diff --git a/README.md b/README.md index 94f91e2969..a1e6d47e67 100644 --- a/README.md +++ b/README.md @@ -1,33 +1,227 @@ # The System Package Data Exchange (SPDX®) Specification -The System Package Data Exchange (SPDX®) specification is an open standard capable of representing systems with software components in as SBOMs (Software Bill of Materials) and other AI, data and security references supporting a range of risk management use cases. +The System Package Data Exchange (SPDX®) specification is an open standard +capable of representing systems with software components in as SBOMs +(Software Bill of Materials) and other AI, data and security references +supporting a range of risk management use cases. -The SPDX standard helps facilitate compliance with free and open source software licenses by standardizing the way license information is shared across the software supply chain. SPDX reduces redundant work by providing a common format for companies and communities to share important data about software licenses and copyrights, thereby streamlining and improving compliance. +The SPDX standard helps facilitate compliance with free and open source +software licenses by standardizing the way license information is shared across +the software supply chain. SPDX reduces redundant work by providing a common +format for companies and communities to share important data about software +licenses and copyrights, thereby streamlining and improving compliance. This repository holds under active development version of the specification as: -* [MarkDown](https://github.com/spdx/spdx-spec/tree/master/chapters) (`master` branch) -* HTML (gh-pages branch, built on every commit to `master` and `development/` branches) - * [Current](https://spdx.github.io/spdx-spec/v3.0/) +- Markdown: + [`development/v3.0.1`](https://github.com/spdx/spdx-spec/tree/development/v3.0.1/docs) + branch +- HTML: `gh-pages` branch, built on every commit to the development branch, + see the workflow in + [`.github/workflows/publish_v3.yml`](.github/workflows/publish_v3.yml) + - Current (3.0): -See for the official [releases of the specification](https://spdx.org/specifications) or additional information also the [SPDX website](https://spdx.org). +The model itself is under active development at +[spdx/spdx-3-model](https://github.com/spdx/spdx-3-model/) +repo (`main` branch). -## Specification Structure +See for the official +[releases of the specification](https://spdx.org/specifications) +or additional information also the SPDX website at . -The specification consists of a model which is generated from the [spdx-3-model](https://github.com/spdx/spdx-3-model) repository and additional information in the `docs` directory. +## Specification structure -The `examples` directory contains examples of various SPDX serializations for the current version of the spec. +This repository consists of these files and directories: -# Building the specification +- `bin/` - Scripts for spec generation. +- `docs/` - Specification content: + - `annexes/` - Annexes for the specification. + - `css/` - Style sheets for HTML. + - `images/` - Model diagrams. These image files are to be generated from a + diagram description file + [model.drawio](https://github.com/spdx/spdx-3-model/blob/main/model.drawio) + in `spdx/spdx-3-model` repo and manually copied here. + - `licenses/` - Licenses that used by the SPDX specifications. + - `model/` - Model files*. This subdirectory _is to be created_ by a script + from `spdx/spec-parser` repo, using model information from + `spdx/spdx-3-model` repo (see the build instructions below). +- `examples/` - Examples of various SPDX serializations for the current version + of the spec. +- `mkdocs.yml` - MkDocs