Add spdx taxonomy

README.md

@@ -34,8 +34,8 @@ Namespaces SHOULD be lower case. Base property names MAY use upper case.
 ### Examples
 
 ```
-local:information_security_classification
-local:team_responsible
+internal:information_security_classification
+internal:team_responsible
 ```
 
 ### ABNF for Official CycloneDX Property Names
@@ -81,6 +81,7 @@ ABNF syntax as per [RFC5234: Augmented BNF for Syntax Specifications: ABNF](http
 | `snyk` | Namespace for use by Snyk. | Snyk | [Snyk Taxonomy Documentation](https://docs.snyk.io/snyk-api-info/get-a-projects-sbom-document-endpoint#custom-cyclonedx-properties) |
 | `sonatype` | Namespace for use by Sonatype | Sonatype | [Sonatype Taxonomy Documentation](https://help.sonatype.com/lift/open-source-vulnerability-analysis/dependency-view/cyclonedx-sonatype-namespace-taxonomy) |
 | `spack` | Namespace for use by the Spack package manager. | Spack Maintainers | [Spack SBOM Project](https://github.com/spack/spack-sbom#readme) |
+| `spdx` | Namespace for interop with the SPDX format. | CycloneDX Core Working Group | [spdx taxonomy](spdx/spdx.md) |
 | `syft` | Namespace for use by the Syft project. | Syft Maintainers | [Syft Project](https://github.com/anchore/syft) |
 | `tern` | Namespace for use by the Tern project. | Tern Maintainers | [Tern Project](https://github.com/tern-tools/tern) |
 | `veracode` | Namespace for use by Veracode. | Veracode | [Veracode taxonomy](https://github.com/veracode/cyclonedx-property-taxonomy#readme) |

spdx/spdx.md

@@ -0,0 +1,5 @@
+## `spdx` Namespace
+
+| Namespace | Description | Taxonomy |
+| --- | --- | --- |
+| `spdx:v2` | Namespace for SPDX v2. | [spdx:v2 taxonomy](v2.md) |

spdx/v2.md

@@ -0,0 +1,90 @@
+## `spdx:v2` Namespace Taxonomy
+
+The SPDX namespaces and property names correspond to SPDX elements and fields.
+
+For more information on their meaning please refer to the [SPDX specification](https://spdx.github.io/spdx-spec/).
+
+| Namespace | Description |
+| --- | --- |
+| `spdx:v2:checksum` | Checksum information |
+| `spdx:v2:creation-info` | Creation information |
+| `spdx:v2:document` | Document information |
+| `spdx:v2:external-reference` | External reference information |
+| `spdx:v2:file` | File information |
+| `spdx:v2:package` | Package information |
+
+| Property |
+| --- |
+| `spdx:v2:annotation` |
+| `spdx:v2:comment` |
+| `spdx:v2:download-location` |
+| `spdx:v2:files-analyzed` |
+| `spdx:v2:homepage` |
+| `spdx:v2:license-comments` |
+| `spdx:v2:license-concluded` |
+| `spdx:v2:license-declared` |
+| `spdx:v2:license-info-from-file` |
+| `spdx:v2:spdxid` |
+
+## `spdx:v2:checksum` Namespace Taxonomy
+
+| Property |
+| --- |
+| `spdx:v2:checksum:md2` |
+| `spdx:v2:checksum:md4` |
+| `spdx:v2:checksum:md6` |
+| `spdx:v2:checksum:sha225` |
+
+## `spdx:v2:document` Namespace Taxonomy
+
+| Property |
+| --- |
+| `spdx:v2:document:data-license` |
+| `spdx:v2:document:describes` |
+| `spdx:v2:document:document-namespace` |
+| `spdx:v2:document:external-document-ref` |
+| `spdx:v2:document:name` |
+| `spdx:v2:document:spdx-version` |
+
+## `spdx:v2:creation-info` Namespace Taxonomy
+
+| Property |
+| --- |
+| `spdx:v2:creation-info:comment` |
+| `spdx:v2:creation-info:creators-organization` |
+| `spdx:v2:creation-info:license-list-version` |
+
+## `spdx:v2:external-reference` Namespace Taxonomy
+
+| Property |
+| --- |
+| `spdx:v2:external-reference:security:cpe22` |
+| `spdx:v2:external-reference:security:cpe23` |
+| `spdx:v2:external-reference:package-manager:bower` |
+| `spdx:v2:external-reference:package-manager:maven-central` |
+| `spdx:v2:external-reference:package-manager:npm` |
+| `spdx:v2:external-reference:package-manager:nuget` |
+| `spdx:v2:external-reference:package-manager:purl` |
+| `spdx:v2:external-reference:persistent-id:swh` |
+| `spdx:v2:external-reference:other` |
+
+## `spdx:v2:file` Namespace Taxonomy
+
+| Property |
+| --- |
+| `spdx:v2:file:type` |
+| `spdx:v2:file:contributor` |
+| `spdx:v2:file:notice-text` |
+
+## `spdx:v2:package` Namespace Taxonomy
+
+| Property |
+| --- |
+| `spdx:v2:package:file-name` |
+| `spdx:v2:package:originator:email` |
+| `spdx:v2:package:originator:organization` |
+| `spdx:v2:package:source-info` |
+| `spdx:v2:package:summary` |
+| `spdx:v2:package:supplier:organization` |
+| `spdx:v2:package:verification-code:value` |
+| `spdx:v2:package:verification-code:excluded-file` |