diff --git a/docs/scope.md b/docs/scope.md index 69d5a49084..71cbd44343 100644 --- a/docs/scope.md +++ b/docs/scope.md @@ -1,3 +1,25 @@ # 1 Scope -This System Package Data Exchange (SPDX®) specification defines a standard capable of representing systems with software components in as SBOMs (Software Bill of Materials) and other AI, data and security references supporting a range of risk management use cases. An SPDX document can be associated with a set of software packages, files or snippets and contains information about the software in the SPDX format described in this specification. +The System Package Data Exchange (SPDX®) specification defines an open standard +for communicating bill of materials (BOM) information for different topic +areas. + +SPDX defines an underlying data model as well as multiple serialization formats +to encode that data model. + +SPDX metadata includes details about creation and distribution, including the +following: + +- software composition, for collections of software (Packages), individual + Files, and portions of files (Snippets) +- software build information +- artificial intelligence (AI) models +- datasets +- creator, supplier and distributor identity information +- provenance and integrity +- licenses and copyrights, including a curated list of licenses and exceptions +- security vulnerabilities, defects, and other quality data +- relationships between system elements +- software usage and lifecycle +- mechanisms to enable annotating SPDX elements and linking between multiple + SPDX Documents