recipe for the spec documentation generation. The + inclusion of model files and the order of chapters are defined here. -## Prerequisites +The specification consists of documents in the `docs/` directory from this +`spdx/spdx-spec` repository and a model which is generated from Markdown files +in the `spdx/spdx-3-model` repository. -You have to [MkDocs](http://mkdocs.org) installed on your machine. If you don't have it yet installed please follow these [installation instructions](http://www.mkdocs.org/#installation). +Note: The model files in the `spdx/spdx-3-model` repository use a constrained +format of Markdown. Only a limited set of headings are allowed to be processed +by the spec-parser. -## Building HTML +## Building the specification - # Execute built-in dev-server that lets you preview the specification - $ mkdocs serve +The specification building flow looks like this: - # Building static HTML site - $ mkdocs build +```text + +-------------------+ + |[spdx-3-model] | + | | | + | +- model/ ---- Constrained-Markdown files -+ + | | | | + | +- model.drawio -----------------+ | + +-------------------+ | | + | | + | | + +-------------------+ v | + |[spdx-spec] | draw.io | + | | | (manual) | + | +- docs/ | | | + | | | | | + | +- annexes/ | | v + | | | | spec-parser + | +- images/ <---- PNG images --+ | + | | | | + | +- licenses/ | | + | | | | + | +- model/ <----- Processed Markdown files ---+ + | | | + | +- index.md | + | | | + | +- *.md | + +-------------------+ + | + mike & mkdocs + | + v + +-------------------+ + | HTML website | + +-------------------+ +``` + +### Prerequisites + +Apart from Git and Python, you have to have [MkDocs](http://mkdocs.org) +installed on your machine. If you don't have it yet installed please follow +these [installation instructions](http://www.mkdocs.org/#installation). + +[WeasyPrint](https://doc.courtbouillon.org/weasyprint/stable/first_steps.html#installation) +is also required for generating PDF files. To disable PDF generation, comment +out the these lines in your `mkdocs.yml` configuration file: + +```yaml +#- pdf-export: +# combined: true +``` + +### Preparing input files + +Next, you have to prepare the model files, the other specification files, +and the model parser, by cloning these repositoriess: +[`spdx/spdx-3-model`](https://github.com/spdx/spdx-3-model), +[`spdx/spdx-spec`](https://github.com/spdx/spdx-spec), and +[`spdx/spec-parser`](https://github.com/spdx/spec-parser) +to these paths: `spdx-3-model`, `spdx-spec`, and `spec-parser`, respectively: + +```shell +git clone https://github.com/spdx/spdx-3-model.git +git clone https://github.com/spdx/spdx-spec.git +git clone https://github.com/spdx/spec-parser.git +``` + +Install prerequisites for Python: + +```shell +pip3 install -r spdx-spec/requirements.txt +pip3 install -r spec-parser/requirements.txt +``` + +### Generating formatted Markdown files for MkDocs + +Model files in `spdx/spdx-3-model` repo are written in a specific format of +Markdown, with a limited set of allowed headings. The `spec-parser` processes +these model files to generate both ontology and final Markdown files suitable +for MkDocs. + +The `spec-parser` also performs automatic formatting on the resulting Markdown +files. For instance, it converts a list under the "Properties" heading into a +table. + +To check the model files and generate formatted files for MkDocs, run the +following command: + +```shell +python3 spec-parser/main.py spdx-3-model/model spdx-spec/docs/model +``` + +This will create well-formatted model files in the `spdx-spec/docs/model/` +directory. This directory contains two components: + +- Model ontology and diagram files: These files (`model.plantuml`, + `spdx-context.jsonld`, `spdx-model.dot`, `spdx-model.json-ld`, + `spdx-model.pretty-xml`, `spdx-model.ttl`, `spdx-model.xml`) + are ready for immediate use. +- Formatted Makdown files: These files (`.md` extension) are located in various + subdirectories and are intended for processing by MkDocs in the next step. + +If the output directory already exists, the `spec-parser` will not overwrite +it. If you edited a model file and want to regenerate the formatted files, you +have to delete the existing `spdx-spec/docs/model` directory first: + +```shell +rm -rf spdx-spec/docs/model +``` + +### Building HTML + +With all spec and model files prepared, we will use MkDocs to assemble them +into a website. + +In side `spdx-spec/` directory, execute a built-in dev-server that let you +preview the specification: + +```shell +mkdocs serve +``` + +Or building a static HTML site: + +```shell +mkdocs build +``` + +To abort the build immediately when there is a warning, enables strict mode: + +```shell +mkdocs build --strict +``` + +To get debug messages, enables verbose output: + +```shell +mkdocs build --verbose +``` + +## Configuring the website + +Inside `spdx-spec/` directory, there is a file `mkdocs.yml`. This is a +configuration file for MkDocs. + +Files intended for display and linking in the navigation bar should be +included in the `nav:` section. The order of filenames in this section +determines their order on the navigation bar. + +## Specification versions on spdx.github.io/spdx-spec/ + +The SPDX specifications on are built +by using a workflow in +[`.github/workflows/publish_v3.yml`](.github/workflows/publish_v3.yml). +This workflow uses [mike](https://github.com/jimporter/mike) to publish +multiple versions of MkDocs-powered documentation. + +The published versions, their titles, and aliases are listed in the file +[versions.json](https://github.com/spdx/spdx-spec/blob/gh-pages/versions.json) +located in the `gh-pages` branch. These versions populate the version selector +dropdown on the website. The line `run: mike deploy` in the GitHub workflow +file determines the title and alias. + +mike is not needed for local testing of a specific spec version. diff --git a/docs/annexes/getting-started.md b/docs/annexes/getting-started.md index f792a6d7c9..f7e076f008 100644 --- a/docs/annexes/getting-started.md +++ b/docs/annexes/getting-started.md @@ -76,7 +76,7 @@ say this is a [Person][Class_Person]. Next, we need to name our object: ```json - "spdxId": "http://spdx.example.com/Person/JoshuaWatt", + "spdxId": "http://spdx.org/spdxdocs/Person/JoshuaWatt-141ec767-40f2-4aad-9658-ac2703f3a7d9", ``` Most objects can have some sort of "ID" property that gives it a name. In the @@ -96,7 +96,7 @@ are considered to be the same object, and any references to this URI is a reference to this _specific_ object we are creating. If you work for a company, own a domain, etc. it is encouraged to use that (or -some subdomain of it) in place of `spdx.example.com`. +some subdomain of it) in place of `spdx.org/spdxdocs`. In practice, many `spdxId` values will have some sort of hash or random UUID-like string incorporated to make them unique. @@ -231,7 +231,7 @@ who (or what) created the elements that are linked to this ```json "createdBy": [ - "http://spdx.example.com/Person/JoshuaWatt" + "http://spdx.org/spdxdocs/Person/JoshuaWatt-141ec767-40f2-4aad-9658-ac2703f3a7d9" ], ``` @@ -271,7 +271,7 @@ do that now: ```json { "type": "SpdxDocument", - "spdxId": "http://spdx.example.com/Document1", + "spdxId": "https://spdx.org/spdxdocs/Document1-d078aed9-384d-4a64-87cb-99c79647c8c9", "creationInfo": "_:creationinfo", ``` @@ -307,7 +307,7 @@ Element) references. Add this now and close our our ```json "rootElement": [ - "http://spdx.example.com/BOM1" + "https://spdx.org/spdxdocs/BOM-e2e955f5-c50e-4a3a-8c69-db152f0f4615" ] }, ``` @@ -365,7 +365,7 @@ Lets define our package: ```json { "type": "software_Package", - "spdxId": "http://spdx.example.com/amazing-widget", + "spdxId": "https://spdx.org/spdxdocs/Package-d1db6e61-aebe-4b13-ae73-d0f66018dbe0", "creationInfo": "_:creationinfo", ``` This should be familiar by now. Note the reuse of our previous @@ -425,7 +425,7 @@ property: ```json "originatedBy": [ - "http://spdx.example.com/Person/JoshuaWatt" + "http://spdx.org/spdxdocs/Person/JoshuaWatt-141ec767-40f2-4aad-9658-ac2703f3a7d9" ], ``` @@ -472,7 +472,7 @@ Lets get started with our first file, the program executable: ```json { "type": "software_File", - "spdxId": "http://spdx.example.com/amazing-widget/main", + "spdxId": "https://spdx.org/spdxdocs/File-8f79956e-4089-4166-9a71-457de77e4846", "creationInfo": "_:creationinfo", "name": "/usr/bin/amazing-widget", "verifiedUsing": [ @@ -484,7 +484,7 @@ Lets get started with our first file, the program executable: ], "builtTime": "2024-03-05T00:00:00Z", "originatedBy": [ - "http://spdx.example.com/Person/JoshuaWatt" + "http://spdx.org/spdxdocs/Person/JoshuaWatt-141ec767-40f2-4aad-9658-ac2703f3a7d9" ], ``` @@ -527,7 +527,7 @@ program: ```json { "type": "software_File", - "spdxId": "http://spdx.example.com/amazing-widget/config", + "spdxId": "https://spdx.org/spdxdocs/File-77808a5c-7a1b-43d1-9fa9-410a309ca9f3", "creationInfo": "_:creationinfo", "name": "/etc/amazing-widget.cfg", "verifiedUsing": [ @@ -539,7 +539,7 @@ program: ], "builtTime": "2024-03-05T00:00:00Z", "originatedBy": [ - "http://spdx.example.com/Person/JoshuaWatt" + "http://spdx.org/spdxdocs/Person/JoshuaWatt-141ec767-40f2-4aad-9658-ac2703f3a7d9" ], "software_primaryPurpose": "configuration" }, @@ -564,7 +564,7 @@ new one: ```json { "type": "Relationship", - "spdxId": "http://spdx.example.com/amazing-widet-contains", + "spdxId": "https://spdx.org/spdxdocs/Relationship/contains-6b0b7ce4-a069-406d-9088-9e91f65b79f0", "creationInfo": "_:creationinfo", ``` @@ -592,10 +592,10 @@ with them: you can think of them as an arrow pointing from their express this: ```json - "from": "http://spdx.example.com/amazing-widget", + "from": "https://spdx.org/spdxdocs/Package-d1db6e61-aebe-4b13-ae73-d0f66018dbe0", "to": [ - "http://spdx.example.com/amazing-widget/config", - "http://spdx.example.com/amazing-widget/main" + "https://spdx.org/spdxdocs/File-8f79956e-4089-4166-9a71-457de77e4846", + "https://spdx.org/spdxdocs/File-77808a5c-7a1b-43d1-9fa9-410a309ca9f3" ], ``` @@ -631,7 +631,7 @@ This is done by creating a [software_Sbom][Class_software_Sbom] object: ```json { "type": "software_Sbom", - "spdxId": "http://spdx.example.com/BOM1", + "spdxId": "https://spdx.org/spdxdocs/BOM-e2e955f5-c50e-4a3a-8c69-db152f0f4615", "creationInfo": "_:creationinfo", ``` @@ -647,7 +647,7 @@ of the SBOM, which is our [software_Package][Class_software_Package]: ```json "rootElement": [ - "http://spdx.example.com/amazing-widget" + "https://spdx.org/spdxdocs/Package-d1db6e61-aebe-4b13-ae73-d0f66018dbe0" ], ``` @@ -661,8 +661,8 @@ included: ```json "element": [ - "http://spdx.example.com/amazing-widget/main", - "http://spdx.example.com/amazing-widget/config" + "https://spdx.org/spdxdocs/File-8f79956e-4089-4166-9a71-457de77e4846", + "https://spdx.org/spdxdocs/File-77808a5c-7a1b-43d1-9fa9-410a309ca9f3" ], ``` diff --git a/mkdocs.yml b/mkdocs.yml index 27b6852f25..1b55e4facd 100644 --- a/mkdocs.yml +++ b/mkdocs.yml @@ -314,7 +314,7 @@ nav: - model/Build/Properties/environment.md - model/Build/Properties/parameters.md - Lite: - - 'Descrption': model/Lite/Lite.md + - 'Description': model/Lite/Lite.md - Extension: - 'Description': model/Extension/Extension.md - Classes: