.1

"CC-BY-1.0"

Creative Commons Attribution 1.0 Generic

"CC-BY-2.0"

Creative Commons Attribution 2.0 Generic

"CC-BY-2.5"

Creative Commons Attribution 2.5 Generic

"CC-BY-2.5-AU"

Creative Commons Attribution 2.5 Australia

"CC-BY-3.0"

Creative Commons Attribution 3.0 Unported

"CC-BY-3.0-AT"

Creative Commons Attribution 3.0 Austria

"CC-BY-3.0-AU"

Creative Commons Attribution 3.0 Australia

"CC-BY-3.0-DE"

Creative Commons Attribution 3.0 Germany

"CC-BY-3.0-IGO"

Creative Commons Attribution 3.0 IGO

"CC-BY-3.0-NL"

Creative Commons Attribution 3.0 Netherlands

"CC-BY-3.0-US"

Creative Commons Attribution 3.0 United States

"CC-BY-4.0"

Creative Commons Attribution 4.0 International

"CC-BY-NC-1.0"

Creative Commons Attribution Non Commercial 1.0 Generic

"CC-BY-NC-2.0"

Creative Commons Attribution Non Commercial 2.0 Generic

"CC-BY-NC-2.5"

Creative Commons Attribution Non Commercial 2.5 Generic

"CC-BY-NC-3.0"

Creative Commons Attribution Non Commercial 3.0 Unported

"CC-BY-NC-3.0-DE"

Creative Commons Attribution Non Commercial 3.0 Germany

"CC-BY-NC-4.0"

Creative Commons Attribution Non Commercial 4.0 International

"CC-BY-NC-ND-1.0"

Creative Commons Attribution Non Commercial No Derivatives 1.0 Generic

"CC-BY-NC-ND-2.0"

Creative Commons Attribution Non Commercial No Derivatives 2.0 Generic

"CC-BY-NC-ND-2.5"

Creative Commons Attribution Non Commercial No Derivatives 2.5 Generic

"CC-BY-NC-ND-3.0"

Creative Commons Attribution Non Commercial No Derivatives 3.0 Unported

"CC-BY-NC-ND-3.0-DE"

Creative Commons Attribution Non Commercial No Derivatives 3.0 Germany

"CC-BY-NC-ND-3.0-IGO"

Creative Commons Attribution Non Commercial No Derivatives 3.0 IGO

"CC-BY-NC-ND-4.0"

Creative Commons Attribution Non Commercial No Derivatives 4.0 International

"CC-BY-NC-SA-1.0"

Creative Commons Attribution Non Commercial Share Alike 1.0 Generic

"CC-BY-NC-SA-2.0"

Creative Commons Attribution Non Commercial Share Alike 2.0 Generic

"CC-BY-NC-SA-2.0-DE"

Creative Commons Attribution Non Commercial Share Alike 2.0 Germany

"CC-BY-NC-SA-2.0-FR"

Creative Commons Attribution-NonCommercial-ShareAlike 2.0 France

"CC-BY-NC-SA-2.0-UK"

Creative Commons Attribution Non Commercial Share Alike 2.0 England and Wales

"CC-BY-NC-SA-2.5"

Creative Commons Attribution Non Commercial Share Alike 2.5 Generic

"CC-BY-NC-SA-3.0"

Creative Commons Attribution Non Commercial Share Alike 3.0 Unported

"CC-BY-NC-SA-3.0-DE"

Creative Commons Attribution Non Commercial Share Alike 3.0 Germany

"CC-BY-NC-SA-3.0-IGO"

Creative Commons Attribution Non Commercial Share Alike 3.0 IGO

"CC-BY-NC-SA-4.0"

Creative Commons Attribution Non Commercial Share Alike 4.0 International

"CC-BY-ND-1.0"

Creative Commons Attribution No Derivatives 1.0 Generic

"CC-BY-ND-2.0"

Creative Commons Attribution No Derivatives 2.0 Generic

"CC-BY-ND-2.5"

Creative Commons Attribution No Derivatives 2.5 Generic

"CC-BY-ND-3.0"

Creative Commons Attribution No Derivatives 3.0 Unported

"CC-BY-ND-3.0-DE"

Creative Commons Attribution No Derivatives 3.0 Germany

"CC-BY-ND-4.0"

Creative Commons Attribution No Derivatives 4.0 International

"CC-BY-SA-1.0"

Creative Commons Attribution Share Alike 1.0 Generic

"CC-BY-SA-2.0"

Creative Commons Attribution Share Alike 2.0 Generic

"CC-BY-SA-2.0-UK"

Creative Commons Attribution Share Alike 2.0 England and Wales

"CC-BY-SA-2.1-JP"

Creative Commons Attribution Share Alike 2.1 Japan

"CC-BY-SA-2.5"

Creative Commons Attribution Share Alike 2.5 Generic

"CC-BY-SA-3.0"

Creative Commons Attribution Share Alike 3.0 Unported

"CC-BY-SA-3.0-AT"

Creative Commons Attribution Share Alike 3.0 Austria

"CC-BY-SA-3.0-DE"

Creative Commons Attribution Share Alike 3.0 Germany

"CC-BY-SA-3.0-IGO"

Creative Commons Attribution-ShareAlike 3.0 IGO

"CC-BY-SA-4.0"

Creative Commons Attribution Share Alike 4.0 International

"CC-PDDC"

Creative Commons Public Domain Dedication and Certification

"CC-PDM-1.0"

Creative Commons Public Domain Mark 1.0 Universal

"CC-SA-1.0"

Creative Commons Share Alike 1.0 Generic

"CC0-1.0"

Creative Commons Zero v1.0 Universal

"CDDL-1.0"

Common Development and Distribution License 1.0

"CDDL-1.1"

Common Development and Distribution License 1.1

"CDL-1.0"

Common Documentation License 1.0

"CDLA-Permissive-1.0"

Community Data License Agreement Permissive 1.0

"CDLA-Permissive-2.0"

Community Data License Agreement Permissive 2.0

"CDLA-Sharing-1.0"

Community Data License Agreement Sharing 1.0

"CECILL-1.0"

CeCILL Free Software License Agreement v1.0

"CECILL-1.1"

CeCILL Free Software License Agreement v1.1

"CECILL-2.0"

CeCILL Free Software License Agreement v2.0

"CECILL-2.1"

CeCILL Free Software License Agreement v2.1

"CECILL-B"

CeCILL-B Free Software License Agreement

"CECILL-C"

CeCILL-C Free Software License Agreement

"CERN-OHL-1.1"

CERN Open Hardware Licence v1.1

"CERN-OHL-1.2"

CERN Open Hardware Licence v1.2

"CERN-OHL-P-2.0"

CERN Open Hardware Licence Version 2 - Permissive

"CERN-OHL-S-2.0"

CERN Open Hardware Licence Version 2 - Strongly Reciprocal

"CERN-OHL-W-2.0"

CERN Open Hardware Licence Version 2 - Weakly Reciprocal

"CFITSIO"

CFITSIO License

"check-cvs"

check-cvs License

"checkmk"

Checkmk License

"ClArtistic"

Clarified Artistic License

"Clips"

Clips License

"CMU-Mach"

CMU Mach License

"CMU-Mach-nodoc"

CMU Mach - no notices-in-documentation variant

"CNRI-Jython"

CNRI Jython License

"CNRI-Python"

CNRI Python License

"CNRI-Python-GPL-Compatible"

CNRI Python Open Source GPL Compatible License Agreement

"COIL-1.0"

Copyfree Open Innovation License

"Community-Spec-1.0"

Community Specification License 1.0

"Condor-1.1"

Condor Public License v1.1

"copyleft-next-0.3.0"

copyleft-next 0.3.0

"copyleft-next-0.3.1"

copyleft-next 0.3.1

"Cornell-Lossless-JPEG"

Cornell Lossless JPEG License

"CPAL-1.0"

Common Public Attribution License 1.0

"CPL-1.0"

Common Public License 1.0

"CPOL-1.02"

Code Project Open License 1.02

"Cronyx"

Cronyx License

"Crossword"

Crossword License

"CryptoSwift"

CryptoSwift License

"CrystalStacker"

CrystalStacker License

"CUA-OPL-1.0"

CUA Office Public License v1.0

"Cube"

Cube License

"curl"

curl License

"cve-tou"

Common Vulnerability Enumeration ToU License

"D-FSL-1.0"

Deutsche Freie Software Lizenz

"DEC-3-Clause"

DEC 3-Clause License

"diffmark"

diffmark license

"DL-DE-BY-2.0"

Data licence Germany – attribution – version 2.0

"DL-DE-ZERO-2.0"

Data licence Germany – zero – version 2.0

"DOC"

DOC License

"DocBook-DTD"

DocBook DTD License

"DocBook-Schema"

DocBook Schema License

"DocBook-Stylesheet"

DocBook Stylesheet License

"DocBook-XML"

DocBook XML License

"Dotseqn"

Dotseqn License

"DRL-1.0"

Detection Rule License 1.0

"DRL-1.1"

Detection Rule License 1.1

"DSDP"

DSDP License

"dtoa"

David M. Gay dtoa License

"dvipdfm"

dvipdfm License

"ECL-1.0"

Educational Community License v1.0

"ECL-2.0"

Educational Community License v2.0

"eCos-2.0"

eCos license version 2.0

"EFL-1.0"

Eiffel Forum License v1.0

"EFL-2.0"

Eiffel Forum License v2.0

"eGenix"

eGenix.com Public License 1.1.0

"Elastic-2.0"

Elastic License 2.0

"Entessa"

Entessa Public License v1.0

"EPICS"

EPICS Open License

"EPL-1.0"

Eclipse Public License 1.0

"EPL-2.0"

Eclipse Public License 2.0

"ErlPL-1.1"

Erlang Public License v1.1

"ESA-PL-permissive-2.4"

European Space Agency Public License – v2.4 – Permissive (Type 3)

"ESA-PL-strong-copyleft-2.4"

European Space Agency Public License (ESA-PL) - V2.4 - Strong Copyleft (Type 1)

"ESA-PL-weak-copyleft-2.4"

European Space Agency Public License – v2.4 – Weak Copyleft (Type 2)

"etalab-2.0"

Etalab Open License 2.0

"EUDatagrid"

EU DataGrid Software License

"EUPL-1.0"

European Union Public License 1.0

"EUPL-1.1"

European Union Public License 1.1

"EUPL-1.2"

European Union Public License 1.2

"Eurosym"

Eurosym License

"Fair"

Fair License

"FBM"

Fuzzy Bitmap License

"FDK-AAC"

Fraunhofer FDK AAC Codec Library

"Ferguson-Twofish"

Ferguson Twofish License

"Frameworx-1.0"

Frameworx Open License 1.0

"FreeBSD-DOC"

FreeBSD Documentation License

"FreeImage"

FreeImage Public License v1.0

"FSFAP"

FSF All Permissive License

"FSFAP-no-warranty-disclaimer"

FSF All Permissive License (without Warranty)

"FSFUL"

FSF Unlimited License

"FSFULLR"

FSF Unlimited License (with License Retention)

"FSFULLRSD"

FSF Unlimited License (with License Retention and Short Disclaimer)

"FSFULLRWD"

FSF Unlimited License (With License Retention and Warranty Disclaimer)

"FSL-1.1-ALv2"

Functional Source License, Version 1.1, ALv2 Future License

"FSL-1.1-MIT"

Functional Source License, Version 1.1, MIT Future License

"FTL"

Freetype Project License

"Furuseth"

Furuseth License

"fwlw"

fwlw License

"Game-Programming-Gems"

Game Programming Gems License

"GCR-docs"

Gnome GCR Documentation License

"GD"

GD License

"generic-xts"

Generic XTS License

"GFDL-1.1"

GNU Free Documentation License v1.1

"GFDL-1.1-invariants-only"

GNU Free Documentation License v1.1 only - invariants

"GFDL-1.1-invariants-or-later"

GNU Free Documentation License v1.1 or later - invariants

"GFDL-1.1-no-invariants-only"

GNU Free Documentation License v1.1 only - no invariants

"GFDL-1.1-no-invariants-or-later"

GNU Free Documentation License v1.1 or later - no invariants

"GFDL-1.1-only"

GNU Free Documentation License v1.1 only

"GFDL-1.1-or-later"

GNU Free Documentation License v1.1 or later

"GFDL-1.2"

GNU Free Documentation License v1.2

"GFDL-1.2-invariants-only"

GNU Free Documentation License v1.2 only - invariants

"GFDL-1.2-invariants-or-later"

GNU Free Documentation License v1.2 or later - invariants

"GFDL-1.2-no-invariants-only"

GNU Free Documentation License v1.2 only - no invariants

"GFDL-1.2-no-invariants-or-later"

GNU Free Documentation License v1.2 or later - no invariants

"GFDL-1.2-only"

GNU Free Documentation License v1.2 only

"GFDL-1.2-or-later"

GNU Free Documentation License v1.2 or later

"GFDL-1.3"

GNU Free Documentation License v1.3

"GFDL-1.3-invariants-only"

GNU Free Documentation License v1.3 only - invariants

"GFDL-1.3-invariants-or-later"

GNU Free Documentation License v1.3 or later - invariants

"GFDL-1.3-no-invariants-only"

GNU Free Documentation License v1.3 only - no invariants

"GFDL-1.3-no-invariants-or-later"

GNU Free Documentation License v1.3 or later - no invariants

"GFDL-1.3-only"

GNU Free Documentation License v1.3 only

"GFDL-1.3-or-later"

GNU Free Documentation License v1.3 or later

"Giftware"

Giftware License

"GL2PS"

GL2PS License

"Glide"

3dfx Glide License

"Glulxe"

Glulxe License

"GLWTPL"

Good Luck With That Public License

"gnuplot"

gnuplot License

"GPL-1.0"

GNU General Public License v1.0 only

"GPL-1.0+"

GNU General Public License v1.0 or later

"GPL-1.0-only"

GNU General Public License v1.0 only

"GPL-1.0-or-later"

GNU General Public License v1.0 or later

"GPL-2.0"

GNU General Public License v2.0 only

"GPL-2.0+"

GNU General Public License v2.0 or later

"GPL-2.0-only"

GNU General Public License v2.0 only

"GPL-2.0-or-later"

GNU General Public License v2.0 or later

"GPL-2.0-with-autoconf-exception"

GNU General Public License v2.0 w/Autoconf exception

"GPL-2.0-with-bison-exception"

GNU General Public License v2.0 w/Bison exception

"GPL-2.0-with-classpath-exception"

GNU General Public License v2.0 w/Classpath exception

"GPL-2.0-with-font-exception"

GNU General Public License v2.0 w/Font exception

"GPL-2.0-with-GCC-exception"

GNU General Public License v2.0 w/GCC Runtime Library exception

"GPL-3.0"

GNU General Public License v3.0 only

"GPL-3.0+"

GNU General Public License v3.0 or later

"GPL-3.0-only"

GNU General Public License v3.0 only

"GPL-3.0-or-later"

GNU General Public License v3.0 or later

"GPL-3.0-with-autoconf-exception"

GNU General Public License v3.0 w/Autoconf exception

"GPL-3.0-with-GCC-exception"

GNU General Public License v3.0 w/GCC Runtime Library exception

"Graphics-Gems"

Graphics Gems License

"gSOAP-1.3b"

gSOAP Public License v1.3b

"gtkbook"

gtkbook License

"Gutmann"

Gutmann License

"HaskellReport"

Haskell Language Report License

"HDF5"

HDF5 License

"hdparm"

hdparm License

"HIDAPI"

HIDAPI License

"Hippocratic-2.1"

Hippocratic License 2.1

"HP-1986"

Hewlett-Packard 1986 License

"HP-1989"

Hewlett-Packard 1989 License

"HPND"

Historical Permission Notice and Disclaimer

"HPND-DEC"

Historical Permission Notice and Disclaimer - DEC variant

"HPND-doc"

Historical Permission Notice and Disclaimer - documentation variant

"HPND-doc-sell"

Historical Permission Notice and Disclaimer - documentation sell variant

"HPND-export-US"

HPND with US Government export control warning

"HPND-export-US-acknowledgement"

HPND with US Government export control warning and acknowledgment

"HPND-export-US-modify"

HPND with US Government export control warning and modification rqmt

"HPND-export2-US"

HPND with US Government export control and 2 disclaimers

"HPND-Fenneberg-Livingston"

Historical Permission Notice and Disclaimer - Fenneberg-Livingston variant

"HPND-INRIA-IMAG"

Historical Permission Notice and Disclaimer - INRIA-IMAG variant

"HPND-Intel"

Historical Permission Notice and Disclaimer - Intel variant

"HPND-Kevlin-Henney"

Historical Permission Notice and Disclaimer - Kevlin Henney variant

"HPND-Markus-Kuhn"

Historical Permission Notice and Disclaimer - Markus Kuhn variant

"HPND-merchantability-variant"

Historical Permission Notice and Disclaimer - merchantability variant

"HPND-MIT-disclaimer"

Historical Permission Notice and Disclaimer with MIT disclaimer

"HPND-Netrek"

Historical Permission Notice and Disclaimer - Netrek variant

"HPND-Pbmplus"

Historical Permission Notice and Disclaimer - Pbmplus variant

"HPND-sell-MIT-disclaimer-xserver"

Historical Permission Notice and Disclaimer - sell xserver variant with MIT disclaimer

"HPND-sell-regexpr"

Historical Permission Notice and Disclaimer - sell regexpr variant

"HPND-sell-variant"

Historical Permission Notice and Disclaimer - sell variant

"HPND-sell-variant-critical-systems"

HPND - sell variant with safety critical systems clause

"HPND-sell-variant-MIT-disclaimer"

HPND sell variant with MIT disclaimer

"HPND-sell-variant-MIT-disclaimer-rev"

HPND sell variant with MIT disclaimer - reverse

"HPND-SMC"

Historical Permission Notice and Disclaimer - SMC variant

"HPND-UC"

Historical Permission Notice and Disclaimer - University of California variant

"HPND-UC-export-US"

Historical Permission Notice and Disclaimer - University of California, US export warning

"HTMLTIDY"

HTML Tidy License

"hyphen-bulgarian"

hyphen-bulgarian License

"IBM-pibs"

IBM PowerPC Initialization and Boot Software

"ICU"

ICU License

"IEC-Code-Components-EULA"

IEC Code Components End-user licence agreement

"IJG"

Independent JPEG Group License

"IJG-short"

Independent JPEG Group License - short

"ImageMagick"

ImageMagick License

"iMatix"

iMatix Standard Function Library Agreement

"Imlib2"

Imlib2 License

"Info-ZIP"

Info-ZIP License

"Inner-Net-2.0"

Inner Net License v2.0

"InnoSetup"

Inno Setup License

"Intel"

Intel Open Source License

"Intel-ACPI"

Intel ACPI Software License Agreement

"Interbase-1.0"

Interbase Public License v1.0

"IPA"

IPA Font License

"IPL-1.0"

IBM Public License v1.0

"ISC"

ISC License

"ISC-Veillard"

ISC Veillard variant

"ISO-permission"

ISO permission notice

"Jam"

Jam License

"JasPer-2.0"

JasPer License

"jove"

Jove License

"JPL-image"

JPL Image Use Policy

"JPNIC"

Japan Network Information Center License

"JSON"

JSON License

"Kastrup"

Kastrup License

"Kazlib"

Kazlib License

"Knuth-CTAN"

Knuth CTAN License

"LAL-1.2"

Licence Art Libre 1.2

"LAL-1.3"

Licence Art Libre 1.3

"Latex2e"

Latex2e License

"Latex2e-translated-notice"

Latex2e with translated notice permission

"Leptonica"

Leptonica License

"LGPL-2.0"

GNU Library General Public License v2 only

"LGPL-2.0+"

GNU Library General Public License v2 or later

"LGPL-2.0-only"

GNU Library General Public License v2 only

"LGPL-2.0-or-later"

GNU Library General Public License v2 or later

"LGPL-2.1"

GNU Lesser General Public License v2.1 only

"LGPL-2.1+"

GNU Lesser General Public License v2.1 or later

"LGPL-2.1-only"

GNU Lesser General Public License v2.1 only

"LGPL-2.1-or-later"

GNU Lesser General Public License v2.1 or later

"LGPL-3.0"

GNU Lesser General Public License v3.0 only

"LGPL-3.0+"

GNU Lesser General Public License v3.0 or later

"LGPL-3.0-only"

GNU Lesser General Public License v3.0 only

"LGPL-3.0-or-later"

GNU Lesser General Public License v3.0 or later

"LGPLLR"

Lesser General Public License For Linguistic Resources

"Libpng"

libpng License

"libpng-1.6.35"

