Curation guideline

Ckresse — Mon, 23 Mar 2026 07:43:00 GMT

Adapt to consider new FOSSology version and Github actions

← Older revision		Revision as of 09:43, 23 March 2026
Line 105:		Line 105:

	==== Both reports ====		==== Both reports ====
	* Set line break to 80 characters.		* Set line break to 80 characters for license texts (please note: Not for the entire SPDX file, as this will break checksums and render an invalid SPDX report)
	* Remove empty lines.		* Remove empty lines.

Line 122:		Line 122:
	* ''PackageLicenseConcluded:'' NOASSERTION		* ''PackageLicenseConcluded:'' NOASSERTION
	* (Not required for FOSSology versions 4.3 or higher) If main license is not a template license text, add correct customized license reference to ''PackageLicenseDeclared''.		* (Not required for FOSSology versions 4.3 or higher) If main license is not a template license text, add correct customized license reference to ''PackageLicenseDeclared''.
	* Dual licensing conclusions: Remove "LicenseRef-Dual-license" and correct AND operator to OR (e.g. LicenseA AND LicenseB AND LicenseRef-Dual-license → LicenseA OR LicenseB). ~~If there is dual licensing and multiple licenses, be~~ aware of the SPDX operator hierarchy (default order of precedence: WITH, AND, OR)~~. For only two licenses, this is not required for FOSSology versions 4.3 or higher, but for three or more licenses, manual editing is still necessary~~.		* Dual licensing conclusions: In cases where more than two licenses are involved, manual post-processing is required. Remove "LicenseRef-Dual-license" and correct AND operator to the correct SPDX license expression (e.g. LicenseA AND LicenseB AND LicenseC AND LicenseRef-Dual-license → (LicenseA OR LicenseB) AND LicenseC). Be aware of the SPDX operator hierarchy (default order of precedence: WITH, AND, OR).
	* As the SPDX standard does not contain template license texts but the OSSelot variant does, we need to add the prefix "LicenseRef-" to all license IDs that do not yet carry it to obtain a valid SPDX document. See patch in [[FOSSology#Customization]].		* As the SPDX standard does not contain template license texts but the OSSelot variant does, we need to add the prefix "LicenseRef-" to all license IDs that do not yet carry it to obtain a valid SPDX document. See patch in [[FOSSology#Customization]]. From FOSSology 4.6 and higher, this is included when selecting the report setting "Enable OSSelot export" for the SPDX report.

	The SPDX tag:value file ~~must~~ be validated either with the [https://tools.spdx.org/app/ SPDX online tools] or with the [https://github.com/spdx/tools-java CLI tools]. ~~When the SPDX tag:value file is valid, convert~~ to spdx.json, spdx.rdf.xml, spdx.yaml formats.		The SPDX tag:value file should be validated either with the [https://tools.spdx.org/app/ SPDX online tools] or with the [https://github.com/spdx/tools-java CLI tools], however, the report will also be validated on merge into the Github repository. The conversion to spdx.json, spdx.rdf.xml, spdx.yaml formats will also be automatically done at merge.

	== Contribution ==		== Contribution ==
Line 131:		Line 131:
	* README with download URL, purl, creator name		* README with download URL, purl, creator name
	* OSS disclosure file		* OSS disclosure file
	* SPDX tag:value file
	* SPDX json file
	* SPDX rdf.xml file
	* SPDX yaml file

	To contribute, the repository [https://github.com/Open-Source-Compliance/package-analysis https://github.com/Open-Source-Compliance/package-analysis] must be forked and a pull request must be created.		To contribute, the repository [https://github.com/Open-Source-Compliance/package-analysis https://github.com/Open-Source-Compliance/package-analysis] must be forked and a pull request must be created.

OSSelot - Recent changes [en]

Curation guideline