Skip to content

AI: Add SPDX 3.1 (draft) for Example 02 #136

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
bact wants to merge 8 commits into
base: master
Choose a base branch
from
Open

AI: Add SPDX 3.1 (draft) for Example 02 #136

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
3f1dd77
AI: Add SPDX 3.1 (draft) for Example 02
bact Apr 22, 2026
e35b6ce
Update SPDX 3.1 draft file link in README
bact Apr 22, 2026
ee6d471
Add SPDX 3.1 to README
bact Apr 23, 2026
2afdcd3
Update specVersion: 3.1.0 -> 3.1
bact Apr 23, 2026
8d862a6
Update property format
bact Apr 23, 2026
8d58ceb
Merge branch 'master' into ai-ex02-spdx31-draft
bact Apr 23, 2026
9f58cca
Change external identifier types in sbom.spdx3.json-draft
bact Apr 23, 2026
f2de953
Change externalIdentifierType from 'webpage' to 'other'
bact Apr 23, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 7 additions & 6 deletions ai/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@ SPDX-FileType: DOCUMENTATION
SPDX-License-Identifier: CC-BY-4.0
---

# SPDX AI Profile Usage Examples
# SPDX AI profile examples

This repository includes demonstrations of [SPDX documents](https://spdx.dev)
for various examples of AI applications and models.
Expand All @@ -13,15 +13,16 @@ for various examples of AI applications and models.
Directories of the form `example##` are structured as follows:

- `content/`: contains the example's content (data files, source code, etc.)
- `spdx3.0/`: contains one or more SPDX documents for the example
- `spdx3.0/`: contains SPDX 3.0 documents for the example
- `spdx3.1/`: contains SPDX 3.1 documents for the example
- `README.md`: more details about the particular example

## Examples

| # | Sources | Binaries | Data | SPDX | Comments |
|----|---------|----------|------|------|----------|
| [1](./example01/) | - | - | - | 1 document | Demonstrating `dependsOn`, `testedOn`, and `trainedOn` relationships |
| [2](./example02/) | 4 Python files | 1 model file | 3 data files | 1 document | Demonstrating `generates`, `hasDataFile`, and `hasDocumentation` (lifecycle-scoped) relationships |
| # | Sources | Binaries | Data | SPDX 3.0 | SPDX 3.1 | Focus |
| - | ------- | -------- | ---- | -------- | -------- | ----- |
| [01](./example01/) | - | - | - | 1 document | - | `dependsOn`, `testedOn`, `trainedOn` relationships |
| [02](./example02/) | 4 Python files | 1 model file | 3 data files | 1 document | 1 document | `generates`, `hasDataFile`, `hasDocumentation` relationships; `/AI/energyConsumption`, `/AI/hyperparameter`; **3.0→3.1**: `/AI/autonomyType` → `/Core/isoAutomationLevel` |

## Implementing SBOM for AI systems

Expand Down
28 changes: 16 additions & 12 deletions ai/example02/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,24 +3,28 @@ SPDX-FileType: DOCUMENTATION
SPDX-License-Identifier: CC-BY-4.0
---

# Example 02
# AI example 2 - Sentiment analysis

## Description

This example illustrates a software bill of materials (SBOM) for an AI
application that employs machine learning to perform a text sentiment analysis.

The SBOM ([spdx3.0/sbom.spdx3.json](./spdx3.0/sbom.spdx3.json)) demonstrates
the structure between `AIPackage`, `DatasetPackage`, and their technical
documentation through (lifecycle-scoped) relationship types such as
`dependsOn`,
`generates`,
`hasDataFile`,
`hasDocumentation`,
`testedOn`, and
`trainedOn`.

[![A diagram showing relationships between elements in the Sentiment Demo package (Example 2).](./sbom-spdx3.png "A diagram showing relationships between elements in the Sentiment Demo package (Example 2).")](sbom-spdx3.png)
The SBOM demonstrates the structure between `AIPackage`, `DatasetPackage`,
and their technical documentation through lifecycle-scoped relationship types,
and captures autonomy level and dataset size - two properties that migrate in
SPDX 3.1:
`/AI/autonomyType` is replaced by `isoAutomationLevel: conditionalAutomation`,
and `/Dataset/datasetSize` is replaced by `/Software/artifactSize`.

## SPDX files

| Version | File |
| ------- | ---- |
| SPDX 3.0 | [spdx3.0/sbom.spdx3.json](./spdx3.0/sbom.spdx3.json) |
| SPDX 3.1 (draft) | [spdx3.1/sbom.spdx3.json-draft](./spdx3.1/sbom.spdx3.json-draft) |

[![A diagram showing relationships between elements in the Sentiment Demo package (Example 2).](./example02.spdx3.png "A diagram showing relationships between elements in the Sentiment Demo package (Example 2).")](./example02.spdx3.png)

See the [package README](./content/README.md) inside the
[content/](./content/) directory for more details.
Loading
Loading