PNG Reference Library License v1 (for libpng 0.5 through 1.6.35)

"libpng-2.0"

PNG Reference Library version 2

"libselinux-1.0"

libselinux public domain notice

"libtiff"

libtiff License

"libutil-David-Nugent"

libutil David Nugent License

"LiLiQ-P-1.1"

Licence Libre du Québec – Permissive version 1.1

"LiLiQ-R-1.1"

Licence Libre du Québec – Réciprocité version 1.1

"LiLiQ-Rplus-1.1"

Licence Libre du Québec – Réciprocité forte version 1.1

"Linux-man-pages-1-para"

Linux man-pages - 1 paragraph

"Linux-man-pages-copyleft"

Linux man-pages Copyleft

"Linux-man-pages-copyleft-2-para"

Linux man-pages Copyleft - 2 paragraphs

"Linux-man-pages-copyleft-var"

Linux man-pages Copyleft Variant

"Linux-OpenIB"

Linux Kernel Variant of OpenIB.org license

"LOOP"

Common Lisp LOOP License

"LPD-document"

LPD Documentation License

"LPL-1.0"

Lucent Public License Version 1.0

"LPL-1.02"

Lucent Public License v1.02

"LPPL-1.0"

LaTeX Project Public License v1.0

"LPPL-1.1"

LaTeX Project Public License v1.1

"LPPL-1.2"

LaTeX Project Public License v1.2

"LPPL-1.3a"

LaTeX Project Public License v1.3a

"LPPL-1.3c"

LaTeX Project Public License v1.3c

"lsof"

lsof License

"Lucida-Bitmap-Fonts"

Lucida Bitmap Fonts License

"LZMA-SDK-9.11-to-9.20"

LZMA SDK License (versions 9.11 to 9.20)

"LZMA-SDK-9.22"

LZMA SDK License (versions 9.22 and beyond)

"Mackerras-3-Clause"

Mackerras 3-Clause License

"Mackerras-3-Clause-acknowledgment"

Mackerras 3-Clause - acknowledgment variant

"magaz"

magaz License

"mailprio"

mailprio License

"MakeIndex"

MakeIndex License

"man2html"

man2html License

"Martin-Birgmeier"

Martin Birgmeier License

"McPhee-slideshow"

McPhee Slideshow License

"metamail"

metamail License

"Minpack"

Minpack License

"MIPS"

MIPS License

"MirOS"

The MirOS Licence

"MIT"

MIT License

"MIT-0"

MIT No Attribution

"MIT-advertising"

Enlightenment License (e16)

"MIT-Click"

MIT Click License

"MIT-CMU"

CMU License

"MIT-enna"

enna License

"MIT-feh"

feh License

"MIT-Festival"

MIT Festival Variant

"MIT-Khronos-old"

MIT Khronos - old variant

"MIT-Modern-Variant"

MIT License Modern Variant

"MIT-open-group"

MIT Open Group variant

"MIT-STK"

MIT-STK License

"MIT-testregex"

MIT testregex Variant

"MIT-Wu"

MIT Tom Wu Variant

"MITNFA"

MIT +no-false-attribs license

"MMIXware"

MMIXware License

"MMPL-1.0.1"

Minecraft Mod Public License v1.0.1

"Motosoto"

Motosoto License

"MPEG-SSG"

MPEG Software Simulation

"mpi-permissive"

mpi Permissive License

"mpich2"

mpich2 License

"MPL-1.0"

Mozilla Public License 1.0

"MPL-1.1"

Mozilla Public License 1.1

"MPL-2.0"

Mozilla Public License 2.0

"MPL-2.0-no-copyleft-exception"

Mozilla Public License 2.0 (no copyleft exception)

"mplus"

mplus Font License

"MS-LPL"

Microsoft Limited Public License

"MS-PL"

Microsoft Public License

"MS-RL"

Microsoft Reciprocal License

"MTLL"

Matrix Template Library License

"MulanPSL-1.0"

Mulan Permissive Software License, Version 1

"MulanPSL-2.0"

Mulan Permissive Software License, Version 2

"Multics"

Multics License

"Mup"

Mup License

"NAIST-2003"

Nara Institute of Science and Technology License (2003)

"NASA-1.3"

NASA Open Source Agreement 1.3

"Naumen"

Naumen Public License

"NBPL-1.0"

Net Boolean Public License v1

"NCBI-PD"

NCBI Public Domain Notice

"NCGL-UK-2.0"

Non-Commercial Government Licence

"NCL"

NCL Source Code License

"NCSA"

University of Illinois/NCSA Open Source License

"Net-SNMP"

Net-SNMP License

"NetCDF"

NetCDF license

"Newsletr"

Newsletr License

"NGPL"

Nethack General Public License

"ngrep"

ngrep License

"NICTA-1.0"

NICTA Public Software License, Version 1.0

"NIST-PD"

NIST Public Domain Notice

"NIST-PD-fallback"

NIST Public Domain Notice with license fallback

"NIST-PD-TNT"

NIST Public Domain Notice TNT variant

"NIST-Software"

NIST Software License

"NLOD-1.0"

Norwegian Licence for Open Government Data (NLOD) 1.0

"NLOD-2.0"

Norwegian Licence for Open Government Data (NLOD) 2.0

"NLPL"

No Limit Public License

"Nokia"

Nokia Open Source License

"NOSL"

Netizen Open Source License

"Noweb"

Noweb License

"NPL-1.0"

Netscape Public License v1.0

"NPL-1.1"

Netscape Public License v1.1

"NPOSL-3.0"

Non-Profit Open Software License 3.0

"NRL"

NRL License

"NTIA-PD"

NTIA Public Domain Notice

"NTP"

NTP License

"NTP-0"

NTP No Attribution

"Nunit"

Nunit License

"O-UDA-1.0"

Open Use of Data Agreement v1.0

"OAR"

OAR License

"OCCT-PL"

Open CASCADE Technology Public License

"OCLC-2.0"

OCLC Research Public License 2.0

"ODbL-1.0"

Open Data Commons Open Database License v1.0

"ODC-By-1.0"

Open Data Commons Attribution License v1.0

"OFFIS"

OFFIS License

"OFL-1.0"

SIL Open Font License 1.0

"OFL-1.0-no-RFN"

SIL Open Font License 1.0 with no Reserved Font Name

"OFL-1.0-RFN"

SIL Open Font License 1.0 with Reserved Font Name

"OFL-1.1"

SIL Open Font License 1.1

"OFL-1.1-no-RFN"

SIL Open Font License 1.1 with no Reserved Font Name

"OFL-1.1-RFN"

SIL Open Font License 1.1 with Reserved Font Name

"OGC-1.0"

OGC Software License, Version 1.0

"OGDL-Taiwan-1.0"

Taiwan Open Government Data License, version 1.0

"OGL-Canada-2.0"

Open Government Licence - Canada

"OGL-UK-1.0"

Open Government Licence v1.0

"OGL-UK-2.0"

Open Government Licence v2.0

"OGL-UK-3.0"

Open Government Licence v3.0

"OGTSL"

Open Group Test Suite License

"OLDAP-1.1"

Open LDAP Public License v1.1

"OLDAP-1.2"

Open LDAP Public License v1.2

"OLDAP-1.3"

Open LDAP Public License v1.3

"OLDAP-1.4"

Open LDAP Public License v1.4

"OLDAP-2.0"

Open LDAP Public License v2.0 (or possibly 2.0A and 2.0B)

"OLDAP-2.0.1"

Open LDAP Public License v2.0.1

"OLDAP-2.1"

Open LDAP Public License v2.1

"OLDAP-2.2"

Open LDAP Public License v2.2

"OLDAP-2.2.1"

Open LDAP Public License v2.2.1

"OLDAP-2.2.2"

Open LDAP Public License 2.2.2

"OLDAP-2.3"

Open LDAP Public License v2.3

"OLDAP-2.4"

Open LDAP Public License v2.4

"OLDAP-2.5"

Open LDAP Public License v2.5

"OLDAP-2.6"

Open LDAP Public License v2.6

"OLDAP-2.7"

Open LDAP Public License v2.7

"OLDAP-2.8"

Open LDAP Public License v2.8

"OLFL-1.3"

Open Logistics Foundation License Version 1.3

"OML"

Open Market License

"OpenMDW-1.0"

OpenMDW License Agreement v1.0

"OpenPBS-2.3"

OpenPBS v2.3 Software License

"OpenSSL"

OpenSSL License

"OpenSSL-standalone"

OpenSSL License - standalone

"OpenVision"

OpenVision License

"OPL-1.0"

Open Public License v1.0

"OPL-UK-3.0"

United Kingdom Open Parliament Licence v3.0

"OPUBL-1.0"

Open Publication License v1.0

"OSC-1.0"

OSC License 1.0

"OSET-PL-2.1"

OSET Public License version 2.1

"OSL-1.0"

Open Software License 1.0

"OSL-1.1"

Open Software License 1.1

"OSL-2.0"

Open Software License 2.0

"OSL-2.1"

Open Software License 2.1

"OSL-3.0"

Open Software License 3.0

"OSSP"

OSSP License

"PADL"

PADL License

"ParaType-Free-Font-1.3"

ParaType Free Font Licensing Agreement v1.3

"Parity-6.0.0"

The Parity Public License 6.0.0

"Parity-7.0.0"

The Parity Public License 7.0.0

"PDDL-1.0"

Open Data Commons Public Domain Dedication & License 1.0

"PHP-3.0"

PHP License v3.0

"PHP-3.01"

PHP License v3.01

"Pixar"

Pixar License

"pkgconf"

pkgconf License

"Plexus"

Plexus Classworlds License

"pnmstitch"

pnmstitch License

"PolyForm-Noncommercial-1.0.0"

PolyForm Noncommercial License 1.0.0

"PolyForm-Small-Business-1.0.0"

PolyForm Small Business License 1.0.0

"PostgreSQL"

PostgreSQL License

"PPL"

Peer Production License

"PSF-2.0"

Python Software Foundation License 2.0

"psfrag"

psfrag License

"psutils"

psutils License

"Python-2.0"

Python License 2.0

"Python-2.0.1"

Python License 2.0.1

"python-ldap"

Python ldap License

"Qhull"

Qhull License

"QPL-1.0"

Q Public License 1.0

"QPL-1.0-INRIA-2004"

Q Public License 1.0 - INRIA 2004 variant

"radvd"

radvd License

"Rdisc"

Rdisc License

"RHeCos-1.1"

Red Hat eCos Public License v1.1

"RPL-1.1"

Reciprocal Public License 1.1

"RPL-1.5"

Reciprocal Public License 1.5

"RPSL-1.0"

RealNetworks Public Source License v1.0

"RSA-MD"

RSA Message-Digest License

"RSCPL"

Ricoh Source Code Public License

"Ruby"

Ruby License

"Ruby-pty"

Ruby pty extension license

"SAX-PD"

Sax Public Domain Notice

"SAX-PD-2.0"

Sax Public Domain Notice 2.0

"Saxpath"

Saxpath License

"SCEA"

SCEA Shared Source License

"SchemeReport"

Scheme Language Report License

"Sendmail"

Sendmail License

"Sendmail-8.23"

Sendmail License 8.23

"Sendmail-Open-Source-1.1"

Sendmail Open Source License v1.1

"SGI-B-1.0"

SGI Free Software License B v1.0

"SGI-B-1.1"

SGI Free Software License B v1.1

"SGI-B-2.0"

SGI Free Software License B v2.0

"SGI-OpenGL"

SGI OpenGL License

"SGMLUG-PM"

SGMLUG Parser Materials License

"SGP4"

SGP4 Permission Notice

"SHL-0.5"

Solderpad Hardware License v0.5

"SHL-0.51"

Solderpad Hardware License, Version 0.51

"SimPL-2.0"

Simple Public License 2.0

"SISSL"

Sun Industry Standards Source License v1.1

"SISSL-1.2"

Sun Industry Standards Source License v1.2

"SL"

SL License

"Sleepycat"

Sleepycat License

"SMAIL-GPL"

SMAIL General Public License

"SMLNJ"

Standard ML of New Jersey License

"SMPPL"

Secure Messaging Protocol Public License

"SNIA"

SNIA Public License 1.1

"snprintf"

snprintf License

"SOFA"

SOFA Software License

"softSurfer"

softSurfer License

"Soundex"

Soundex License

"Spencer-86"

Spencer License 86

"Spencer-94"

Spencer License 94

"Spencer-99"

Spencer License 99

"SPL-1.0"

Sun Public License v1.0

"ssh-keyscan"

ssh-keyscan License

"SSH-OpenSSH"

SSH OpenSSH license

"SSH-short"

SSH short notice

"SSLeay-standalone"

SSLeay License - standalone

"SSPL-1.0"

Server Side Public License, v 1

"StandardML-NJ"

Standard ML of New Jersey License

"SugarCRM-1.1.3"

SugarCRM Public License v1.1.3

"SUL-1.0"

Sustainable Use License v1.0

"Sun-PPP"

Sun PPP License

"Sun-PPP-2000"

Sun PPP License (2000)

"SunPro"

SunPro License

"SWL"

Scheme Widget Library (SWL) Software License Agreement

"swrule"

swrule License

"Symlinks"

Symlinks License

"TAPR-OHL-1.0"

TAPR Open Hardware License v1.0

"TCL"

TCL/TK License

"TCP-wrappers"

TCP Wrappers License

"TekHVC"

TekHVC License

"TermReadKey"

TermReadKey License

"TGPPL-1.0"

Transitive Grace Period Public Licence 1.0

"ThirdEye"

ThirdEye License

"threeparttable"

threeparttable License

"TMate"

TMate Open Source License

"TORQUE-1.1"

TORQUE v2.5+ Software License v1.1

"TOSL"

Trusster Open Source License

"TPDL"

Time::ParseDate License

"TPL-1.0"

THOR Public License 1.0

"TrustedQSL"

TrustedQSL License

"TTWL"

Text-Tabs+Wrap License

"TTYP0"

TTYP0 License

"TU-Berlin-1.0"

Technische Universitaet Berlin License 1.0

"TU-Berlin-2.0"

Technische Universitaet Berlin License 2.0

"Ubuntu-font-1.0"

Ubuntu Font Licence v1.0

"UCAR"

UCAR License

"UCL-1.0"

Upstream Compatibility License v1.0

"ulem"

ulem License

"UMich-Merit"

Michigan/Merit Networks License

"Unicode-3.0"

Unicode License v3

"Unicode-DFS-2015"

Unicode License Agreement - Data Files and Software (2015)

"Unicode-DFS-2016"

Unicode License Agreement - Data Files and Software (2016)

"Unicode-TOU"

Unicode Terms of Use

"UnixCrypt"

UnixCrypt License

"Unlicense"

The Unlicense

"Unlicense-libtelnet"

Unlicense - libtelnet variant

"Unlicense-libwhirlpool"

Unlicense - libwhirlpool variant

"UnRAR"

UnRAR License

"UPL-1.0"

Universal Permissive License v1.0

"URT-RLE"

Utah Raster Toolkit Run Length Encoded License

"Vim"

Vim License

"Vixie-Cron"

Vixie Cron License

"VOSTROM"

VOSTROM Public License for Open Source

"VSL-1.0"

Vovida Software License v1.0

"W3C"

W3C Software Notice and License (2002-12-31)

"W3C-19980720"

W3C Software Notice and License (1998-07-20)

"W3C-20150513"

W3C Software Notice and Document License (2015-05-13)

"w3m"

w3m License

"Watcom-1.0"

Sybase Open Watcom Public License 1.0

"Widget-Workshop"

Widget Workshop License

"WordNet"

WordNet License

"Wsuipa"

Wsuipa License

"WTFNMFPL"

Do What The F*ck You Want To But It's Not My Fault Public License

"WTFPL"

Do What The F*ck You Want To Public License

"wwl"

WWL License

"wxWindows"

wxWindows Library License

"X11"

X11 License

"X11-distribute-modifications-variant"

X11 License Distribution Modification Variant

"X11-no-permit-persons"

X11 no permit persons clause

"X11-swapped"

X11 swapped final paragraphs

"Xdebug-1.03"

Xdebug License v 1.03

"Xerox"

Xerox License

"Xfig"

Xfig License

"XFree86-1.1"

XFree86 License 1.1

"xinetd"

xinetd License

"xkeyboard-config-Zinoviev"

xkeyboard-config Zinoviev License

"xlock"

xlock License

"Xnet"

X.Net License

"xpp"

XPP License

"XSkat"

XSkat License

"xzoom"

xzoom License

"YPL-1.0"

Yahoo! Public License v1.0

"YPL-1.1"

Yahoo! Public License v1.1

"Zed"

Zed License

"Zeeff"

Zeeff License

"Zend-2.0"

Zend License v2.0

"Zimbra-1.3"

Zimbra Public License v1.3

"Zimbra-1.4"

Zimbra Public License v1.4

"Zlib"

zlib License

"zlib-acknowledgement"

zlib/libpng License with Acknowledgement

"ZPL-1.1"

Zope Public License 1.1

"ZPL-2.0"

Zope Public License 2.0

"ZPL-2.1"

Zope Public License 2.1

"389-exception"

389 Directory Server Exception

"Asterisk-exception"

Asterisk exception

"Asterisk-linking-protocols-exception"

Asterisk linking protocols exception

"Autoconf-exception-2.0"

Autoconf exception 2.0

"Autoconf-exception-3.0"

Autoconf exception 3.0

"Autoconf-exception-generic"

Autoconf generic exception

"Autoconf-exception-generic-3.0"

Autoconf generic exception for GPL-3.0

"Autoconf-exception-macro"

Autoconf macro exception

"Bison-exception-1.24"

Bison exception 1.24

"Bison-exception-2.2"

Bison exception 2.2

"Bootloader-exception"

Bootloader Distribution Exception

"CGAL-linking-exception"

CGAL Linking Exception

"Classpath-exception-2.0"

Classpath exception 2.0

"Classpath-exception-2.0-short"

Classpath exception 2.0 - short

"CLISP-exception-2.0"

CLISP exception 2.0

"cryptsetup-OpenSSL-exception"

cryptsetup OpenSSL exception

"Digia-Qt-LGPL-exception-1.1"

Digia Qt LGPL Exception version 1.1

"DigiRule-FOSS-exception"

DigiRule FOSS License Exception

"eCos-exception-2.0"

eCos exception 2.0

"erlang-otp-linking-exception"

Erlang/OTP Linking Exception

"Fawkes-Runtime-exception"

Fawkes Runtime Exception

"FLTK-exception"

FLTK exception

"fmt-exception"

fmt exception

"Font-exception-2.0"

Font exception 2.0

"freertos-exception-2.0"

FreeRTOS Exception 2.0

"GCC-exception-2.0"

GCC Runtime Library exception 2.0

"GCC-exception-2.0-note"

GCC Runtime Library exception 2.0 - note variant

"GCC-exception-3.1"

GCC Runtime Library exception 3.1

"Gmsh-exception"

Gmsh exception

"GNAT-exception"

GNAT exception

"GNOME-examples-exception"

GNOME examples exception

"GNU-compiler-exception"

GNU Compiler Exception

"gnu-javamail-exception"

GNU JavaMail exception

"GPL-3.0-389-ds-base-exception"

GPL-3.0 389 DS Base Exception

"GPL-3.0-interface-exception"

GPL-3.0 Interface Exception

"GPL-3.0-linking-exception"

GPL-3.0 Linking Exception

"GPL-3.0-linking-source-exception"

GPL-3.0 Linking Exception (with Corresponding Source)

"GPL-CC-1.0"

GPL Cooperation Commitment 1.0

"GStreamer-exception-2005"

GStreamer Exception (2005)

"GStreamer-exception-2008"

GStreamer Exception (2008)

"harbour-exception"

harbour exception

"i2p-gpl-java-exception"

i2p GPL+Java Exception

"Independent-modules-exception"

Independent Module Linking exception

"KiCad-libraries-exception"

KiCad Libraries Exception

"kvirc-openssl-exception"

kvirc OpenSSL Exception

"LGPL-3.0-linking-exception"

LGPL-3.0 Linking Exception

"libpri-OpenH323-exception"

libpri OpenH323 exception

"Libtool-exception"

Libtool Exception

"Linux-syscall-note"

Linux Syscall Note

"LLGPL"

LLGPL Preamble

"LLVM-exception"

LLVM Exception

"LZMA-exception"

LZMA exception

"mif-exception"

Macros and Inline Functions Exception

"mxml-exception"

mxml Exception

"Nokia-Qt-exception-1.1"

Nokia Qt LGPL exception 1.1

"OCaml-LGPL-linking-exception"

OCaml LGPL Linking Exception

"OCCT-exception-1.0"

Open CASCADE Exception 1.0

"OpenJDK-assembly-exception-1.0"

OpenJDK Assembly exception 1.0

"openvpn-openssl-exception"

OpenVPN OpenSSL Exception

"PCRE2-exception"

PCRE2 exception

"polyparse-exception"

Polyparse Exception

"PS-or-PDF-font-exception-20170817"

PS/PDF font exception (2017-08-17)

"QPL-1.0-INRIA-2004-exception"

INRIA QPL 1.0 2004 variant exception

"Qt-GPL-exception-1.0"

Qt GPL exception 1.0

"Qt-LGPL-exception-1.1"

Qt LGPL exception 1.1

"Qwt-exception-1.0"

Qwt exception 1.0

"romic-exception"

Romic Exception

"RRDtool-FLOSS-exception-2.0"

RRDtool FLOSS exception 2.0

"rsync-linking-exception"

rsync Linking Exception

"SANE-exception"

SANE Exception

"SHL-2.0"

Solderpad Hardware License v2.0

"SHL-2.1"

Solderpad Hardware License v2.1

"Simple-Library-Usage-exception"

Simple Library Usage Exception

"sqlitestudio-OpenSSL-exception"

sqlitestudio OpenSSL exception

"stunnel-exception"

stunnel Exception

"SWI-exception"

SWI exception

"Swift-exception"

Swift Exception

"Texinfo-exception"

Texinfo exception

"u-boot-exception-2.0"

U-Boot exception 2.0

"UBDL-exception"

Unmodified Binary Distribution exception

"Universal-FOSS-exception-1.0"

Universal FOSS Exception, Version 1.0

"vsftpd-openssl-exception"

vsftpd OpenSSL exception

"WxWindows-exception-3.1"

WxWindows Library Exception 3.1

"x11vnc-openssl-exception"

x11vnc OpenSSL Exception


Example:

"Apache-2.0"

Type: string

If SPDX does not define the license used, this field may be used to provide the license name


Example:

"Acme Software License"

Type: object

An optional way to include the textual content of a license.

No Additional Properties

Type: string Default: "text/plain"

Specifies the content type of the text. Defaults to text/plain if not specified.

Type: enum (of string)

Specifies the optional encoding the text is represented in.

Must be one of:

  • "base64"

Type: string

The attachment data. Proactive controls such as input validation and sanitization should be employed to prevent misuse of attachment text.

Type: stringFormat: iri-reference

The URL to the license file. If specified, a 'license' externalReference should also be specified for completeness


Example:

"https://www.apache.org/licenses/LICENSE-2.0.txt"

Type: string

Examples:

"Apache-2.0 AND (MIT OR GPL-2.0-only)"

"GPL-3.0-only WITH Classpath-exception-2.0"

Type: object

Specifies optional release notes.

No Additional Properties

Type: string

The software versioning type the release note describes.


Examples:

"major"

"minor"

"patch"

"pre-release"

"internal"

Type: string

The title of the release.

Type: stringFormat: iri-reference

The URL to an image that may be prominently displayed with the release note.

Type: stringFormat: iri-reference

The URL to an image that may be used in messaging on social media platforms.

Type: string

A short description of the release.

Type: stringFormat: date-time

The date and time (timestamp) when the release note was created.

Type: array of string

One or more alternate names the release may be referred to. This may include unofficial terms used by development and marketing teams (e.g. code names).

No Additional Items

Each item of this array must be:

Type: string

Type: array of string

One or more tags that may aid in search or retrieval of the release note.

No Additional Items

Each item of this array must be:

Type: string

Type: array

A collection of issues that have been resolved.

No Additional Items

Each item of this array must be:

Type: object

An individual issue that has been resolved.

No Additional Properties

Type: enum (of string)

Specifies the type of issue

Must be one of:

  • "defect"
  • "enhancement"
  • "security"

Type: string

The identifier of the issue assigned by the source of the issue

Type: string

The name of the issue

Type: string

A description of the issue

Type: object

The source of the issue where it is documented

No Additional Properties

Type: string

The name of the source. For example 'National Vulnerability Database', 'NVD', and 'Apache'

Type: stringFormat: iri-reference

The url of the issue documentation as provided by the source

Type: array of string

A collection of URL's for reference. Multiple URLs are allowed.

No Additional Items

Each item of this array must be:

Type: stringFormat: iri-reference

Example:

"https://example.com"

Type: array

Zero or more release notes containing the locale and content. Multiple note objects may be specified to support release notes in a wide variety of languages.

No Additional Items

Each item of this array must be:

Type: object

A note containing the locale and content.

No Additional Properties

Type: string

The ISO-639 (or higher) language code and optional ISO-3166 (or higher) country code. Examples include: "en", "en-US", "fr" and "fr-CA"

Must match regular expression: ^([a-z]{2})(-[A-Z]{2})?$

Type: object

Specifies the full content of the release note.

No Additional Properties

Type: string Default: "text/plain"

Specifies the content type of the text. Defaults to text/plain if not specified.

Type: enum (of string)

Specifies the optional encoding the text is represented in.

Must be one of:

  • "base64"

Type: string

The attachment data. Proactive controls such as input validation and sanitization should be employed to prevent misuse of attachment text.

Type: array

Provides the ability to document properties in a name-value store. This provides flexibility to include data not officially supported in the standard without having to use additional namespaces or create extensions. Unlike key-value stores, properties support duplicate names, each potentially having different values. Property names of interest to the general public are encouraged to be registered in the CycloneDX Property Taxonomy. Formal registration is OPTIONAL.

No Additional Items

Each item of this array must be:

Type: object

Type: string

The name of the property. Duplicate names are allowed, each potentially having a different value.

Type: string

The value of the property.

Type: array

Provides the ability to document properties in a name-value store. This provides flexibility to include data not officially supported in the standard without having to use additional namespaces or create extensions. Unlike key-value stores, properties support duplicate names, each potentially having different values. Property names of interest to the general public are encouraged to be registered in the CycloneDX Property Taxonomy. Formal registration is OPTIONAL.

No Additional Items

Each item of this array must be:

Type: object

Type: string

The name of the property. Duplicate names are allowed, each potentially having a different value.

Type: string

The value of the property.

Type: object

Enveloped signature in JSON Signature Format (JSF).

Type: object
No Additional Properties

Type: array

Unique top level property for Multiple Signatures. (multisignature)

No Additional Items

Each item of this array must be:

Type: object
No Additional Properties


Type: enum (of string)

Signature algorithm. The currently recognized JWA [RFC7518] and RFC8037 [RFC8037] asymmetric key algorithms. Note: Unlike RFC8037 [RFC8037] JSF requires explicit Ed* algorithm names instead of "EdDSA".

Must be one of:

  • "RS256"
  • "RS384"
  • "RS512"
  • "PS256"
  • "PS384"
  • "PS512"
  • "ES256"
  • "ES384"
  • "ES512"
  • "Ed25519"
  • "Ed448"
  • "HS256"
  • "HS384"
  • "HS512"
Type: stringFormat: uri

Signature algorithm. Note: If proprietary signature algorithms are added, they must be expressed as URIs.

Type: string

Optional. Application specific string identifying the signature key.

Type: object

Optional. Public key object.

Type: object

If the conditions in the "If" tab are respected, then the conditions in the "Then" tab should be respected. Otherwise, the conditions in the "Else" tab should be respected.

Type: object

Type: const
Type: object
No Additional Properties

Type: enum (of string)

Key type indicator.

Must be one of:

  • "EC"
  • "OKP"
  • "RSA"

Type: enum (of string)

EC curve name.

Must be one of:

  • "P-256"
  • "P-384"
  • "P-521"

Type: string

EC curve point X. The length of this field must be the full size of a coordinate for the curve specified in the "crv" parameter. For example, if the value of "crv" is "P-521", the decoded argument must be 66 bytes.

Type: string

EC curve point Y. The length of this field must be the full size of a coordinate for the curve specified in the "crv" parameter. For example, if the value of "crv" is "P-256", the decoded argument must be 32 bytes.

Type: object

If the conditions in the "If" tab are respected, then the conditions in the "Then" tab should be respected. Otherwise, the conditions in the "Else" tab should be respected.

Type: object

Type: const
Type: object
No Additional Properties

Type: enum (of string)

Key type indicator.

Must be one of:

  • "EC"
  • "OKP"
  • "RSA"

Type: enum (of string)

EdDSA curve name.

Must be one of:

  • "Ed25519"
  • "Ed448"

Type: string

EdDSA curve point X. The length of this field must be the full size of a coordinate for the curve specified in the "crv" parameter. For example, if the value of "crv" is "Ed25519", the decoded argument must be 32 bytes.

Type: object

If the conditions in the "If" tab are respected, then the conditions in the "Then" tab should be respected. Otherwise, the conditions in the "Else" tab should be respected.

Type: object

Type: const
Type: object
No Additional Properties

Type: enum (of string)

Key type indicator.

Must be one of:

  • "EC"
  • "OKP"
  • "RSA"

Type: string

RSA modulus.

Type: string

RSA exponent.

Type: enum (of string)

Key type indicator.

Must be one of:

  • "EC"
  • "OKP"
  • "RSA"

Additional Properties of any type are allowed.

Type: object

Type: array of string

Optional. Sorted array of X.509 [RFC5280] certificates, where the first element must contain the signature certificate. The certificate path must be contiguous but is not required to be complete.

No Additional Items

Each item of this array must be:

Type: string

Type: array of string

Optional. Array holding the names of one or more application level properties that must be excluded from the signature process. Note that the "excludes" property itself, must also be excluded from the signature process. Since both the "excludes" property and the associated data it points to are unsigned, a conforming JSF implementation must provide options for specifying which properties to accept.

No Additional Items

Each item of this array must be:

Type: string

Type: string

The signature data. Note that the binary representation must follow the JWA [RFC7518] specifications.

Type: object
No Additional Properties

Type: array

Unique top level property for Signature Chains. (signaturechain)

No Additional Items

Each item of this array must be:

Type: object
No Additional Properties


Type: enum (of string)

Signature algorithm. The currently recognized JWA [RFC7518] and RFC8037 [RFC8037] asymmetric key algorithms. Note: Unlike RFC8037 [RFC8037] JSF requires explicit Ed* algorithm names instead of "EdDSA".

Must be one of:

  • "RS256"
  • "RS384"
  • "RS512"
  • "PS256"
  • "PS384"
  • "PS512"
  • "ES256"
  • "ES384"
  • "ES512"
  • "Ed25519"
  • "Ed448"
  • "HS256"
  • "HS384"
  • "HS512"
Type: stringFormat: uri

Signature algorithm. Note: If proprietary signature algorithms are added, they must be expressed as URIs.

Type: string

Optional. Application specific string identifying the signature key.

Type: object

Optional. Public key object.

Type: object

If the conditions in the "If" tab are respected, then the conditions in the "Then" tab should be respected. Otherwise, the conditions in the "Else" tab should be respected.

Type: object

Type: const
Type: object
No Additional Properties

Type: enum (of string)

Key type indicator.

Must be one of:

  • "EC"
  • "OKP"
  • "RSA"

Type: enum (of string)

EC curve name.

Must be one of:

  • "P-256"
  • "P-384"
  • "P-521"

Type: string

EC curve point X. The length of this field must be the full size of a coordinate for the curve specified in the "crv" parameter. For example, if the value of "crv" is "P-521", the decoded argument must be 66 bytes.

Type: string

EC curve point Y. The length of this field must be the full size of a coordinate for the curve specified in the "crv" parameter. For example, if the value of "crv" is "P-256", the decoded argument must be 32 bytes.

Type: object

If the conditions in the "If" tab are respected, then the conditions in the "Then" tab should be respected. Otherwise, the conditions in the "Else" tab should be respected.

Type: object

Type: const
Type: object
No Additional Properties

Type: enum (of string)

Key type indicator.

Must be one of:

  • "EC"
  • "OKP"
  • "RSA"

Type: enum (of string)

EdDSA curve name.

Must be one of:

  • "Ed25519"
  • "Ed448"

Type: string

EdDSA curve point X. The length of this field must be the full size of a coordinate for the curve specified in the "crv" parameter. For example, if the value of "crv" is "Ed25519", the decoded argument must be 32 bytes.

Type: object

If the conditions in the "If" tab are respected, then the conditions in the "Then" tab should be respected. Otherwise, the conditions in the "Else" tab should be respected.

Type: object

Type: const
Type: object
No Additional Properties

Type: enum (of string)

Key type indicator.

Must be one of:

  • "EC"
  • "OKP"
  • "RSA"

Type: string

RSA modulus.

Type: string

RSA exponent.

Type: enum (of string)

Key type indicator.

Must be one of:

  • "EC"
  • "OKP"
  • "RSA"

Additional Properties of any type are allowed.

Type: object

Type: array of string

Optional. Sorted array of X.509 [RFC5280] certificates, where the first element must contain the signature certificate. The certificate path must be contiguous but is not required to be complete.

No Additional Items

Each item of this array must be:

Type: string

Type: array of string

Optional. Array holding the names of one or more application level properties that must be excluded from the signature process. Note that the "excludes" property itself, must also be excluded from the signature process. Since both the "excludes" property and the associated data it points to are unsigned, a conforming JSF implementation must provide options for specifying which properties to accept.

No Additional Items

Each item of this array must be:

Type: string

Type: string

The signature data. Note that the binary representation must follow the JWA [RFC7518] specifications.

Type: object

Unique top level property for simple signatures. (signaturecore)

No Additional Properties


Type: enum (of string)

Signature algorithm. The currently recognized JWA [RFC7518] and RFC8037 [RFC8037] asymmetric key algorithms. Note: Unlike RFC8037 [RFC8037] JSF requires explicit Ed* algorithm names instead of "EdDSA".

Must be one of:

  • "RS256"
  • "RS384"
  • "RS512"
  • "PS256"
  • "PS384"
  • "PS512"
  • "ES256"
  • "ES384"
  • "ES512"
  • "Ed25519"
  • "Ed448"
  • "HS256"
  • "HS384"
  • "HS512"
Type: stringFormat: uri

Signature algorithm. Note: If proprietary signature algorithms are added, they must be expressed as URIs.

Type: string

Optional. Application specific string identifying the signature key.

Type: object

Optional. Public key object.

Type: object

If the conditions in the "If" tab are respected, then the conditions in the "Then" tab should be respected. Otherwise, the conditions in the "Else" tab should be respected.

Type: object

Type: const
Type: object
No Additional Properties

Type: enum (of string)

Key type indicator.

Must be one of:

  • "EC"
  • "OKP"
  • "RSA"

Type: enum (of string)

EC curve name.

Must be one of:

  • "P-256"
  • "P-384"
  • "P-521"

Type: string

EC curve point X. The length of this field must be the full size of a coordinate for the curve specified in the "crv" parameter. For example, if the value of "crv" is "P-521", the decoded argument must be 66 bytes.

Type: string

EC curve point Y. The length of this field must be the full size of a coordinate for the curve specified in the "crv" parameter. For example, if the value of "crv" is "P-256", the decoded argument must be 32 bytes.

Type: object

If the conditions in the "If" tab are respected, then the conditions in the "Then" tab should be respected. Otherwise, the conditions in the "Else" tab should be respected.

Type: object

Type: const
Type: object
No Additional Properties

Type: enum (of string)

Key type indicator.

Must be one of:

  • "EC"
  • "OKP"
  • "RSA"

Type: enum (of string)

EdDSA curve name.

Must be one of:

  • "Ed25519"
  • "Ed448"

Type: string

EdDSA curve point X. The length of this field must be the full size of a coordinate for the curve specified in the "crv" parameter. For example, if the value of "crv" is "Ed25519", the decoded argument must be 32 bytes.

Type: object

If the conditions in the "If" tab are respected, then the conditions in the "Then" tab should be respected. Otherwise, the conditions in the "Else" tab should be respected.

Type: object

Type: const
Type: object
No Additional Properties

Type: enum (of string)

Key type indicator.

Must be one of:

  • "EC"
  • "OKP"
  • "RSA"

Type: string

RSA modulus.

Type: string

RSA exponent.

Type: enum (of string)

Key type indicator.

Must be one of:

  • "EC"
  • "OKP"
  • "RSA"

Additional Properties of any type are allowed.

Type: object

Type: array of string

Optional. Sorted array of X.509 [RFC5280] certificates, where the first element must contain the signature certificate. The certificate path must be contiguous but is not required to be complete.

No Additional Items

Each item of this array must be:

Type: string

Type: array of string

Optional. Array holding the names of one or more application level properties that must be excluded from the signature process. Note that the "excludes" property itself, must also be excluded from the signature process. Since both the "excludes" property and the associated data it points to are unsigned, a conforming JSF implementation must provide options for specifying which properties to accept.

No Additional Items

Each item of this array must be:

Type: string

Type: string

The signature data. Note that the binary representation must follow the JWA [RFC7518] specifications.

Type: array

A list of services. This may include microservices, function-as-a-service, and other types of network or intra-process services.

All items must be unique

No Additional Items

Each item of this array must be:

Type: object
No Additional Properties

Type: string

An optional identifier which can be used to reference the service elsewhere in the BOM. Every bom-ref MUST be unique within the BOM.

Type: object

The organization that provides the service.

No Additional Properties

Type: string

The name of the organization


Example:

"Example Inc."

Type: array of string

The URL of the organization. Multiple URLs are allowed.

No Additional Items

Each item of this array must be:

Type: stringFormat: iri-reference

Example:

"https://example.com"

Type: array

A contact at the organization. Multiple contacts are allowed.

No Additional Items

Each item of this array must be:

Type: object
No Additional Properties

Type: string

The name of a contact


Example:

"Contact name"

Type: stringFormat: idn-email

The email address of the contact.


Example:

Type: string

The phone number of the contact.


Example:

"800-555-1212"

Type: string

The grouping name, namespace, or identifier. This will often be a shortened, single name of the company or project that produced the service or domain name. Whitespace and special characters should be avoided.


Example:

"com.acme"

Type: string

The name of the service. This will often be a shortened, single name of the service.


Example:

"ticker-service"

Type: string

The service version.


Example:

"1.0.0"

Type: string

Specifies a description for the service

Type: array of string

The endpoint URIs of the service. Multiple endpoints are allowed.

No Additional Items

Each item of this array must be:

Type: stringFormat: iri-reference

Example:

"https://example.com/api/v1/ticker"

Type: boolean

A boolean value indicating if the service requires authentication. A value of true indicates the service requires authentication prior to use. A value of false indicates the service does not require authentication.

Type: boolean

A boolean value indicating if use of the service crosses a trust zone or boundary. A value of true indicates that by using the service, a trust boundary is crossed. A value of false indicates that by using the service, a trust boundary is not crossed.

Type: array

Specifies the data classification.

No Additional Items

Each item of this array must be:

Type: object
No Additional Properties

Type: enum (of string)

Specifies the flow direction of the data. Direction is relative to the service. Inbound flow states that data enters the service. Outbound flow states that data leaves the service. Bi-directional states that data flows both ways, and unknown states that the direction is not known.

Must be one of:

  • "inbound"
  • "outbound"
  • "bi-directional"
  • "unknown"

Type: string

Data classification tags data according to its type, sensitivity, and value if altered, stolen, or destroyed.

Type: array
No Additional Items

Each item of this array must be:

Type: object
No Additional Properties

Type: object

The following properties are required:

  • license
Type: object

The following properties are required:

  • expression

Type: object
No Additional Properties

Type: object

The following properties are required:

  • id
Type: object

The following properties are required:

  • name

Type: enum (of string)

A valid SPDX license ID

Must be one of:

NameDescription
"0BSD"

BSD Zero Clause License

"3D-Slicer-1.0"

3D Slicer License v1.0

"AAL"

Attribution Assurance License

"Abstyles"

Abstyles License

"AdaCore-doc"

AdaCore Doc License

"Adobe-2006"

Adobe Systems Incorporated Source Code License Agreement

"Adobe-Display-PostScript"

Adobe Display PostScript License

"Adobe-Glyph"

Adobe Glyph List License

"Adobe-Utopia"

Adobe Utopia Font License

"ADSL"

Amazon Digital Services License

"Advanced-Cryptics-Dictionary"

Advanced Cryptics Dictionary License

"AFL-1.1"

Academic Free License v1.1

"AFL-1.2"

Academic Free License v1.2

"AFL-2.0"

Academic Free License v2.0

"AFL-2.1"

Academic Free License v2.1

"AFL-3.0"

Academic Free License v3.0

"Afmparse"

Afmparse License

"AGPL-1.0"

Affero General Public License v1.0

"AGPL-1.0-only"

Affero General Public License v1.0 only

"AGPL-1.0-or-later"

Affero General Public License v1.0 or later

"AGPL-3.0"

GNU Affero General Public License v3.0

"AGPL-3.0-only"

GNU Affero General Public License v3.0 only

"AGPL-3.0-or-later"

GNU Affero General Public License v3.0 or later

"Aladdin"

Aladdin Free Public License

"ALGLIB-Documentation"

ALGLIB Documentation License

"AMD-newlib"

AMD newlib License

"AMDPLPA"

AMD's plpa_map.c License

"AML"

Apple MIT License

"AML-glslang"

AML glslang variant License

"AMPAS"

Academy of Motion Picture Arts and Sciences BSD

"ANTLR-PD"

ANTLR Software Rights Notice

"ANTLR-PD-fallback"

ANTLR Software Rights Notice with license fallback

"any-OSI"

Any OSI License

"any-OSI-perl-modules"

Any OSI License - Perl Modules

"Apache-1.0"

Apache License 1.0

"Apache-1.1"

Apache License 1.1

"Apache-2.0"

Apache License 2.0

"APAFML"

Adobe Postscript AFM License

"APL-1.0"

Adaptive Public License 1.0

"App-s2p"

App::s2p License

"APSL-1.0"

Apple Public Source License 1.0

"APSL-1.1"

Apple Public Source License 1.1

"APSL-1.2"

Apple Public Source License 1.2

"APSL-2.0"

Apple Public Source License 2.0

"Arphic-1999"

Arphic Public License

"Artistic-1.0"

Artistic License 1.0

"Artistic-1.0-cl8"

Artistic License 1.0 w/clause 8

"Artistic-1.0-Perl"

Artistic License 1.0 (Perl)

"Artistic-2.0"

Artistic License 2.0

"Artistic-dist"

Artistic License 1.0 (dist)

"Aspell-RU"

Aspell Russian License

"ASWF-Digital-Assets-1.0"

ASWF Digital Assets License version 1.0

"ASWF-Digital-Assets-1.1"

ASWF Digital Assets License 1.1

"Baekmuk"

Baekmuk License

"Bahyph"

Bahyph License

"Barr"

Barr License

"bcrypt-Solar-Designer"

bcrypt Solar Designer License

"Beerware"

Beerware License

"Bitstream-Charter"

Bitstream Charter Font License

"Bitstream-Vera"

Bitstream Vera Font License

"BitTorrent-1.0"

BitTorrent Open Source License v1.0

"BitTorrent-1.1"

BitTorrent Open Source License v1.1

"blessing"

SQLite Blessing

"BlueOak-1.0.0"

Blue Oak Model License 1.0.0

"Boehm-GC"

Boehm-Demers-Weiser GC License

"Boehm-GC-without-fee"

Boehm-Demers-Weiser GC License (without fee)

"BOLA-1.1"

Buena Onda License Agreement v1.1

"Borceux"

Borceux license

"Brian-Gladman-2-Clause"

Brian Gladman 2-Clause License

"Brian-Gladman-3-Clause"

Brian Gladman 3-Clause License

"BSD-1-Clause"

BSD 1-Clause License

"BSD-2-Clause"

BSD 2-Clause "Simplified" License

"BSD-2-Clause-Darwin"

BSD 2-Clause - Ian Darwin variant

"BSD-2-Clause-first-lines"

BSD 2-Clause - first lines requirement

"BSD-2-Clause-FreeBSD"

BSD 2-Clause FreeBSD License

"BSD-2-Clause-NetBSD"

BSD 2-Clause NetBSD License

"BSD-2-Clause-Patent"

BSD-2-Clause Plus Patent License

"BSD-2-Clause-pkgconf-disclaimer"

BSD 2-Clause pkgconf disclaimer variant

"BSD-2-Clause-Views"

BSD 2-Clause with views sentence

"BSD-3-Clause"

BSD 3-Clause "New" or "Revised" License

"BSD-3-Clause-acpica"

BSD 3-Clause acpica variant

"BSD-3-Clause-Attribution"

BSD with attribution

"BSD-3-Clause-Clear"

BSD 3-Clause Clear License

"BSD-3-Clause-flex"

BSD 3-Clause Flex variant

"BSD-3-Clause-HP"

Hewlett-Packard BSD variant license

"BSD-3-Clause-LBNL"

Lawrence Berkeley National Labs BSD variant license

"BSD-3-Clause-Modification"

BSD 3-Clause Modification

"BSD-3-Clause-No-Military-License"

BSD 3-Clause No Military License

"BSD-3-Clause-No-Nuclear-License"

BSD 3-Clause No Nuclear License

"BSD-3-Clause-No-Nuclear-License-2014"

BSD 3-Clause No Nuclear License 2014

"BSD-3-Clause-No-Nuclear-Warranty"

BSD 3-Clause No Nuclear Warranty

"BSD-3-Clause-Open-MPI"

BSD 3-Clause Open MPI variant

"BSD-3-Clause-Sun"

BSD 3-Clause Sun Microsystems

"BSD-3-Clause-Tso"

BSD 3-Clause Tso variant

"BSD-4-Clause"

BSD 4-Clause "Original" or "Old" License

"BSD-4-Clause-Shortened"

BSD 4 Clause Shortened

"BSD-4-Clause-UC"

BSD-4-Clause (University of California-Specific)

"BSD-4.3RENO"

BSD 4.3 RENO License

"BSD-4.3TAHOE"

BSD 4.3 TAHOE License

"BSD-Advertising-Acknowledgement"

BSD Advertising Acknowledgement License

"BSD-Attribution-HPND-disclaimer"

BSD with Attribution and HPND disclaimer

"BSD-Inferno-Nettverk"

BSD-Inferno-Nettverk

"BSD-Mark-Modifications"

BSD Mark Modifications License

"BSD-Protection"

BSD Protection License

"BSD-Source-beginning-file"

BSD Source Code Attribution - beginning of file variant

"BSD-Source-Code"

BSD Source Code Attribution

"BSD-Systemics"

Systemics BSD variant license

"BSD-Systemics-W3Works"

Systemics W3Works BSD variant license

"BSL-1.0"

Boost Software License 1.0

"Buddy"

Buddy License

"BUSL-1.1"

Business Source License 1.1

"bzip2-1.0.5"

bzip2 and libbzip2 License v1.0.5

"bzip2-1.0.6"

bzip2 and libbzip2 License v1.0.6

"C-UDA-1.0"

Computational Use of Data Agreement v1.0

"CAL-1.0"

Cryptographic Autonomy License 1.0

"CAL-1.0-Combined-Work-Exception"

Cryptographic Autonomy License 1.0 (Combined Work Exception)

"Caldera"

Caldera License

"Caldera-no-preamble"

Caldera License (without preamble)

"CAPEC-tou"

Common Attack Pattern Enumeration and Classification License

"Catharon"

Catharon License

"CATOSL-1.1"

Computer Associates Trusted Open Source License 1.1

"CC-BY-1.0"

Creative Commons Attribution 1.0 Generic

"CC-BY-2.0"

Creative Commons Attribution 2.0 Generic

"CC-BY-2.5"

Creative Commons Attribution 2.5 Generic

"CC-BY-2.5-AU"

Creative Commons Attribution 2.5 Australia

"CC-BY-3.0"

Creative Commons Attribution 3.0 Unported

"CC-BY-3.0-AT"

Creative Commons Attribution 3.0 Austria

"CC-BY-3.0-AU"

Creative Commons Attribution 3.0 Australia

"CC-BY-3.0-DE"

Creative Commons Attribution 3.0 Germany

"CC-BY-3.0-IGO"

Creative Commons Attribution 3.0 IGO

"CC-BY-3.0-NL"

Creative Commons Attribution 3.0 Netherlands

"CC-BY-3.0-US"

Creative Commons Attribution 3.0 United States

"CC-BY-4.0"

Creative Commons Attribution 4.0 International

"CC-BY-NC-1.0"

Creative Commons Attribution Non Commercial 1.0 Generic

"CC-BY-NC-2.0"

Creative Commons Attribution Non Commercial 2.0 Generic

"CC-BY-NC-2.5"

Creative Commons Attribution Non Commercial 2.5 Generic

"CC-BY-NC-3.0"

Creative Commons Attribution Non Commercial 3.0 Unported

"CC-BY-NC-3.0-DE"

Creative Commons Attribution Non Commercial 3.0 Germany

"CC-BY-NC-4.0"

Creative Commons Attribution Non Commercial 4.0 International

"CC-BY-NC-ND-1.0"

Creative Commons Attribution Non Commercial No Derivatives 1.0 Generic

"CC-BY-NC-ND-2.0"

Creative Commons Attribution Non Commercial No Derivatives 2.0 Generic

"CC-BY-NC-ND-2.5"

Creative Commons Attribution Non Commercial No Derivatives 2.5 Generic

"CC-BY-NC-ND-3.0"

Creative Commons Attribution Non Commercial No Derivatives 3.0 Unported

"CC-BY-NC-ND-3.0-DE"

Creative Commons Attribution Non Commercial No Derivatives 3.0 Germany

"CC-BY-NC-ND-3.0-IGO"

Creative Commons Attribution Non Commercial No Derivatives 3.0 IGO

"CC-BY-NC-ND-4.0"

Creative Commons Attribution Non Commercial No Derivatives 4.0 International

"CC-BY-NC-SA-1.0"

Creative Commons Attribution Non Commercial Share Alike 1.0 Generic

"CC-BY-NC-SA-2.0"

Creative Commons Attribution Non Commercial Share Alike 2.0 Generic

"CC-BY-NC-SA-2.0-DE"

Creative Commons Attribution Non Commercial Share Alike 2.0 Germany

"CC-BY-NC-SA-2.0-FR"

Creative Commons Attribution-NonCommercial-ShareAlike 2.0 France

"CC-BY-NC-SA-2.0-UK"

Creative Commons Attribution Non Commercial Share Alike 2.0 England and Wales

"CC-BY-NC-SA-2.5"

Creative Commons Attribution Non Commercial Share Alike 2.5 Generic

"CC-BY-NC-SA-3.0"

Creative Commons Attribution Non Commercial Share Alike 3.0 Unported

"CC-BY-NC-SA-3.0-DE"

Creative Commons Attribution Non Commercial Share Alike 3.0 Germany

"CC-BY-NC-SA-3.0-IGO"

Creative Commons Attribution Non Commercial Share Alike 3.0 IGO

"CC-BY-NC-SA-4.0"

Creative Commons Attribution Non Commercial Share Alike 4.0 International

"CC-BY-ND-1.0"

Creative Commons Attribution No Derivatives 1.0 Generic

"CC-BY-ND-2.0"

Creative Commons Attribution No Derivatives 2.0 Generic

"CC-BY-ND-2.5"

Creative Commons Attribution No Derivatives 2.5 Generic

"CC-BY-ND-3.0"

Creative Commons Attribution No Derivatives 3.0 Unported

"CC-BY-ND-3.0-DE"

Creative Commons Attribution No Derivatives 3.0 Germany

"CC-BY-ND-4.0"

Creative Commons Attribution No Derivatives 4.0 International

"CC-BY-SA-1.0"

Creative Commons Attribution Share Alike 1.0 Generic

"CC-BY-SA-2.0"

Creative Commons Attribution Share Alike 2.0 Generic

"CC-BY-SA-2.0-UK"

Creative Commons Attribution Share Alike 2.0 England and Wales

"CC-BY-SA-2.1-JP"

Creative Commons Attribution Share Alike 2.1 Japan

"CC-BY-SA-2.5"

Creative Commons Attribution Share Alike 2.5 Generic

"CC-BY-SA-3.0"

Creative Commons Attribution Share Alike 3.0 Unported

"CC-BY-SA-3.0-AT"

Creative Commons Attribution Share Alike 3.0 Austria

"CC-BY-SA-3.0-DE"

Creative Commons Attribution Share Alike 3.0 Germany

"CC-BY-SA-3.0-IGO"

Creative Commons Attribution-ShareAlike 3.0 IGO

"CC-BY-SA-4.0"

Creative Commons Attribution Share Alike 4.0 International

"CC-PDDC"

Creative Commons Public Domain Dedication and Certification

"CC-PDM-1.0"

Creative Commons Public Domain Mark 1.0 Universal

"CC-SA-1.0"

Creative Commons Share Alike 1.0 Generic

"CC0-1.0"

Creative Commons Zero v1.0 Universal

"CDDL-1.0"

Common Development and Distribution License 1.0

"CDDL-1.1"

Common Development and Distribution License 1.1

"CDL-1.0"

Common Documentation License 1.0

"CDLA-Permissive-1.0"

Community Data License Agreement Permissive 1.0

"CDLA-Permissive-2.0"

Community Data License Agreement Permissive 2.0

"CDLA-Sharing-1.0"

Community Data License Agreement Sharing 1.0

"CECILL-1.0"

CeCILL Free Software License Agreement v1.0

"CECILL-1.1"

CeCILL Free Software License Agreement v1.1

"CECILL-2.0"

CeCILL Free Software License Agreement v2.0

"CECILL-2.1"

CeCILL Free Software License Agreement v2.1

"CECILL-B"

CeCILL-B Free Software License Agreement

"CECILL-C"

CeCILL-C Free Software License Agreement

"CERN-OHL-1.1"

CERN Open Hardware Licence v1.1

"CERN-OHL-1.2"

CERN Open Hardware Licence v1.2

"CERN-OHL-P-2.0"

CERN Open Hardware Licence Version 2 - Permissive

"CERN-OHL-S-2.0"

CERN Open Hardware Licence Version 2 - Strongly Reciprocal

"CERN-OHL-W-2.0"

CERN Open Hardware Licence Version 2 - Weakly Reciprocal

"CFITSIO"

CFITSIO License

"check-cvs"

check-cvs License

"checkmk"

Checkmk License

"ClArtistic"

Clarified Artistic License

"Clips"

Clips License

"CMU-Mach"

CMU Mach License

"CMU-Mach-nodoc"

CMU Mach - no notices-in-documentation variant

"CNRI-Jython"

CNRI Jython License

"CNRI-Python"

CNRI Python License

"CNRI-Python-GPL-Compatible"

CNRI Python Open Source GPL Compatible License Agreement

"COIL-1.0"

Copyfree Open Innovation License

"Community-Spec-1.0"

Community Specification License 1.0

"Condor-1.1"

Condor Public License v1.1

"copyleft-next-0.3.0"

copyleft-next 0.3.0

"copyleft-next-0.3.1"

copyleft-next 0.3.1

"Cornell-Lossless-JPEG"

Cornell Lossless JPEG License

"CPAL-1.0"

Common Public Attribution License 1.0

"CPL-1.0"

Common Public License 1.0

"CPOL-1.02"

Code Project Open License 1.02

"Cronyx"

Cronyx License

"Crossword"

Crossword License

"CryptoSwift"

CryptoSwift License

"CrystalStacker"

CrystalStacker License

"CUA-OPL-1.0"

CUA Office Public License v1.0

"Cube"

Cube License

"curl"

curl License

"cve-tou"

Common Vulnerability Enumeration ToU License

"D-FSL-1.0"

Deutsche Freie Software Lizenz

"DEC-3-Clause"

DEC 3-Clause License

"diffmark"

diffmark license

"DL-DE-BY-2.0"

Data licence Germany – attribution – version 2.0

"DL-DE-ZERO-2.0"

Data licence Germany – zero – version 2.0

"DOC"

DOC License

"DocBook-DTD"

DocBook DTD License

"DocBook-Schema"

DocBook Schema License

"DocBook-Stylesheet"

DocBook Stylesheet License

"DocBook-XML"

DocBook XML License

"Dotseqn"

Dotseqn License

"DRL-1.0"

Detection Rule License 1.0

"DRL-1.1"

Detection Rule License 1.1

"DSDP"

DSDP License

"dtoa"

David M. Gay dtoa License

"dvipdfm"

dvipdfm License

"ECL-1.0"

Educational Community License v1.0

"ECL-2.0"

Educational Community License v2.0

"eCos-2.0"

eCos license version 2.0

"EFL-1.0"

Eiffel Forum License v1.0

"EFL-2.0"

Eiffel Forum License v2.0

"eGenix"

eGenix.com Public License 1.1.0

"Elastic-2.0"

Elastic License 2.0

"Entessa"

Entessa Public License v1.0

"EPICS"

EPICS Open License

"EPL-1.0"

Eclipse Public License 1.0

"EPL-2.0"

Eclipse Public License 2.0

"ErlPL-1.1"

Erlang Public License v1.1

"ESA-PL-permissive-2.4"

European Space Agency Public License – v2.4 – Permissive (Type 3)

"ESA-PL-strong-copyleft-2.4"

European Space Agency Public License (ESA-PL) - V2.4 - Strong Copyleft (Type 1)

"ESA-PL-weak-copyleft-2.4"

European Space Agency Public License – v2.4 – Weak Copyleft (Type 2)

"etalab-2.0"

Etalab Open License 2.0

"EUDatagrid"

EU DataGrid Software License

"EUPL-1.0"

European Union Public License 1.0

"EUPL-1.1"

European Union Public License 1.1

"EUPL-1.2"

European Union Public License 1.2

"Eurosym"

Eurosym License

"Fair"

Fair License

"FBM"

Fuzzy Bitmap License

"FDK-AAC"

Fraunhofer FDK AAC Codec Library

"Ferguson-Twofish"

Ferguson Twofish License

"Frameworx-1.0"

Frameworx Open License 1.0

"FreeBSD-DOC"

FreeBSD Documentation License

"FreeImage"

FreeImage Public License v1.0

"FSFAP"

FSF All Permissive License

"FSFAP-no-warranty-disclaimer"

FSF All Permissive License (without Warranty)

"FSFUL"

FSF Unlimited License

"FSFULLR"

FSF Unlimited License (with License Retention)

"FSFULLRSD"

FSF Unlimited License (with License Retention and Short Disclaimer)

"FSFULLRWD"

FSF Unlimited License (With License Retention and Warranty Disclaimer)

"FSL-1.1-ALv2"

Functional Source License, Version 1.1, ALv2 Future License

"FSL-1.1-MIT"

Functional Source License, Version 1.1, MIT Future License

"FTL"

Freetype Project License

"Furuseth"

Furuseth License

"fwlw"

fwlw License

"Game-Programming-Gems"

Game Programming Gems License

"GCR-docs"

Gnome GCR Documentation License

"GD"

GD License

"generic-xts"

Generic XTS License

"GFDL-1.1"

GNU Free Documentation License v1.1

"GFDL-1.1-invariants-only"

GNU Free Documentation License v1.1 only - invariants

"GFDL-1.1-invariants-or-later"

GNU Free Documentation License v1.1 or later - invariants

"GFDL-1.1-no-invariants-only"

GNU Free Documentation License v1.1 only - no invariants

"GFDL-1.1-no-invariants-or-later"

GNU Free Documentation License v1.1 or later - no invariants

"GFDL-1.1-only"

GNU Free Documentation License v1.1 only

"GFDL-1.1-or-later"

GNU Free Documentation License v1.1 or later

"GFDL-1.2"

GNU Free Documentation License v1.2

"GFDL-1.2-invariants-only"

GNU Free Documentation License v1.2 only - invariants

"GFDL-1.2-invariants-or-later"

GNU Free Documentation License v1.2 or later - invariants

"GFDL-1.2-no-invariants-only"

GNU Free Documentation License v1.2 only - no invariants

"GFDL-1.2-no-invariants-or-later"

GNU Free Documentation License v1.2 or later - no invariants

"GFDL-1.2-only"

GNU Free Documentation License v1.2 only

"GFDL-1.2-or-later"

GNU Free Documentation License v1.2 or later

"GFDL-1.3"

GNU Free Documentation License v1.3

"GFDL-1.3-invariants-only"

GNU Free Documentation License v1.3 only - invariants

"GFDL-1.3-invariants-or-later"

GNU Free Documentation License v1.3 or later - invariants

"GFDL-1.3-no-invariants-only"

GNU Free Documentation License v1.3 only - no invariants

"GFDL-1.3-no-invariants-or-later"

GNU Free Documentation License v1.3 or later - no invariants

"GFDL-1.3-only"

GNU Free Documentation License v1.3 only

"GFDL-1.3-or-later"

GNU Free Documentation License v1.3 or later

"Giftware"

Giftware License

"GL2PS"

GL2PS License

"Glide"

3dfx Glide License

"Glulxe"

Glulxe License

"GLWTPL"

Good Luck With That Public License

"gnuplot"

gnuplot License

"GPL-1.0"

GNU General Public License v1.0 only

"GPL-1.0+"

GNU General Public License v1.0 or later

"GPL-1.0-only"

GNU General Public License v1.0 only

"GPL-1.0-or-later"

GNU General Public License v1.0 or later

"GPL-2.0"

GNU General Public License v2.0 only

"GPL-2.0+"

GNU General Public License v2.0 or later

"GPL-2.0-only"

GNU General Public License v2.0 only

"GPL-2.0-or-later"

GNU General Public License v2.0 or later

"GPL-2.0-with-autoconf-exception"

GNU General Public License v2.0 w/Autoconf exception

"GPL-2.0-with-bison-exception"

GNU General Public License v2.0 w/Bison exception

"GPL-2.0-with-classpath-exception"

GNU General Public License v2.0 w/Classpath exception

"GPL-2.0-with-font-exception"

GNU General Public License v2.0 w/Font exception

"GPL-2.0-with-GCC-exception"

GNU General Public License v2.0 w/GCC Runtime Library exception

"GPL-3.0"

GNU General Public License v3.0 only

"GPL-3.0+"

GNU General Public License v3.0 or later

"GPL-3.0-only"

GNU General Public License v3.0 only

"GPL-3.0-or-later"

GNU General Public License v3.0 or later

"GPL-3.0-with-autoconf-exception"

GNU General Public License v3.0 w/Autoconf exception

"GPL-3.0-with-GCC-exception"

GNU General Public License v3.0 w/GCC Runtime Library exception

"Graphics-Gems"

Graphics Gems License

"gSOAP-1.3b"

gSOAP Public License v1.3b

"gtkbook"

gtkbook License

"Gutmann"

Gutmann License

"HaskellReport"

Haskell Language Report License

"HDF5"

HDF5 License

"hdparm"

hdparm License

"HIDAPI"

HIDAPI License

"Hippocratic-2.1"

Hippocratic License 2.1

"HP-1986"

Hewlett-Packard 1986 License

"HP-1989"

Hewlett-Packard 1989 License

"HPND"

Historical Permission Notice and Disclaimer

"HPND-DEC"

Historical Permission Notice and Disclaimer - DEC variant

"HPND-doc"

Historical Permission Notice and Disclaimer - documentation variant

"HPND-doc-sell"

Historical Permission Notice and Disclaimer - documentation sell variant

"HPND-export-US"

HPND with US Government export control warning

"HPND-export-US-acknowledgement"

HPND with US Government export control warning and acknowledgment

"HPND-export-US-modify"

HPND with US Government export control warning and modification rqmt

"HPND-export2-US"

HPND with US Government export control and 2 disclaimers

"HPND-Fenneberg-Livingston"

Historical Permission Notice and Disclaimer - Fenneberg-Livingston variant

"HPND-INRIA-IMAG"

Historical Permission Notice and Disclaimer - INRIA-IMAG variant

"HPND-Intel"

Historical Permission Notice and Disclaimer - Intel variant

"HPND-Kevlin-Henney"

Historical Permission Notice and Disclaimer - Kevlin Henney variant

"HPND-Markus-Kuhn"

Historical Permission Notice and Disclaimer - Markus Kuhn variant

"HPND-merchantability-variant"

Historical Permission Notice and Disclaimer - merchantability variant

"HPND-MIT-disclaimer"

Historical Permission Notice and Disclaimer with MIT disclaimer

"HPND-Netrek"

Historical Permission Notice and Disclaimer - Netrek variant

"HPND-Pbmplus"

Historical Permission Notice and Disclaimer - Pbmplus variant

"HPND-sell-MIT-disclaimer-xserver"

Historical Permission Notice and Disclaimer - sell xserver variant with MIT disclaimer

"HPND-sell-regexpr"

Historical Permission Notice and Disclaimer - sell regexpr variant

"HPND-sell-variant"

Historical Permission Notice and Disclaimer - sell variant

"HPND-sell-variant-critical-systems"

HPND - sell variant with safety critical systems clause

"HPND-sell-variant-MIT-disclaimer"

HPND sell variant with MIT disclaimer

"HPND-sell-variant-MIT-disclaimer-rev"

HPND sell variant with MIT disclaimer - reverse

"HPND-SMC"

Historical Permission Notice and Disclaimer - SMC variant

"HPND-UC"

Historical Permission Notice and Disclaimer - University of California variant

"HPND-UC-export-US"

Historical Permission Notice and Disclaimer - University of California, US export warning

"HTMLTIDY"

HTML Tidy License

"hyphen-bulgarian"

hyphen-bulgarian License

"IBM-pibs"

IBM PowerPC Initialization and Boot Software

"ICU"

ICU License

"IEC-Code-Components-EULA"

IEC Code Components End-user licence agreement

"IJG"

Independent JPEG Group License

"IJG-short"

Independent JPEG Group License - short

"ImageMagick"

ImageMagick License

"iMatix"

iMatix Standard Function Library Agreement

"Imlib2"

Imlib2 License

"Info-ZIP"

Info-ZIP License

"Inner-Net-2.0"

Inner Net License v2.0

"InnoSetup"

Inno Setup License

"Intel"

Intel Open Source License

"Intel-ACPI"

Intel ACPI Software License Agreement

"Interbase-1.0"

Interbase Public License v1.0

"IPA"

IPA Font License

"IPL-1.0"

IBM Public License v1.0

"ISC"

ISC License

"ISC-Veillard"

ISC Veillard variant

"ISO-permission"

ISO permission notice

"Jam"

Jam License

"JasPer-2.0"

JasPer License

"jove"

Jove License

"JPL-image"

JPL Image Use Policy

"JPNIC"

Japan Network Information Center License

"JSON"

JSON License

"Kastrup"

Kastrup License

"Kazlib"

Kazlib License

"Knuth-CTAN"

Knuth CTAN License

"LAL-1.2"

Licence Art Libre 1.2

"LAL-1.3"

Licence Art Libre 1.3

"Latex2e"

Latex2e License

"Latex2e-translated-notice"

Latex2e with translated notice permission

"Leptonica"

Leptonica License

"LGPL-2.0"

GNU Library General Public License v2 only

"LGPL-2.0+"

GNU Library General Public License v2 or later

"LGPL-2.0-only"

GNU Library General Public License v2 only

"LGPL-2.0-or-later"

GNU Library General Public License v2 or later

"LGPL-2.1"

GNU Lesser General Public License v2.1 only

"LGPL-2.1+"

GNU Lesser General Public License v2.1 or later

"LGPL-2.1-only"

GNU Lesser General Public License v2.1 only

"LGPL-2.1-or-later"

GNU Lesser General Public License v2.1 or later

"LGPL-3.0"

GNU Lesser General Public License v3.0 only

"LGPL-3.0+"

GNU Lesser General Public License v3.0 or later

"LGPL-3.0-only"

GNU Lesser General Public License v3.0 only

"LGPL-3.0-or-later"

GNU Lesser General Public License v3.0 or later

"LGPLLR"

Lesser General Public License For Linguistic Resources

"Libpng"

libpng License

"libpng-1.6.35"

PNG Reference Library License v1 (for libpng 0.5 through 1.6.35)

"libpng-2.0"

PNG Reference Library version 2

"libselinux-1.0"

libselinux public domain notice

"libtiff"

libtiff License

"libutil-David-Nugent"

libutil David Nugent License

"LiLiQ-P-1.1"

Licence Libre du Québec – Permissive version 1.1

"LiLiQ-R-1.1"

Licence Libre du Québec – Réciprocité version 1.1

"LiLiQ-Rplus-1.1"

Licence Libre du Québec – Réciprocité forte version 1.1

"Linux-man-pages-1-para"

Linux man-pages - 1 paragraph

"Linux-man-pages-copyleft"

Linux man-pages Copyleft

"Linux-man-pages-copyleft-2-para"

Linux man-pages Copyleft - 2 paragraphs

"Linux-man-pages-copyleft-var"

Linux man-pages Copyleft Variant

"Linux-OpenIB"

Linux Kernel Variant of OpenIB.org license

"LOOP"

Common Lisp LOOP License

"LPD-document"

LPD Documentation License

"LPL-1.0"

Lucent Public License Version 1.0

"LPL-1.02"

Lucent Public License v1.02

"LPPL-1.0"

LaTeX Project Public License v1.0

"LPPL-1.1"

LaTeX Project Public License v1.1

"LPPL-1.2"

LaTeX Project Public License v1.2

"LPPL-1.3a"

LaTeX Project Public License v1.3a

"LPPL-1.3c"

LaTeX Project Public License v1.3c

"lsof"

lsof License

"Lucida-Bitmap-Fonts"

Lucida Bitmap Fonts License

"LZMA-SDK-9.11-to-9.20"

LZMA SDK License (versions 9.11 to 9.20)

"LZMA-SDK-9.22"

LZMA SDK License (versions 9.22 and beyond)

"Mackerras-3-Clause"

Mackerras 3-Clause License

"Mackerras-3-Clause-acknowledgment"

Mackerras 3-Clause - acknowledgment variant

"magaz"

magaz License

"mailprio"

mailprio License

"MakeIndex"

MakeIndex License

"man2html"

man2html License

"Martin-Birgmeier"

Martin Birgmeier License

"McPhee-slideshow"

McPhee Slideshow License

"metamail"

metamail License

"Minpack"

Minpack License

"MIPS"

MIPS License

"MirOS"

The MirOS Licence

"MIT"

MIT License

"MIT-0"

MIT No Attribution

"MIT-advertising"

Enlightenment License (e16)

"MIT-Click"

MIT Click License

"MIT-CMU"

CMU License

"MIT-enna"

enna License

"MIT-feh"

feh License

"MIT-Festival"

MIT Festival Variant

"MIT-Khronos-old"

MIT Khronos - old variant

"MIT-Modern-Variant"

MIT License Modern Variant

"MIT-open-group"

MIT Open Group variant

"MIT-STK"

MIT-STK License

"MIT-testregex"

MIT testregex Variant

"MIT-Wu"

MIT Tom Wu Variant

"MITNFA"

MIT +no-false-attribs license

"MMIXware"

MMIXware License

"MMPL-1.0.1"

Minecraft Mod Public License v1.0.1

"Motosoto"

Motosoto License

"MPEG-SSG"

MPEG Software Simulation

"mpi-permissive"

mpi Permissive License

"mpich2"

mpich2 License

"MPL-1.0"

Mozilla Public License 1.0

"MPL-1.1"

Mozilla Public License 1.1

"MPL-2.0"

Mozilla Public License 2.0

"MPL-2.0-no-copyleft-exception"

Mozilla Public License 2.0 (no copyleft exception)

"mplus"

mplus Font License

"MS-LPL"

Microsoft Limited Public License

"MS-PL"

Microsoft Public License

"MS-RL"

Microsoft Reciprocal License

"MTLL"

Matrix Template Library License

"MulanPSL-1.0"

Mulan Permissive Software License, Version 1

"MulanPSL-2.0"

Mulan Permissive Software License, Version 2

"Multics"

Multics License

"Mup"

Mup License

"NAIST-2003"

Nara Institute of Science and Technology License (2003)

"NASA-1.3"

NASA Open Source Agreement 1.3

"Naumen"

Naumen Public License

"NBPL-1.0"

Net Boolean Public License v1

"NCBI-PD"

NCBI Public Domain Notice

"NCGL-UK-2.0"

Non-Commercial Government Licence

"NCL"

NCL Source Code License

"NCSA"

University of Illinois/NCSA Open Source License

"Net-SNMP"

Net-SNMP License

"NetCDF"

NetCDF license

"Newsletr"

Newsletr License

"NGPL"

Nethack General Public License

"ngrep"

ngrep License

"NICTA-1.0"

NICTA Public Software License, Version 1.0

"NIST-PD"

NIST Public Domain Notice

"NIST-PD-fallback"

NIST Public Domain Notice with license fallback

"NIST-PD-TNT"

NIST Public Domain Notice TNT variant

"NIST-Software"

NIST Software License

"NLOD-1.0"

Norwegian Licence for Open Government Data (NLOD) 1.0

"NLOD-2.0"

Norwegian Licence for Open Government Data (NLOD) 2.0

"NLPL"

No Limit Public License

"Nokia"

Nokia Open Source License

"NOSL"

Netizen Open Source License

"Noweb"

Noweb License

"NPL-1.0"

Netscape Public License v1.0

"NPL-1.1"

Netscape Public License v1.1

"NPOSL-3.0"

Non-Profit Open Software License 3.0

"NRL"

NRL License

"NTIA-PD"

NTIA Public Domain Notice

"NTP"

NTP License

"NTP-0"

NTP No Attribution

"Nunit"

Nunit License

"O-UDA-1.0"

Open Use of Data Agreement v1.0

"OAR"

OAR License

"OCCT-PL"

Open CASCADE Technology Public License

"OCLC-2.0"

OCLC Research Public License 2.0

"ODbL-1.0"

Open Data Commons Open Database License v1.0

"ODC-By-1.0"

Open Data Commons Attribution License v1.0

"OFFIS"

OFFIS License

"OFL-1.0"

SIL Open Font License 1.0

"OFL-1.0-no-RFN"

SIL Open Font License 1.0 with no Reserved Font Name

"OFL-1.0-RFN"

SIL Open Font License 1.0 with Reserved Font Name

"OFL-1.1"

SIL Open Font License 1.1

"OFL-1.1-no-RFN"

SIL Open Font License 1.1 with no Reserved Font Name

"OFL-1.1-RFN"

SIL Open Font License 1.1 with Reserved Font Name

"OGC-1.0"

OGC Software License, Version 1.0

"OGDL-Taiwan-1.0"

Taiwan Open Government Data License, version 1.0

"OGL-Canada-2.0"

Open Government Licence - Canada

"OGL-UK-1.0"

Open Government Licence v1.0

"OGL-UK-2.0"

Open Government Licence v2.0

"OGL-UK-3.0"

Open Government Licence v3.0

"OGTSL"

Open Group Test Suite License

"OLDAP-1.1"

Open LDAP Public License v1.1

"OLDAP-1.2"

Open LDAP Public License v1.2

"OLDAP-1.3"

Open LDAP Public License v1.3

"OLDAP-1.4"

Open LDAP Public License v1.4

"OLDAP-2.0"

Open LDAP Public License v2.0 (or possibly 2.0A and 2.0B)

"OLDAP-2.0.1"

Open LDAP Public License v2.0.1

"OLDAP-2.1"

Open LDAP Public License v2.1

"OLDAP-2.2"

Open LDAP Public License v2.2

"OLDAP-2.2.1"

Open LDAP Public License v2.2.1

"OLDAP-2.2.2"

Open LDAP Public License 2.2.2

"OLDAP-2.3"

Open LDAP Public License v2.3

"OLDAP-2.4"

Open LDAP Public License v2.4

"OLDAP-2.5"

Open LDAP Public License v2.5

"OLDAP-2.6"

Open LDAP Public License v2.6

"OLDAP-2.7"

Open LDAP Public License v2.7

"OLDAP-2.8"

Open LDAP Public License v2.8

"OLFL-1.3"

Open Logistics Foundation License Version 1.3

"OML"

Open Market License

"OpenMDW-1.0"

OpenMDW License Agreement v1.0

"OpenPBS-2.3"

OpenPBS v2.3 Software License

"OpenSSL"

OpenSSL License

"OpenSSL-standalone"

OpenSSL License - standalone

"OpenVision"

OpenVision License

"OPL-1.0"

Open Public License v1.0

"OPL-UK-3.0"

United Kingdom Open Parliament Licence v3.0

"OPUBL-1.0"

Open Publication License v1.0

"OSC-1.0"

OSC License 1.0

"OSET-PL-2.1"

OSET Public License version 2.1

"OSL-1.0"

Open Software License 1.0

"OSL-1.1"

Open Software License 1.1

"OSL-2.0"

Open Software License 2.0

"OSL-2.1"

Open Software License 2.1

"OSL-3.0"

Open Software License 3.0

"OSSP"

OSSP License

"PADL"

PADL License

"ParaType-Free-Font-1.3"

ParaType Free Font Licensing Agreement v1.3

"Parity-6.0.0"

The Parity Public License 6.0.0

"Parity-7.0.0"

The Parity Public License 7.0.0

"PDDL-1.0"

Open Data Commons Public Domain Dedication & License 1.0

"PHP-3.0"

PHP License v3.0

"PHP-3.01"

PHP License v3.01

"Pixar"

Pixar License

"pkgconf"

pkgconf License

"Plexus"

Plexus Classworlds License

"pnmstitch"

pnmstitch License

"PolyForm-Noncommercial-1.0.0"

PolyForm Noncommercial License 1.0.0

"PolyForm-Small-Business-1.0.0"

PolyForm Small Business License 1.0.0

"PostgreSQL"

PostgreSQL License

"PPL"

Peer Production License

"PSF-2.0"

Python Software Foundation License 2.0

"psfrag"

psfrag License

"psutils"

psutils License

"Python-2.0"

Python License 2.0

"Python-2.0.1"

Python License 2.0.1

"python-ldap"

Python ldap License

"Qhull"

Qhull License

"QPL-1.0"

Q Public License 1.0

"QPL-1.0-INRIA-2004"

Q Public License 1.0 - INRIA 2004 variant

"radvd"

radvd License

"Rdisc"

Rdisc License

"RHeCos-1.1"

Red Hat eCos Public License v1.1

"RPL-1.1"

Reciprocal Public License 1.1

"RPL-1.5"

Reciprocal Public License 1.5

"RPSL-1.0"

RealNetworks Public Source License v1.0

"RSA-MD"

RSA Message-Digest License

"RSCPL"

Ricoh Source Code Public License

"Ruby"

Ruby License

"Ruby-pty"

Ruby pty extension license

"SAX-PD"

Sax Public Domain Notice

"SAX-PD-2.0"

Sax Public Domain Notice 2.0

"Saxpath"

Saxpath License

"SCEA"

SCEA Shared Source License

"SchemeReport"

Scheme Language Report License

"Sendmail"

Sendmail License

"Sendmail-8.23"

Sendmail License 8.23

"Sendmail-Open-Source-1.1"

Sendmail Open Source License v1.1

"SGI-B-1.0"

SGI Free Software License B v1.0

"SGI-B-1.1"

SGI Free Software License B v1.1

"SGI-B-2.0"

SGI Free Software License B v2.0

"SGI-OpenGL"

SGI OpenGL License

"SGMLUG-PM"

SGMLUG Parser Materials License

"SGP4"

SGP4 Permission Notice

"SHL-0.5"

Solderpad Hardware License v0.5

"SHL-0.51"

Solderpad Hardware License, Version 0.51

"SimPL-2.0"

Simple Public License 2.0

"SISSL"

Sun Industry Standards Source License v1.1

"SISSL-1.2"

Sun Industry Standards Source License v1.2

"SL"

SL License

"Sleepycat"

Sleepycat License

"SMAIL-GPL"

SMAIL General Public License

"SMLNJ"

Standard ML of New Jersey License

"SMPPL"

Secure Messaging Protocol Public License

"SNIA"

SNIA Public License 1.1

"snprintf"

snprintf License

"SOFA"

SOFA Software License

"softSurfer"

softSurfer License

"Soundex"

Soundex License

"Spencer-86"

Spencer License 86

"Spencer-94"

Spencer License 94

"Spencer-99"

Spencer License 99

"SPL-1.0"

Sun Public License v1.0

"ssh-keyscan"

ssh-keyscan License

"SSH-OpenSSH"

SSH OpenSSH license

"SSH-short"

SSH short notice

"SSLeay-standalone"

SSLeay License - standalone

"SSPL-1.0"

Server Side Public License, v 1

"StandardML-NJ"

Standard ML of New Jersey License

"SugarCRM-1.1.3"

SugarCRM Public License v1.1.3

"SUL-1.0"

Sustainable Use License v1.0

"Sun-PPP"

Sun PPP License

"Sun-PPP-2000"

Sun PPP License (2000)

"SunPro"

SunPro License

"SWL"

Scheme Widget Library (SWL) Software License Agreement

"swrule"

swrule License

"Symlinks"

Symlinks License

"TAPR-OHL-1.0"

TAPR Open Hardware License v1.0

"TCL"

TCL/TK License

"TCP-wrappers"

TCP Wrappers License

"TekHVC"

TekHVC License

"TermReadKey"

TermReadKey License

"TGPPL-1.0"

Transitive Grace Period Public Licence 1.0

"ThirdEye"

ThirdEye License

"threeparttable"

threeparttable License

"TMate"

TMate Open Source License

"TORQUE-1.1"

TORQUE v2.5+ Software License v1.1

"TOSL"

Trusster Open Source License

"TPDL"

Time::ParseDate License

"TPL-1.0"

