spdx/spdx-3-model

Move Licensing requirement to conformance section

Opened this issue · 1 comments

The Licensing profile states that:

If the hasConcludedLicense for a Software Artifact is not the same as its hasDeclaredLicense, a written explanation SHOULD be provided in the hasConcludedLicense relationship comment field.

This should moved into the compliance section.

In addition, I suggest to include something like this in the compliance section:

A SoftwareArtifact with a hasDeclaredLicense relationship to a NoneLicense or NoAssertionLicense should not link to any declared license.
A SoftwareArtifact with a hasConcludedLicense relationship to a NoneLicense or NoAssertionLicense should not link to any concluded license.

Agree with moving this to the conformance section.

The additions need to be discussed - I'm not sure I agree with the proposed language. It's a bit complex, so having a discussion on the topic may help.

Ping @swinslow

Suggest we do this in 3.1 since (at least today) it is documentation.