PackageInfoNoteArgs

Indicates whether the file content of this package has been available for or subjected to analysis when creating the SPDX document

A place for the SPDX data creator to record, at the package level, acknowledgements that may be needed to be communicated in some contexts

Provide an independently reproducible mechanism that permits unique identification of a specific package that correlates to the data in this SPDX file

Identify the copyright holders of the package, as well as any dates present

A more detailed description of the package

This section identifies the download Universal Resource Locator (URL), or a specific location within a version control system (VCS) for the package at the time that the SPDX file was created

ExternalRef

Contain the license the SPDX file creator has concluded as governing the This field is to contain a list of all licenses found in the package. The relationship between licenses (i.e., conjunctive, disjunctive) is not specified in this field – it is simply a listing of all licenses found

Provide a place for the SPDX file creator to record a web site that serves as the package's home page

List the licenses that have been declared by the authors of the package

If the package identified in the SPDX file originated from a different person or organization than identified as Package Supplier, this field identifies from where or whom the package originally came

The type of package: OS, MAVEN, GO, GO_STDLIB, etc.

A short description of the package

Identify the actual distribution source for the package/directory identified in the SPDX file

Identify the full name of the package as given by the Package Originator

This field provides an independently reproducible mechanism identifying specific contents of a package based on the actual files (except the SPDX file itself, if it is included in the package) that make up each package and that correlates to the data in this SPDX file

Identify the version of the package