THOR Public License 1.0

"TrustedQSL"

TrustedQSL License

"TTWL"

Text-Tabs+Wrap License

"TTYP0"

TTYP0 License

"TU-Berlin-1.0"

Technische Universitaet Berlin License 1.0

"TU-Berlin-2.0"

Technische Universitaet Berlin License 2.0

"Ubuntu-font-1.0"

Ubuntu Font Licence v1.0

"UCAR"

UCAR License

"UCL-1.0"

Upstream Compatibility License v1.0

"ulem"

ulem License

"UMich-Merit"

Michigan/Merit Networks License

"Unicode-3.0"

Unicode License v3

"Unicode-DFS-2015"

Unicode License Agreement - Data Files and Software (2015)

"Unicode-DFS-2016"

Unicode License Agreement - Data Files and Software (2016)

"Unicode-TOU"

Unicode Terms of Use

"UnixCrypt"

UnixCrypt License

"Unlicense"

The Unlicense

"Unlicense-libtelnet"

Unlicense - libtelnet variant

"Unlicense-libwhirlpool"

Unlicense - libwhirlpool variant

"UnRAR"

UnRAR License

"UPL-1.0"

Universal Permissive License v1.0

"URT-RLE"

Utah Raster Toolkit Run Length Encoded License

"Vim"

Vim License

"Vixie-Cron"

Vixie Cron License

"VOSTROM"

VOSTROM Public License for Open Source

"VSL-1.0"

Vovida Software License v1.0

"W3C"

W3C Software Notice and License (2002-12-31)

"W3C-19980720"

W3C Software Notice and License (1998-07-20)

"W3C-20150513"

W3C Software Notice and Document License (2015-05-13)

"w3m"

w3m License

"Watcom-1.0"

Sybase Open Watcom Public License 1.0

"Widget-Workshop"

Widget Workshop License

"WordNet"

WordNet License

"Wsuipa"

Wsuipa License

"WTFNMFPL"

Do What The F*ck You Want To But It's Not My Fault Public License

"WTFPL"

Do What The F*ck You Want To Public License

"wwl"

WWL License

"wxWindows"

wxWindows Library License

"X11"

X11 License

"X11-distribute-modifications-variant"

X11 License Distribution Modification Variant

"X11-no-permit-persons"

X11 no permit persons clause

"X11-swapped"

X11 swapped final paragraphs

"Xdebug-1.03"

Xdebug License v 1.03

"Xerox"

Xerox License

"Xfig"

Xfig License

"XFree86-1.1"

XFree86 License 1.1

"xinetd"

xinetd License

"xkeyboard-config-Zinoviev"

xkeyboard-config Zinoviev License

"xlock"

xlock License

"Xnet"

X.Net License

"xpp"

XPP License

"XSkat"

XSkat License

"xzoom"

xzoom License

"YPL-1.0"

Yahoo! Public License v1.0

"YPL-1.1"

Yahoo! Public License v1.1

"Zed"

Zed License

"Zeeff"

Zeeff License

"Zend-2.0"

Zend License v2.0

"Zimbra-1.3"

Zimbra Public License v1.3

"Zimbra-1.4"

Zimbra Public License v1.4

"Zlib"

zlib License

"zlib-acknowledgement"

zlib/libpng License with Acknowledgement

"ZPL-1.1"

Zope Public License 1.1

"ZPL-2.0"

Zope Public License 2.0

"ZPL-2.1"

Zope Public License 2.1

"389-exception"

389 Directory Server Exception

"Asterisk-exception"

Asterisk exception

"Asterisk-linking-protocols-exception"

Asterisk linking protocols exception

"Autoconf-exception-2.0"

Autoconf exception 2.0

"Autoconf-exception-3.0"

Autoconf exception 3.0

"Autoconf-exception-generic"

Autoconf generic exception

"Autoconf-exception-generic-3.0"

Autoconf generic exception for GPL-3.0

"Autoconf-exception-macro"

Autoconf macro exception

"Bison-exception-1.24"

Bison exception 1.24

"Bison-exception-2.2"

Bison exception 2.2

"Bootloader-exception"

Bootloader Distribution Exception

"CGAL-linking-exception"

CGAL Linking Exception

"Classpath-exception-2.0"

Classpath exception 2.0

"Classpath-exception-2.0-short"

Classpath exception 2.0 - short

"CLISP-exception-2.0"

CLISP exception 2.0

"cryptsetup-OpenSSL-exception"

cryptsetup OpenSSL exception

"Digia-Qt-LGPL-exception-1.1"

Digia Qt LGPL Exception version 1.1

"DigiRule-FOSS-exception"

DigiRule FOSS License Exception

"eCos-exception-2.0"

eCos exception 2.0

"erlang-otp-linking-exception"

Erlang/OTP Linking Exception

"Fawkes-Runtime-exception"

Fawkes Runtime Exception

"FLTK-exception"

FLTK exception

"fmt-exception"

fmt exception

"Font-exception-2.0"

Font exception 2.0

"freertos-exception-2.0"

FreeRTOS Exception 2.0

"GCC-exception-2.0"

GCC Runtime Library exception 2.0

"GCC-exception-2.0-note"

GCC Runtime Library exception 2.0 - note variant

"GCC-exception-3.1"

GCC Runtime Library exception 3.1

"Gmsh-exception"

Gmsh exception

"GNAT-exception"

GNAT exception

"GNOME-examples-exception"

GNOME examples exception

"GNU-compiler-exception"

GNU Compiler Exception

"gnu-javamail-exception"

GNU JavaMail exception

"GPL-3.0-389-ds-base-exception"

GPL-3.0 389 DS Base Exception

"GPL-3.0-interface-exception"

GPL-3.0 Interface Exception

"GPL-3.0-linking-exception"

GPL-3.0 Linking Exception

"GPL-3.0-linking-source-exception"

GPL-3.0 Linking Exception (with Corresponding Source)

"GPL-CC-1.0"

GPL Cooperation Commitment 1.0

"GStreamer-exception-2005"

GStreamer Exception (2005)

"GStreamer-exception-2008"

GStreamer Exception (2008)

"harbour-exception"

harbour exception

"i2p-gpl-java-exception"

i2p GPL+Java Exception

"Independent-modules-exception"

Independent Module Linking exception

"KiCad-libraries-exception"

KiCad Libraries Exception

"kvirc-openssl-exception"

kvirc OpenSSL Exception

"LGPL-3.0-linking-exception"

LGPL-3.0 Linking Exception

"libpri-OpenH323-exception"

libpri OpenH323 exception

"Libtool-exception"

Libtool Exception

"Linux-syscall-note"

Linux Syscall Note

"LLGPL"

LLGPL Preamble

"LLVM-exception"

LLVM Exception

"LZMA-exception"

LZMA exception

"mif-exception"

Macros and Inline Functions Exception

"mxml-exception"

mxml Exception

"Nokia-Qt-exception-1.1"

Nokia Qt LGPL exception 1.1

"OCaml-LGPL-linking-exception"

OCaml LGPL Linking Exception

"OCCT-exception-1.0"

Open CASCADE Exception 1.0

"OpenJDK-assembly-exception-1.0"

OpenJDK Assembly exception 1.0

"openvpn-openssl-exception"

OpenVPN OpenSSL Exception

"PCRE2-exception"

PCRE2 exception

"polyparse-exception"

Polyparse Exception

"PS-or-PDF-font-exception-20170817"

PS/PDF font exception (2017-08-17)

"QPL-1.0-INRIA-2004-exception"

INRIA QPL 1.0 2004 variant exception

"Qt-GPL-exception-1.0"

Qt GPL exception 1.0

"Qt-LGPL-exception-1.1"

Qt LGPL exception 1.1

"Qwt-exception-1.0"

Qwt exception 1.0

"romic-exception"

Romic Exception

"RRDtool-FLOSS-exception-2.0"

RRDtool FLOSS exception 2.0

"rsync-linking-exception"

rsync Linking Exception

"SANE-exception"

SANE Exception

"SHL-2.0"

Solderpad Hardware License v2.0

"SHL-2.1"

Solderpad Hardware License v2.1

"Simple-Library-Usage-exception"

Simple Library Usage Exception

"sqlitestudio-OpenSSL-exception"

sqlitestudio OpenSSL exception

"stunnel-exception"

stunnel Exception

"SWI-exception"

SWI exception

"Swift-exception"

Swift Exception

"Texinfo-exception"

Texinfo exception

"u-boot-exception-2.0"

U-Boot exception 2.0

"UBDL-exception"

Unmodified Binary Distribution exception

"Universal-FOSS-exception-1.0"

Universal FOSS Exception, Version 1.0

"vsftpd-openssl-exception"

vsftpd OpenSSL exception

"WxWindows-exception-3.1"

WxWindows Library Exception 3.1

"x11vnc-openssl-exception"

x11vnc OpenSSL Exception


Example:

"Apache-2.0"

Type: string

If SPDX does not define the license used, this field may be used to provide the license name


Example:

"Acme Software License"

Type: object

An optional way to include the textual content of a license.

No Additional Properties

Type: string Default: "text/plain"

Specifies the content type of the text. Defaults to text/plain if not specified.

Type: enum (of string)

Specifies the optional encoding the text is represented in.

Must be one of:

  • "base64"

Type: string

The attachment data. Proactive controls such as input validation and sanitization should be employed to prevent misuse of attachment text.

Type: stringFormat: iri-reference

The URL to the license file. If specified, a 'license' externalReference should also be specified for completeness


Example:

"https://www.apache.org/licenses/LICENSE-2.0.txt"

Type: string

Examples:

"Apache-2.0 AND (MIT OR GPL-2.0-only)"

"GPL-3.0-only WITH Classpath-exception-2.0"

Type: array

External references provide a way to document systems, sites, and information that may be relevant but which are not included with the BOM.

No Additional Items

Each item of this array must be:

Type: object

Specifies an individual external reference

No Additional Properties

Type: stringFormat: iri-reference

The URL to the external reference

Type: string

An optional comment describing the external reference

Type: enum (of string)

Specifies the type of external reference. There are built-in types to describe common references. If a type does not exist for the reference being referred to, use the "other" type.

Must be one of:

  • "vcs"
  • "issue-tracker"
  • "website"
  • "advisories"
  • "bom"
  • "mailing-list"
  • "social"
  • "chat"
  • "documentation"
  • "support"
  • "distribution"
  • "license"
  • "build-meta"
  • "build-system"
  • "release-notes"
  • "other"

Type: array

The hashes of the external reference (if applicable).

No Additional Items

Each item of this array must be:

Type: object
No Additional Properties

Type: enum (of string)

Must be one of:

  • "MD5"
  • "SHA-1"
  • "SHA-256"
  • "SHA-384"
  • "SHA-512"
  • "SHA3-256"
  • "SHA3-384"
  • "SHA3-512"
  • "BLAKE2b-256"
  • "BLAKE2b-384"
  • "BLAKE2b-512"
  • "BLAKE3"

Type: string
Must match regular expression: ^([a-fA-F0-9]{32}|[a-fA-F0-9]{40}|[a-fA-F0-9]{64}|[a-fA-F0-9]{96}|[a-fA-F0-9]{128})$
Example:

"3942447fac867ae5cdb3229b658f4d48"

Type: array

A list of services included or deployed behind the parent service. This is not a dependency tree. It provides a way to specify a hierarchical representation of service assemblies.

All items must be unique

No Additional Items

Each item of this array must be:

Type: object
Same definition as Service Object

Type: object

Specifies optional release notes.

No Additional Properties

Type: string

The software versioning type the release note describes.


Examples:

"major"

"minor"

"patch"

"pre-release"

"internal"

Type: string

The title of the release.

Type: stringFormat: iri-reference

The URL to an image that may be prominently displayed with the release note.

Type: stringFormat: iri-reference

The URL to an image that may be used in messaging on social media platforms.

Type: string

A short description of the release.

Type: stringFormat: date-time

The date and time (timestamp) when the release note was created.

Type: array of string

One or more alternate names the release may be referred to. This may include unofficial terms used by development and marketing teams (e.g. code names).

No Additional Items

Each item of this array must be:

Type: string

Type: array of string

One or more tags that may aid in search or retrieval of the release note.

No Additional Items

Each item of this array must be:

Type: string

Type: array

A collection of issues that have been resolved.

No Additional Items

Each item of this array must be:

Type: object

An individual issue that has been resolved.

No Additional Properties

Type: enum (of string)

Specifies the type of issue

Must be one of:

  • "defect"
  • "enhancement"
  • "security"

Type: string

The identifier of the issue assigned by the source of the issue

Type: string

The name of the issue

Type: string

A description of the issue

Type: object

The source of the issue where it is documented

No Additional Properties

Type: string

The name of the source. For example 'National Vulnerability Database', 'NVD', and 'Apache'

Type: stringFormat: iri-reference

The url of the issue documentation as provided by the source

Type: array of string

A collection of URL's for reference. Multiple URLs are allowed.

No Additional Items

Each item of this array must be:

Type: stringFormat: iri-reference

Example:

"https://example.com"

Type: array

Zero or more release notes containing the locale and content. Multiple note objects may be specified to support release notes in a wide variety of languages.

No Additional Items

Each item of this array must be:

Type: object

A note containing the locale and content.

No Additional Properties

Type: string

The ISO-639 (or higher) language code and optional ISO-3166 (or higher) country code. Examples include: "en", "en-US", "fr" and "fr-CA"

Must match regular expression: ^([a-z]{2})(-[A-Z]{2})?$

Type: object

Specifies the full content of the release note.

No Additional Properties

Type: string Default: "text/plain"

Specifies the content type of the text. Defaults to text/plain if not specified.

Type: enum (of string)

Specifies the optional encoding the text is represented in.

Must be one of:

  • "base64"

Type: string

The attachment data. Proactive controls such as input validation and sanitization should be employed to prevent misuse of attachment text.

Type: array

Provides the ability to document properties in a name-value store. This provides flexibility to include data not officially supported in the standard without having to use additional namespaces or create extensions. Unlike key-value stores, properties support duplicate names, each potentially having different values. Property names of interest to the general public are encouraged to be registered in the CycloneDX Property Taxonomy. Formal registration is OPTIONAL.

No Additional Items

Each item of this array must be:

Type: object

Type: string

The name of the property. Duplicate names are allowed, each potentially having a different value.

Type: string

The value of the property.

Type: array

Provides the ability to document properties in a name-value store. This provides flexibility to include data not officially supported in the standard without having to use additional namespaces or create extensions. Unlike key-value stores, properties support duplicate names, each potentially having different values. Property names of interest to the general public are encouraged to be registered in the CycloneDX Property Taxonomy. Formal registration is OPTIONAL.

No Additional Items

Each item of this array must be:

Type: object

Type: string

The name of the property. Duplicate names are allowed, each potentially having a different value.

Type: string

The value of the property.

Type: object

Enveloped signature in JSON Signature Format (JSF).

Type: object
No Additional Properties

Type: array

Unique top level property for Multiple Signatures. (multisignature)

No Additional Items

Each item of this array must be:

Type: object
No Additional Properties


Type: enum (of string)

Signature algorithm. The currently recognized JWA [RFC7518] and RFC8037 [RFC8037] asymmetric key algorithms. Note: Unlike RFC8037 [RFC8037] JSF requires explicit Ed* algorithm names instead of "EdDSA".

Must be one of:

  • "RS256"
  • "RS384"
  • "RS512"
  • "PS256"
  • "PS384"
  • "PS512"
  • "ES256"
  • "ES384"
  • "ES512"
  • "Ed25519"
  • "Ed448"
  • "HS256"
  • "HS384"
  • "HS512"
Type: stringFormat: uri

Signature algorithm. Note: If proprietary signature algorithms are added, they must be expressed as URIs.

Type: string

Optional. Application specific string identifying the signature key.

Type: object

Optional. Public key object.

Type: object

If the conditions in the "If" tab are respected, then the conditions in the "Then" tab should be respected. Otherwise, the conditions in the "Else" tab should be respected.

Type: object

Type: const
Type: object
No Additional Properties

Type: enum (of string)

Key type indicator.

Must be one of:

  • "EC"
  • "OKP"
  • "RSA"

Type: enum (of string)

EC curve name.

Must be one of:

  • "P-256"
  • "P-384"
  • "P-521"

Type: string

EC curve point X. The length of this field must be the full size of a coordinate for the curve specified in the "crv" parameter. For example, if the value of "crv" is "P-521", the decoded argument must be 66 bytes.

Type: string

EC curve point Y. The length of this field must be the full size of a coordinate for the curve specified in the "crv" parameter. For example, if the value of "crv" is "P-256", the decoded argument must be 32 bytes.

Type: object

If the conditions in the "If" tab are respected, then the conditions in the "Then" tab should be respected. Otherwise, the conditions in the "Else" tab should be respected.

Type: object

Type: const
Type: object
No Additional Properties

Type: enum (of string)

Key type indicator.

Must be one of:

  • "EC"
  • "OKP"
  • "RSA"

Type: enum (of string)

EdDSA curve name.

Must be one of:

  • "Ed25519"
  • "Ed448"

Type: string

EdDSA curve point X. The length of this field must be the full size of a coordinate for the curve specified in the "crv" parameter. For example, if the value of "crv" is "Ed25519", the decoded argument must be 32 bytes.

Type: object

If the conditions in the "If" tab are respected, then the conditions in the "Then" tab should be respected. Otherwise, the conditions in the "Else" tab should be respected.

Type: object

Type: const
Type: object
No Additional Properties

Type: enum (of string)

Key type indicator.

Must be one of:

  • "EC"
  • "OKP"
  • "RSA"

Type: string

RSA modulus.

Type: string

RSA exponent.

Type: enum (of string)

Key type indicator.

Must be one of:

  • "EC"
  • "OKP"
  • "RSA"

Additional Properties of any type are allowed.

Type: object

Type: array of string

Optional. Sorted array of X.509 [RFC5280] certificates, where the first element must contain the signature certificate. The certificate path must be contiguous but is not required to be complete.

No Additional Items

Each item of this array must be:

Type: string

Type: array of string

Optional. Array holding the names of one or more application level properties that must be excluded from the signature process. Note that the "excludes" property itself, must also be excluded from the signature process. Since both the "excludes" property and the associated data it points to are unsigned, a conforming JSF implementation must provide options for specifying which properties to accept.

No Additional Items

Each item of this array must be:

Type: string

Type: string

The signature data. Note that the binary representation must follow the JWA [RFC7518] specifications.

Type: object
No Additional Properties

Type: array

Unique top level property for Signature Chains. (signaturechain)

No Additional Items

Each item of this array must be:

Type: object
No Additional Properties


Type: enum (of string)

Signature algorithm. The currently recognized JWA [RFC7518] and RFC8037 [RFC8037] asymmetric key algorithms. Note: Unlike RFC8037 [RFC8037] JSF requires explicit Ed* algorithm names instead of "EdDSA".

Must be one of:

  • "RS256"
  • "RS384"
  • "RS512"
  • "PS256"
  • "PS384"
  • "PS512"
  • "ES256"
  • "ES384"
  • "ES512"
  • "Ed25519"
  • "Ed448"
  • "HS256"
  • "HS384"
  • "HS512"
Type: stringFormat: uri

Signature algorithm. Note: If proprietary signature algorithms are added, they must be expressed as URIs.

Type: string

Optional. Application specific string identifying the signature key.

Type: object

Optional. Public key object.

Type: object

If the conditions in the "If" tab are respected, then the conditions in the "Then" tab should be respected. Otherwise, the conditions in the "Else" tab should be respected.

Type: object

Type: const
Type: object
No Additional Properties

Type: enum (of string)

Key type indicator.

Must be one of:

  • "EC"
  • "OKP"
  • "RSA"

Type: enum (of string)

EC curve name.

Must be one of:

  • "P-256"
  • "P-384"
  • "P-521"

Type: string

EC curve point X. The length of this field must be the full size of a coordinate for the curve specified in the "crv" parameter. For example, if the value of "crv" is "P-521", the decoded argument must be 66 bytes.

Type: string

EC curve point Y. The length of this field must be the full size of a coordinate for the curve specified in the "crv" parameter. For example, if the value of "crv" is "P-256", the decoded argument must be 32 bytes.

Type: object

If the conditions in the "If" tab are respected, then the conditions in the "Then" tab should be respected. Otherwise, the conditions in the "Else" tab should be respected.

Type: object

Type: const
Type: object
No Additional Properties

Type: enum (of string)

Key type indicator.

Must be one of:

  • "EC"
  • "OKP"
  • "RSA"

Type: enum (of string)

EdDSA curve name.

