Proposed language to broaden Package semantics to accommodate classification concept in V 2.3 re: Issue 621

[rjb4standards]

5.2.2 Package information section

In SPDX information is used to describe packages, representing the versioned components of an object that are part of a software distribution. Packages are an abstract concept that can be used to describe any object within a software distribution.

A Package describes any unit of content that can be associated with a distribution of software. Typically, a Package is composed of one or more files. An SPDX document should provide details about the individual files comprising a software distribution, using a Package object to represent each versioned object within a distribution. Each package is identified with a classification type to aid with processing of the object described by a package element. Packages are used for objects that contain versioning information, where File is used to represent objects without versioning information, i.e. underconstruction.html.

Any of the following non-limiting examples may be (but are not required to be) represented in SPDX as a Package:

a tarball, zip file or other archive
a directory or sub-directory
a separately distributed piece of software which another Package or File uses or depends upon (e.g., a Python package, a Go module, ...)
a container image, and/or each image layer within a container image
a collection of one or more sub-packages
a Git repository snapshot from a particular point in time
a open-source library, i.e. OpenSSL
a javascript file
a customer script file
a index,html file
a LICENSE file
a CHANGE log 
a properties file
. . .

[kestewart]

Being addressed in #622

[kestewart]

@rjb4standards to coordinate with Rose, to see if this can be closed.

[rjb4standards]

@rnjudge Rose please let me know when you have a few minutes to discuss coordination of the PackagePurpose element changes and the relationship to the proposed language in 5.2.2. Thanks.

[kestewart]

Reviewed with Dick on call, ok to close. Note, it's also handled with updated the package alignment PR #669.