Must be one of:

  • "Ed25519"
  • "Ed448"

Type: string

EdDSA curve point X. The length of this field must be the full size of a coordinate for the curve specified in the "crv" parameter. For example, if the value of "crv" is "Ed25519", the decoded argument must be 32 bytes.

Type: object

If the conditions in the "If" tab are respected, then the conditions in the "Then" tab should be respected. Otherwise, the conditions in the "Else" tab should be respected.

Type: object

Type: const
Type: object
No Additional Properties

Type: enum (of string)

Key type indicator.

Must be one of:

  • "EC"
  • "OKP"
  • "RSA"

Type: string

RSA modulus.

Type: string

RSA exponent.

Type: enum (of string)

Key type indicator.

Must be one of:

  • "EC"
  • "OKP"
  • "RSA"

Additional Properties of any type are allowed.

Type: object

Type: array of string

Optional. Sorted array of X.509 [RFC5280] certificates, where the first element must contain the signature certificate. The certificate path must be contiguous but is not required to be complete.

No Additional Items

Each item of this array must be:

Type: string

Type: array of string

Optional. Array holding the names of one or more application level properties that must be excluded from the signature process. Note that the "excludes" property itself, must also be excluded from the signature process. Since both the "excludes" property and the associated data it points to are unsigned, a conforming JSF implementation must provide options for specifying which properties to accept.

No Additional Items

Each item of this array must be:

Type: string

Type: string

The signature data. Note that the binary representation must follow the JWA [RFC7518] specifications.

Type: object

Unique top level property for simple signatures. (signaturecore)

No Additional Properties


Type: enum (of string)

Signature algorithm. The currently recognized JWA [RFC7518] and RFC8037 [RFC8037] asymmetric key algorithms. Note: Unlike RFC8037 [RFC8037] JSF requires explicit Ed* algorithm names instead of "EdDSA".

Must be one of:

  • "RS256"
  • "RS384"
  • "RS512"
  • "PS256"
  • "PS384"
  • "PS512"
  • "ES256"
  • "ES384"
  • "ES512"
  • "Ed25519"
  • "Ed448"
  • "HS256"
  • "HS384"
  • "HS512"
Type: stringFormat: uri

Signature algorithm. Note: If proprietary signature algorithms are added, they must be expressed as URIs.

Type: string

Optional. Application specific string identifying the signature key.

Type: object

Optional. Public key object.

Type: object

If the conditions in the "If" tab are respected, then the conditions in the "Then" tab should be respected. Otherwise, the conditions in the "Else" tab should be respected.

Type: object

Type: const
Type: object
No Additional Properties

Type: enum (of string)

Key type indicator.

Must be one of:

  • "EC"
  • "OKP"
  • "RSA"

Type: enum (of string)

EC curve name.

Must be one of:

  • "P-256"
  • "P-384"
  • "P-521"

Type: string

EC curve point X. The length of this field must be the full size of a coordinate for the curve specified in the "crv" parameter. For example, if the value of "crv" is "P-521", the decoded argument must be 66 bytes.

Type: string

EC curve point Y. The length of this field must be the full size of a coordinate for the curve specified in the "crv" parameter. For example, if the value of "crv" is "P-256", the decoded argument must be 32 bytes.

Type: object

If the conditions in the "If" tab are respected, then the conditions in the "Then" tab should be respected. Otherwise, the conditions in the "Else" tab should be respected.

Type: object

Type: const
Type: object
No Additional Properties

Type: enum (of string)

Key type indicator.

Must be one of:

  • "EC"
  • "OKP"
  • "RSA"

Type: enum (of string)

EdDSA curve name.

Must be one of:

  • "Ed25519"
  • "Ed448"

Type: string

EdDSA curve point X. The length of this field must be the full size of a coordinate for the curve specified in the "crv" parameter. For example, if the value of "crv" is "Ed25519", the decoded argument must be 32 bytes.

Type: object

If the conditions in the "If" tab are respected, then the conditions in the "Then" tab should be respected. Otherwise, the conditions in the "Else" tab should be respected.

Type: object

Type: const
Type: object
No Additional Properties

Type: enum (of string)

Key type indicator.

Must be one of:

  • "EC"
  • "OKP"
  • "RSA"

Type: string

RSA modulus.

Type: string

RSA exponent.

Type: enum (of string)

Key type indicator.

Must be one of:

  • "EC"
  • "OKP"
  • "RSA"

Additional Properties of any type are allowed.

Type: object

Type: array of string

Optional. Sorted array of X.509 [RFC5280] certificates, where the first element must contain the signature certificate. The certificate path must be contiguous but is not required to be complete.

No Additional Items

Each item of this array must be:

Type: string

Type: array of string

Optional. Array holding the names of one or more application level properties that must be excluded from the signature process. Note that the "excludes" property itself, must also be excluded from the signature process. Since both the "excludes" property and the associated data it points to are unsigned, a conforming JSF implementation must provide options for specifying which properties to accept.

No Additional Items

Each item of this array must be:

Type: string

Type: string

The signature data. Note that the binary representation must follow the JWA [RFC7518] specifications.

Type: array

External references provide a way to document systems, sites, and information that may be relevant but which are not included with the BOM.

No Additional Items

Each item of this array must be:

Type: object

Specifies an individual external reference

No Additional Properties

Type: stringFormat: iri-reference

The URL to the external reference

Type: string

An optional comment describing the external reference

Type: enum (of string)

Specifies the type of external reference. There are built-in types to describe common references. If a type does not exist for the reference being referred to, use the "other" type.

Must be one of:

  • "vcs"
  • "issue-tracker"
  • "website"
  • "advisories"
  • "bom"
  • "mailing-list"
  • "social"
  • "chat"
  • "documentation"
  • "support"
  • "distribution"
  • "license"
  • "build-meta"
  • "build-system"
  • "release-notes"
  • "other"

Type: array

The hashes of the external reference (if applicable).

No Additional Items

Each item of this array must be:

Type: object
No Additional Properties

Type: enum (of string)

Must be one of:

  • "MD5"
  • "SHA-1"
  • "SHA-256"
  • "SHA-384"
  • "SHA-512"
  • "SHA3-256"
  • "SHA3-384"
  • "SHA3-512"
  • "BLAKE2b-256"
  • "BLAKE2b-384"
  • "BLAKE2b-512"
  • "BLAKE3"

Type: string
Must match regular expression: ^([a-fA-F0-9]{32}|[a-fA-F0-9]{40}|[a-fA-F0-9]{64}|[a-fA-F0-9]{96}|[a-fA-F0-9]{128})$
Example:

"3942447fac867ae5cdb3229b658f4d48"

Type: array

Provides the ability to document dependency relationships.

All items must be unique

No Additional Items

Each item of this array must be:

Type: object

Defines the direct dependencies of a component. Components that do not have their own dependencies MUST be declared as empty elements within the graph. Components that are not represented in the dependency graph MAY have unknown dependencies. It is RECOMMENDED that implementations assume this to be opaque and not an indicator of a component being dependency-free.

No Additional Properties

Type: string

References a component by the components bom-ref attribute

Type: array

The bom-ref identifiers of the components that are dependencies of this dependency object.

All items must be unique

No Additional Items

Each item of this array must be:

Type: string

Type: array

Compositions describe constituent parts (including components, services, and dependency relationships) and their completeness.

All items must be unique

No Additional Items

Each item of this array must be:

Type: object
No Additional Properties

Type: enum (of string) Default: "not_specified"

Specifies an aggregate type that describe how complete a relationship is.

Must be one of:

  • "complete"
  • "incomplete"
  • "incomplete_first_party_only"
  • "incomplete_third_party_only"
  • "unknown"
  • "not_specified"

Type: array of string

The bom-ref identifiers of the components or services being described. Assemblies refer to nested relationships whereby a constituent part may include other constituent parts. References do not cascade to child parts. References are explicit for the specified constituent part only.

All items must be unique

No Additional Items

Each item of this array must be:

Type: string

Type: array of string

The bom-ref identifiers of the components or services being described. Dependencies refer to a relationship whereby an independent constituent part requires another independent constituent part. References do not cascade to transitive dependencies. References are explicit for the specified dependency only.

All items must be unique

No Additional Items

Each item of this array must be:

Type: string

Type: object

Enveloped signature in JSON Signature Format (JSF).

Type: object
No Additional Properties

Type: array

Unique top level property for Multiple Signatures. (multisignature)

No Additional Items

Each item of this array must be:

Type: object
No Additional Properties


Type: enum (of string)

Signature algorithm. The currently recognized JWA [RFC7518] and RFC8037 [RFC8037] asymmetric key algorithms. Note: Unlike RFC8037 [RFC8037] JSF requires explicit Ed* algorithm names instead of "EdDSA".

Must be one of:

  • "RS256"
  • "RS384"
  • "RS512"
  • "PS256"
  • "PS384"
  • "PS512"
  • "ES256"
  • "ES384"
  • "ES512"
  • "Ed25519"
  • "Ed448"
  • "HS256"
  • "HS384"
  • "HS512"
Type: stringFormat: uri

Signature algorithm. Note: If proprietary signature algorithms are added, they must be expressed as URIs.

Type: string

Optional. Application specific string identifying the signature key.

Type: object

Optional. Public key object.

Type: object

If the conditions in the "If" tab are respected, then the conditions in the "Then" tab should be respected. Otherwise, the conditions in the "Else" tab should be respected.

Type: object

Type: const
Type: object
No Additional Properties

Type: enum (of string)

Key type indicator.

Must be one of:

  • "EC"
  • "OKP"
  • "RSA"

Type: enum (of string)

EC curve name.

Must be one of:

  • "P-256"
  • "P-384"
  • "P-521"

Type: string

EC curve point X. The length of this field must be the full size of a coordinate for the curve specified in the "crv" parameter. For example, if the value of "crv" is "P-521", the decoded argument must be 66 bytes.

Type: string

EC curve point Y. The length of this field must be the full size of a coordinate for the curve specified in the "crv" parameter. For example, if the value of "crv" is "P-256", the decoded argument must be 32 bytes.

Type: object

If the conditions in the "If" tab are respected, then the conditions in the "Then" tab should be respected. Otherwise, the conditions in the "Else" tab should be respected.

Type: object

Type: const
Type: object
No Additional Properties

Type: enum (of string)

Key type indicator.

Must be one of:

  • "EC"
  • "OKP"
  • "RSA"

Type: enum (of string)

EdDSA curve name.

Must be one of:

  • "Ed25519"
  • "Ed448"

Type: string

EdDSA curve point X. The length of this field must be the full size of a coordinate for the curve specified in the "crv" parameter. For example, if the value of "crv" is "Ed25519", the decoded argument must be 32 bytes.

Type: object

If the conditions in the "If" tab are respected, then the conditions in the "Then" tab should be respected. Otherwise, the conditions in the "Else" tab should be respected.

Type: object

Type: const
Type: object
No Additional Properties

Type: enum (of string)

Key type indicator.

Must be one of:

  • "EC"
  • "OKP"
  • "RSA"

Type: string

RSA modulus.

Type: string

RSA exponent.

Type: enum (of string)

Key type indicator.

Must be one of:

  • "EC"
  • "OKP"
  • "RSA"

Additional Properties of any type are allowed.

Type: object

Type: array of string

Optional. Sorted array of X.509 [RFC5280] certificates, where the first element must contain the signature certificate. The certificate path must be contiguous but is not required to be complete.

No Additional Items

Each item of this array must be:

Type: string

Type: array of string

Optional. Array holding the names of one or more application level properties that must be excluded from the signature process. Note that the "excludes" property itself, must also be excluded from the signature process. Since both the "excludes" property and the associated data it points to are unsigned, a conforming JSF implementation must provide options for specifying which properties to accept.

No Additional Items

Each item of this array must be:

Type: string

Type: string

The signature data. Note that the binary representation must follow the JWA [RFC7518] specifications.

Type: object
No Additional Properties

Type: array

Unique top level property for Signature Chains. (signaturechain)

No Additional Items

Each item of this array must be:

Type: object
No Additional Properties


Type: enum (of string)

Signature algorithm. The currently recognized JWA [RFC7518] and RFC8037 [RFC8037] asymmetric key algorithms. Note: Unlike RFC8037 [RFC8037] JSF requires explicit Ed* algorithm names instead of "EdDSA".

Must be one of:

  • "RS256"
  • "RS384"
  • "RS512"
  • "PS256"
  • "PS384"
  • "PS512"
  • "ES256"
  • "ES384"
  • "ES512"
  • "Ed25519"
  • "Ed448"
  • "HS256"
  • "HS384"
  • "HS512"
Type: stringFormat: uri

Signature algorithm. Note: If proprietary signature algorithms are added, they must be expressed as URIs.

Type: string

Optional. Application specific string identifying the signature key.

Type: object

Optional. Public key object.

Type: object

If the conditions in the "If" tab are respected, then the conditions in the "Then" tab should be respected. Otherwise, the conditions in the "Else" tab should be respected.

Type: object

Type: const
Type: object
No Additional Properties

Type: enum (of string)

Key type indicator.

Must be one of:

  • "EC"
  • "OKP"
  • "RSA"

Type: enum (of string)

EC curve name.

Must be one of:

  • "P-256"
  • "P-384"
  • "P-521"

Type: string

EC curve point X. The length of this field must be the full size of a coordinate for the curve specified in the "crv" parameter. For example, if the value of "crv" is "P-521", the decoded argument must be 66 bytes.

Type: string

EC curve point Y. The length of this field must be the full size of a coordinate for the curve specified in the "crv" parameter. For example, if the value of "crv" is "P-256", the decoded argument must be 32 bytes.

Type: object

If the conditions in the "If" tab are respected, then the conditions in the "Then" tab should be respected. Otherwise, the conditions in the "Else" tab should be respected.

Type: object

Type: const
Type: object
No Additional Properties

Type: enum (of string)

Key type indicator.

Must be one of:

  • "EC"
  • "OKP"
  • "RSA"

Type: enum (of string)

EdDSA curve name.

Must be one of:

  • "Ed25519"
  • "Ed448"

Type: string

EdDSA curve point X. The length of this field must be the full size of a coordinate for the curve specified in the "crv" parameter. For example, if the value of "crv" is "Ed25519", the decoded argument must be 32 bytes.

Type: object

If the conditions in the "If" tab are respected, then the conditions in the "Then" tab should be respected. Otherwise, the conditions in the "Else" tab should be respected.

Type: object

Type: const
Type: object
No Additional Properties

Type: enum (of string)

Key type indicator.

Must be one of:

  • "EC"
  • "OKP"
  • "RSA"

Type: string

RSA modulus.

Type: string

RSA exponent.

Type: enum (of string)

Key type indicator.

Must be one of:

  • "EC"
  • "OKP"
  • "RSA"

Additional Properties of any type are allowed.

Type: object

Type: array of string

Optional. Sorted array of X.509 [RFC5280] certificates, where the first element must contain the signature certificate. The certificate path must be contiguous but is not required to be complete.

No Additional Items

Each item of this array must be:

Type: string

Type: array of string

Optional. Array holding the names of one or more application level properties that must be excluded from the signature process. Note that the "excludes" property itself, must also be excluded from the signature process. Since both the "excludes" property and the associated data it points to are unsigned, a conforming JSF implementation must provide options for specifying which properties to accept.

No Additional Items

Each item of this array must be:

Type: string

Type: string

The signature data. Note that the binary representation must follow the JWA [RFC7518] specifications.

Type: object

Unique top level property for simple signatures. (signaturecore)

No Additional Properties


Type: enum (of string)

Signature algorithm. The currently recognized JWA [RFC7518] and RFC8037 [RFC8037] asymmetric key algorithms. Note: Unlike RFC8037 [RFC8037] JSF requires explicit Ed* algorithm names instead of "EdDSA".

Must be one of:

  • "RS256"
  • "RS384"
  • "RS512"
  • "PS256"
  • "PS384"
  • "PS512"
  • "ES256"
  • "ES384"
  • "ES512"
  • "Ed25519"
  • "Ed448"
  • "HS256"
  • "HS384"
  • "HS512"
Type: stringFormat: uri

Signature algorithm. Note: If proprietary signature algorithms are added, they must be expressed as URIs.

Type: string

Optional. Application specific string identifying the signature key.

Type: object

Optional. Public key object.

Type: object

If the conditions in the "If" tab are respected, then the conditions in the "Then" tab should be respected. Otherwise, the conditions in the "Else" tab should be respected.

Type: object

Type: const
Type: object
No Additional Properties

Type: enum (of string)

Key type indicator.

Must be one of:

  • "EC"
  • "OKP"
  • "RSA"

Type: enum (of string)

EC curve name.

Must be one of:

  • "P-256"
  • "P-384"
  • "P-521"

Type: string

EC curve point X. The length of this field must be the full size of a coordinate for the curve specified in the "crv" parameter. For example, if the value of "crv" is "P-521", the decoded argument must be 66 bytes.

Type: string

EC curve point Y. The length of this field must be the full size of a coordinate for the curve specified in the "crv" parameter. For example, if the value of "crv" is "P-256", the decoded argument must be 32 bytes.

Type: object

If the conditions in the "If" tab are respected, then the conditions in the "Then" tab should be respected. Otherwise, the conditions in the "Else" tab should be respected.

Type: object

Type: const
Type: object
No Additional Properties

Type: enum (of string)

Key type indicator.

Must be one of:

  • "EC"
  • "OKP"
  • "RSA"

Type: enum (of string)

EdDSA curve name.

Must be one of:

  • "Ed25519"
  • "Ed448"

Type: string

EdDSA curve point X. The length of this field must be the full size of a coordinate for the curve specified in the "crv" parameter. For example, if the value of "crv" is "Ed25519", the decoded argument must be 32 bytes.

Type: object

If the conditions in the "If" tab are respected, then the conditions in the "Then" tab should be respected. Otherwise, the conditions in the "Else" tab should be respected.

Type: object

Type: const
Type: object
No Additional Properties

Type: enum (of string)

Key type indicator.

Must be one of:

  • "EC"
  • "OKP"
  • "RSA"

Type: string

RSA modulus.

Type: string

RSA exponent.

Type: enum (of string)

Key type indicator.

Must be one of:

  • "EC"
  • "OKP"
  • "RSA"

Additional Properties of any type are allowed.

Type: object

Type: array of string

Optional. Sorted array of X.509 [RFC5280] certificates, where the first element must contain the signature certificate. The certificate path must be contiguous but is not required to be complete.

No Additional Items

Each item of this array must be:

Type: string

Type: array of string

Optional. Array holding the names of one or more application level properties that must be excluded from the signature process. Note that the "excludes" property itself, must also be excluded from the signature process. Since both the "excludes" property and the associated data it points to are unsigned, a conforming JSF implementation must provide options for specifying which properties to accept.

No Additional Items

Each item of this array must be:

Type: string

Type: string

The signature data. Note that the binary representation must follow the JWA [RFC7518] specifications.

Type: array

Vulnerabilities identified in components or services.

All items must be unique

No Additional Items

Each item of this array must be:

Type: object

Defines a weakness in an component or service that could be exploited or triggered by a threat source.

No Additional Properties

Type: string

An optional identifier which can be used to reference the vulnerability elsewhere in the BOM. Every bom-ref MUST be unique within the BOM.

Type: string

The identifier that uniquely identifies the vulnerability.


Examples:

"CVE-2021-39182"

"GHSA-35m5-8cvj-8783"

"SNYK-PYTHON-ENROCRYPT-1912876"

Type: object

The source that published the vulnerability.

No Additional Properties

Type: string

The url of the vulnerability documentation as provided by the source.


Example:

"https://nvd.nist.gov/vuln/detail/CVE-2021-39182"

Type: string

The name of the source.


Examples:

"NVD"

"National Vulnerability Database"

"OSS Index"

"VulnDB"

"GitHub Advisories"

Type: array

Zero or more pointers to vulnerabilities that are the equivalent of the vulnerability specified. Often times, the same vulnerability may exist in multiple sources of vulnerability intelligence, but have different identifiers. References provide a way to correlate vulnerabilities across multiple sources of vulnerability intelligence.

No Additional Items

Each item of this array must be:

Type: object
No Additional Properties

Type: string

An identifier that uniquely identifies the vulnerability.


Examples:

"CVE-2021-39182"

"GHSA-35m5-8cvj-8783"

"SNYK-PYTHON-ENROCRYPT-1912876"

Type: object

The source that published the vulnerability.

No Additional Properties

Type: string

The url of the vulnerability documentation as provided by the source.


Example:

"https://nvd.nist.gov/vuln/detail/CVE-2021-39182"

Type: string

The name of the source.


Examples:

"NVD"

"National Vulnerability Database"

"OSS Index"

"VulnDB"

"GitHub Advisories"

Type: array

List of vulnerability ratings

No Additional Items

Each item of this array must be:

Type: object

Defines the severity or risk ratings of a vulnerability.

No Additional Properties

Type: object

The source that calculated the severity or risk rating of the vulnerability.

No Additional Properties

Type: string

The url of the vulnerability documentation as provided by the source.


Example:

"https://nvd.nist.gov/vuln/detail/CVE-2021-39182"

Type: string

The name of the source.


Examples:

"NVD"

"National Vulnerability Database"

"OSS Index"

"VulnDB"

"GitHub Advisories"

Type: number

The numerical score of the rating.

Type: enum (of string)

Textual representation of the severity that corresponds to the numerical score of the rating.

Must be one of:

  • "critical"
  • "high"
  • "medium"
  • "low"
  • "info"
  • "none"
  • "unknown"

Type: enum (of string)

Specifies the severity or risk scoring methodology or standard used.

Must be one of:

  • "CVSSv2"
  • "CVSSv3"
  • "CVSSv31"
  • "OWASP"
  • "other"

Type: string

Textual representation of the metric values used to score the vulnerability

Type: string

An optional reason for rating the vulnerability as it was

Type: array

List of Common Weaknesses Enumerations (CWEs) codes that describes this vulnerability. For example 399 (of https://cwe.mitre.org/data/definitions/399.html)

No Additional Items

Each item of this array must be:

Type: integer

Integer representation of a Common Weaknesses Enumerations (CWE). For example 399 (of https://cwe.mitre.org/data/definitions/399.html)

Value must be greater or equal to 1


Example:

399

Type: string

A description of the vulnerability as provided by the source.

Type: string

If available, an in-depth description of the vulnerability as provided by the source organization. Details often include examples, proof-of-concepts, and other information useful in understanding root cause.

Type: string

Recommendations of how the vulnerability can be remediated or mitigated.

Type: array

Published advisories of the vulnerability if provided.

No Additional Items

Each item of this array must be:

Type: object

Title and location where advisory information can be obtained. An advisory is a notification of a threat to a component, service, or system.

No Additional Properties

Type: string

An optional name of the advisory.

Type: stringFormat: iri-reference

Location where the advisory can be obtained.

Type: stringFormat: date-time

The date and time (timestamp) when the vulnerability record was created in the vulnerability database.

Type: stringFormat: date-time

The date and time (timestamp) when the vulnerability record was first published.

Type: stringFormat: date-time

The date and time (timestamp) when the vulnerability record was last updated.

Type: object

Individuals or organizations credited with the discovery of the vulnerability.

No Additional Properties

Type: array

The organizations credited with vulnerability discovery.

No Additional Items

Each item of this array must be:

Type: object
No Additional Properties

Type: string

The name of the organization


Example:

"Example Inc."

Type: array of string

The URL of the organization. Multiple URLs are allowed.

No Additional Items

Each item of this array must be:

Type: stringFormat: iri-reference

Example:

"https://example.com"

Type: array

A contact at the organization. Multiple contacts are allowed.

No Additional Items

Each item of this array must be:

Type: object
No Additional Properties

Type: string

The name of a contact


Example:

"Contact name"

Type: stringFormat: idn-email

The email address of the contact.


Example:

Type: string

The phone number of the contact.


Example:

"800-555-1212"

Type: array

The individuals, not associated with organizations, that are credited with vulnerability discovery.

No Additional Items

Each item of this array must be:

Type: object
No Additional Properties

Type: string

The name of a contact


Example:

"Contact name"

Type: stringFormat: idn-email

The email address of the contact.


Example:

Type: string

The phone number of the contact.


Example:

"800-555-1212"

Type: array

The tool(s) used to identify, confirm, or score the vulnerability.

No Additional Items

Each item of this array must be:

Type: object

Information about the automated or manual tool used

No Additional Properties

Type: string

The name of the vendor who created the tool

Type: string

The name of the tool

Type: string

The version of the tool

Type: array

The hashes of the tool (if applicable).

No Additional Items

Each item of this array must be:

Type: object
No Additional Properties

Type: enum (of string)

Must be one of:

  • "MD5"
  • "SHA-1"
  • "SHA-256"
  • "SHA-384"
  • "SHA-512"
  • "SHA3-256"
  • "SHA3-384"
  • "SHA3-512"
  • "BLAKE2b-256"
  • "BLAKE2b-384"
  • "BLAKE2b-512"
  • "BLAKE3"

Type: string
Must match regular expression: ^([a-fA-F0-9]{32}|[a-fA-F0-9]{40}|[a-fA-F0-9]{64}|[a-fA-F0-9]{96}|[a-fA-F0-9]{128})$
Example:

"3942447fac867ae5cdb3229b658f4d48"

Type: array

External references provide a way to document systems, sites, and information that may be relevant but which are not included with the BOM.

No Additional Items

Each item of this array must be:

Type: object

Specifies an individual external reference

No Additional Properties

Type: stringFormat: iri-reference

The URL to the external reference

Type: string

An optional comment describing the external reference

Type: enum (of string)

Specifies the type of external reference. There are built-in types to describe common references. If a type does not exist for the reference being referred to, use the "other" type.

Must be one of:

  • "vcs"
  • "issue-tracker"
  • "website"
  • "advisories"
  • "bom"
  • "mailing-list"
  • "social"
  • "chat"
  • "documentation"
  • "support"
  • "distribution"
  • "license"
  • "build-meta"
  • "build-system"
  • "release-notes"
  • "other"

Type: array

The hashes of the external reference (if applicable).

No Additional Items

Each item of this array must be:

Type: object
No Additional Properties

Type: enum (of string)

Must be one of:

  • "MD5"
  • "SHA-1"
  • "SHA-256"
  • "SHA-384"
  • "SHA-512"
  • "SHA3-256"
  • "SHA3-384"
  • "SHA3-512"
  • "BLAKE2b-256"
  • "BLAKE2b-384"
  • "BLAKE2b-512"
  • "BLAKE3"

Type: string
Must match regular expression: ^([a-fA-F0-9]{32}|[a-fA-F0-9]{40}|[a-fA-F0-9]{64}|[a-fA-F0-9]{96}|[a-fA-F0-9]{128})$
Example:

"3942447fac867ae5cdb3229b658f4d48"

Type: object

An assessment of the impact and exploitability of the vulnerability.

No Additional Properties

Type: enum (of string)

Declares the current state of an occurrence of a vulnerability, after automated or manual analysis.

  • resolved = the vulnerability has been remediated.
  • resolved_with_pedigree = the vulnerability has been remediated and evidence of the changes are provided in the affected components pedigree containing verifiable commit history and/or diff(s).
  • exploitable = the vulnerability may be directly or indirectly exploitable.
  • in_triage = the vulnerability is being investigated.
  • false_positive = the vulnerability is not specific to the component or service and was falsely identified or associated.
  • not_affected = the component or service is not affected by the vulnerability. Justification should be specified for all not_affected cases.

Must be one of:

  • "resolved"
  • "resolved_with_pedigree"
  • "exploitable"
  • "in_triage"
  • "false_positive"
  • "not_affected"

Type: enum (of string)

The rationale of why the impact analysis state was asserted.

  • code_not_present = the code has been removed or tree-shaked.
  • code_not_reachable = the vulnerable code is not invoked at runtime.
  • requires_configuration = exploitability requires a configurable option to be set/unset.
  • requires_dependency = exploitability requires a dependency that is not present.
  • requires_environment = exploitability requires a certain environment which is not present.
  • protected_by_compiler = exploitability requires a compiler flag to be set/unset.
  • protected_at_runtime = exploits are prevented at runtime.
  • protected_at_perimeter = attacks are blocked at physical, logical, or network perimeter.
  • protected_by_mitigating_control = preventative measures have been implemented that reduce the likelihood and/or impact of the vulnerability.

Must be one of:

  • "code_not_present"
  • "code_not_reachable"
  • "requires_configuration"
  • "requires_dependency"
  • "requires_environment"
  • "protected_by_compiler"
  • "protected_at_runtime"
  • "protected_at_perimeter"
  • "protected_by_mitigating_control"

Type: array of enum (of string)

A response to the vulnerability by the manufacturer, supplier, or project responsible for the affected component or service. More than one response is allowed. Responses are strongly encouraged for vulnerabilities where the analysis state is exploitable.

No Additional Items

Each item of this array must be:

Type: enum (of string)

Must be one of:

  • "can_not_fix"
  • "will_not_fix"
  • "update"
  • "rollback"
  • "workaround_available"

Type: string

Detailed description of the impact including methods used during assessment. If a vulnerability is not exploitable, this field should include specific details on why the component or service is not impacted by this vulnerability.

Type: array

The components or services that are affected by the vulnerability.

All items must be unique

No Additional Items

Each item of this array must be:

Type: object
No Additional Properties

Type: string

References a component or service by the objects bom-ref

Type: array

Zero or more individual versions or range of versions.

No Additional Items

Each item of this array must be:


No Additional Properties

Type: object

The following properties are required:

  • version
Type: object

The following properties are required:

  • range

Type: string

A single version of a component or service.

Must be at least 1 characters long

Must be at most 1024 characters long

Type: string

A version range specified in Package URL Version Range syntax (vers) which is defined at https://github.com/package-url/vers-spec

Must be at least 1 characters long

Must be at most 1024 characters long

Type: enum (of string) Default: "affected"

The vulnerability status for the version or range of versions.

Must be one of:

  • "affected"
  • "unaffected"
  • "unknown"

Type: array

Provides the ability to document properties in a name-value store. This provides flexibility to include data not officially supported in the standard without having to use additional namespaces or create extensions. Unlike key-value stores, properties support duplicate names, each potentially having different values. Property names of interest to the general public are encouraged to be registered in the CycloneDX Property Taxonomy. Formal registration is OPTIONAL.

No Additional Items

Each item of this array must be:

Type: object

Type: string

The name of the property. Duplicate names are allowed, each potentially having a different value.

Type: string

The value of the property.

Type: object

Enveloped signature in JSON Signature Format (JSF).

Type: object
No Additional Properties

Type: array

Unique top level property for Multiple Signatures. (multisignature)

No Additional Items

Each item of this array must be:

Type: object
No Additional Properties


Type: enum (of string)

Signature algorithm. The currently recognized JWA [RFC7518] and RFC8037 [RFC8037] asymmetric key algorithms. Note: Unlike RFC8037 [RFC8037] JSF requires explicit Ed* algorithm names instead of "EdDSA".

Must be one of:

  • "RS256"
  • "RS384"
  • "RS512"
  • "PS256"
  • "PS384"
  • "PS512"
  • "ES256"
  • "ES384"
  • "ES512"
  • "Ed25519"
  • "Ed448"
  • "HS256"
  • "HS384"
  • "HS512"
Type: stringFormat: uri

Signature algorithm. Note: If proprietary signature algorithms are added, they must be expressed as URIs.

Type: string

Optional. Application specific string identifying the signature key.

Type: object

Optional. Public key object.

Type: object

If the conditions in the "If" tab are respected, then the conditions in the "Then" tab should be respected. Otherwise, the conditions in the "Else" tab should be respected.

Type: object

Type: const
Type: object
No Additional Properties

Type: enum (of string)

Key type indicator.

Must be one of:

  • "EC"
  • "OKP"
  • "RSA"

Type: enum (of string)

EC curve name.

Must be one of:

  • "P-256"
  • "P-384"
  • "P-521"

Type: string

EC curve point X. The length of this field must be the full size of a coordinate for the curve specified in the "crv" parameter. For example, if the value of "crv" is "P-521", the decoded argument must be 66 bytes.

Type: string

EC curve point Y. The length of this field must be the full size of a coordinate for the curve specified in the "crv" parameter. For example, if the value of "crv" is "P-256", the decoded argument must be 32 bytes.

Type: object

If the conditions in the "If" tab are respected, then the conditions in the "Then" tab should be respected. Otherwise, the conditions in the "Else" tab should be respected.

Type: object

Type: const
Type: object
No Additional Properties

Type: enum (of string)

Key type indicator.

Must be one of:

  • "EC"
  • "OKP"
  • "RSA"

Type: enum (of string)

EdDSA curve name.

Must be one of:

  • "Ed25519"
  • "Ed448"

Type: string

EdDSA curve point X. The length of this field must be the full size of a coordinate for the curve specified in the "crv" parameter. For example, if the value of "crv" is "Ed25519", the decoded argument must be 32 bytes.

Type: object

If the conditions in the "If" tab are respected, then the conditions in the "Then" tab should be respected. Otherwise, the conditions in the "Else" tab should be respected.

Type: object

Type: const
Type: object
No Additional Properties

Type: enum (of string)

Key type indicator.

Must be one of:

  • "EC"
  • "OKP"
  • "RSA"

Type: string

RSA modulus.

Type: string

RSA exponent.

Type: enum (of string)

Key type indicator.

Must be one of:

  • "EC"
  • "OKP"
  • "RSA"

Additional Properties of any type are allowed.

Type: object

Type: array of string

Optional. Sorted array of X.509 [RFC5280] certificates, where the first element must contain the signature certificate. The certificate path must be contiguous but is not required to be complete.

No Additional Items

Each item of this array must be:

Type: string

Type: array of string

Optional. Array holding the names of one or more application level properties that must be excluded from the signature process. Note that the "excludes" property itself, must also be excluded from the signature process. Since both the "excludes" property and the associated data it points to are unsigned, a conforming JSF implementation must provide options for specifying which properties to accept.

No Additional Items

Each item of this array must be:

Type: string

Type: string

The signature data. Note that the binary representation must follow the JWA [RFC7518] specifications.

Type: object
No Additional Properties

Type: array

Unique top level property for Signature Chains. (signaturechain)

No Additional Items

Each item of this array must be:

Type: object
No Additional Properties


Type: enum (of string)

Signature algorithm. The currently recognized JWA [RFC7518] and RFC8037 [RFC8037] asymmetric key algorithms. Note: Unlike RFC8037 [RFC8037] JSF requires explicit Ed* algorithm names instead of "EdDSA".

Must be one of:

  • "RS256"
  • "RS384"
  • "RS512"
  • "PS256"
  • "PS384"
  • "PS512"
  • "ES256"
  • "ES384"
  • "ES512"
  • "Ed25519"
  • "Ed448"
  • "HS256"
  • "HS384"
  • "HS512"
Type: stringFormat: uri

Signature algorithm. Note: If proprietary signature algorithms are added, they must be expressed as URIs.

Type: string

Optional. Application specific string identifying the signature key.

Type: object

Optional. Public key object.

Type: object

If the conditions in the "If" tab are respected, then the conditions in the "Then" tab should be respected. Otherwise, the conditions in the "Else" tab should be respected.

Type: object

Type: const
Type: object
No Additional Properties

Type: enum (of string)

Key type indicator.

Must be one of:

  • "EC"
  • "OKP"
  • "RSA"

Type: enum (of string)

EC curve name.

Must be one of:

  • "P-256"
  • "P-384"
  • "P-521"

Type: string

EC curve point X. The length of this field must be the full size of a coordinate for the curve specified in the "crv" parameter. For example, if the value of "crv" is "P-521", the decoded argument must be 66 bytes.

Type: string

EC curve point Y. The length of this field must be the full size of a coordinate for the curve specified in the "crv" parameter. For example, if the value of "crv" is "P-256", the decoded argument must be 32 bytes.

Type: object

If the conditions in the "If" tab are respected, then the conditions in the "Then" tab should be respected. Otherwise, the conditions in the "Else" tab should be respected.

Type: object

Type: const
Type: object
No Additional Properties

Type: enum (of string)

Key type indicator.

Must be one of:

  • "EC"
  • "OKP"
  • "RSA"

Type: enum (of string)

EdDSA curve name.

Must be one of:

  • "Ed25519"
  • "Ed448"

Type: string

EdDSA curve point X. The length of this field must be the full size of a coordinate for the curve specified in the "crv" parameter. For example, if the value of "crv" is "Ed25519", the decoded argument must be 32 bytes.

Type: object

If the conditions in the "If" tab are respected, then the conditions in the "Then" tab should be respected. Otherwise, the conditions in the "Else" tab should be respected.

Type: object

Type: const
Type: object
No Additional Properties

Type: enum (of string)

Key type indicator.

Must be one of:

  • "EC"
  • "OKP"
  • "RSA"

Type: string

RSA modulus.

Type: string

RSA exponent.

Type: enum (of string)

Key type indicator.

Must be one of:

  • "EC"
  • "OKP"
  • "RSA"

Additional Properties of any type are allowed.

Type: object

Type: array of string

Optional. Sorted array of X.509 [RFC5280] certificates, where the first element must contain the signature certificate. The certificate path must be contiguous but is not required to be complete.

No Additional Items

Each item of this array must be:

Type: string

Type: array of string

Optional. Array holding the names of one or more application level properties that must be excluded from the signature process. Note that the "excludes" property itself, must also be excluded from the signature process. Since both the "excludes" property and the associated data it points to are unsigned, a conforming JSF implementation must provide options for specifying which properties to accept.

No Additional Items

Each item of this array must be:

Type: string

Type: string

The signature data. Note that the binary representation must follow the JWA [RFC7518] specifications.

Type: object

Unique top level property for simple signatures. (signaturecore)

No Additional Properties


Type: enum (of string)

Signature algorithm. The currently recognized JWA [RFC7518] and RFC8037 [RFC8037] asymmetric key algorithms. Note: Unlike RFC8037 [RFC8037] JSF requires explicit Ed* algorithm names instead of "EdDSA".

Must be one of:

  • "RS256"
  • "RS384"
  • "RS512"
  • "PS256"
  • "PS384"
  • "PS512"
  • "ES256"
  • "ES384"
  • "ES512"
  • "Ed25519"
  • "Ed448"
  • "HS256"
  • "HS384"
  • "HS512"
Type: stringFormat: uri

Signature algorithm. Note: If proprietary signature algorithms are added, they must be expressed as URIs.

Type: string

Optional. Application specific string identifying the signature key.

Type: object

Optional. Public key object.

Type: object

If the conditions in the "If" tab are respected, then the conditions in the "Then" tab should be respected. Otherwise, the conditions in the "Else" tab should be respected.

Type: object

Type: const
Type: object
No Additional Properties

Type: enum (of string)

Key type indicator.

Must be one of:

  • "EC"
  • "OKP"
  • "RSA"

Type: enum (of string)

EC curve name.

Must be one of:

  • "P-256"
  • "P-384"
  • "P-521"

Type: string

EC curve point X. The length of this field must be the full size of a coordinate for the curve specified in the "crv" parameter. For example, if the value of "crv" is "P-521", the decoded argument must be 66 bytes.

Type: string

EC curve point Y. The length of this field must be the full size of a coordinate for the curve specified in the "crv" parameter. For example, if the value of "crv" is "P-256", the decoded argument must be 32 bytes.

Type: object

If the conditions in the "If" tab are respected, then the conditions in the "Then" tab should be respected. Otherwise, the conditions in the "Else" tab should be respected.

Type: object

Type: const
Type: object
No Additional Properties

Type: enum (of string)

Key type indicator.

Must be one of:

  • "EC"
  • "OKP"
  • "RSA"

Type: enum (of string)

EdDSA curve name.

Must be one of:

  • "Ed25519"
  • "Ed448"

Type: string

EdDSA curve point X. The length of this field must be the full size of a coordinate for the curve specified in the "crv" parameter. For example, if the value of "crv" is "Ed25519", the decoded argument must be 32 bytes.

Type: object

If the conditions in the "If" tab are respected, then the conditions in the "Then" tab should be respected. Otherwise, the conditions in the "Else" tab should be respected.

Type: object

Type: const
Type: object
No Additional Properties

Type: enum (of string)

Key type indicator.

Must be one of:

  • "EC"
  • "OKP"
  • "RSA"

Type: string

RSA modulus.

Type: string

RSA exponent.

Type: enum (of string)

Key type indicator.

Must be one of:

  • "EC"
  • "OKP"
  • "RSA"

Additional Properties of any type are allowed.

Type: object

Type: array of string

Optional. Sorted array of X.509 [RFC5280] certificates, where the first element must contain the signature certificate. The certificate path must be contiguous but is not required to be complete.

No Additional Items

Each item of this array must be:

Type: string

Type: array of string

Optional. Array holding the names of one or more application level properties that must be excluded from the signature process. Note that the "excludes" property itself, must also be excluded from the signature process. Since both the "excludes" property and the associated data it points to are unsigned, a conforming JSF implementation must provide options for specifying which properties to accept.

No Additional Items

Each item of this array must be:

Type: string

Type: string

The signature data. Note that the binary representation must follow the JWA [RFC7518] specifications.