Spdx-Java-Library

https://github.com/spdx/spdx-java-library
Admin
Spdx-Java-Library is a Java library that implements the Java object model for SPDX (Software Package...
Tokens:82,149
Snippets:791
Trust Score:9.4
License:Apache-2.0
Update:10 months ago
Show doc for...
Tokens:
Raw
### Initialize SPDX Model

Source: https://github.com/spdx/spdx-java-library/blob/master/GETTING-STARTED.md

Call SpdxModelFactory.init() to initialize the library's models. This is a prerequisite for using most of the library's functionalities for SPDX data manipulation.

```java
SpdxModelFactory.init();
```

--------------------------------

### Prepare Maven Release

Source: https://github.com/spdx/spdx-java-library/blob/master/RELEASE-CHECKLIST.md

This Maven command initiates the release preparation process. It will prompt the user for details such as the release version, and typically defaults can be accepted for a standard release. This step involves version bumping, tag creation, and preparing the project for deployment. Maven must be installed.

```shell
mvn release:prepare
```

--------------------------------

### Maven Dependency for SPDX Java Library

Source: https://github.com/spdx/spdx-java-library/blob/master/GETTING-STARTED.md

Add this XML snippet to your Maven POM file to include the SPDX Java library. Ensure you use a compatible version; this example specifies versions up to 2.0.

```xml
<dependency>
  <groupId>org.spdx</groupId>
  <artifactId>java-spdx-library</artifactId>
  <version>(,2.0]</version>
</dependency>
```

--------------------------------

### Initialize Default Model Store

Source: https://github.com/spdx/spdx-java-library/blob/master/GETTING-STARTED.md

Optionally, initialize a custom default model store and copy manager. This must be done before or immediately after SpdxModelFactory.init() to avoid data loss.

```java
DefaultModelStore.initialize(IModelStore newModelStore, String newDefaultDocumentUri,
                            IModelCopyManager newDefaultCopyManager);
```

--------------------------------

### Create In-Memory Model Store and Copy Manager

Source: https://github.com/spdx/spdx-java-library/blob/master/GETTING-STARTED.md

Instantiate a simple in-memory model store and a copy manager. These are essential for managing and copying SPDX data within the library.

```java
InMemSpdxStore modelStore = new InMemSpdxStore();
IModelCopyManager copyManager = new ModelCopyManager();
```

--------------------------------

### Create and Describe an SPDX File

Source: https://github.com/spdx/spdx-java-library/blob/master/GETTING-STARTED.md

Creates an SPDX file, setting its unique ID, name, license, copyright, and SHA1 checksum. The file is then added to the document's 'documentDescribes' list. Uses a builder pattern for complex objects.

```java
// We need something for the document to describe, we'll create an SPDX file
			AnyLicenseInfo apacheLicense = LicenseInfoFactory.parseSPDXLicenseString("Apache-2.0", inMemStore, newDocumentUri, null);
			SpdxFile file = myDoc.createSpdxFile(
					SpdxConstants.SPDX_ELEMENT_REF_PRENUM + "44",
					"./myfile/name", 
					apacheLicense, 
					Arrays.asList(new AnyLicenseInfo[] {apacheLicense}),
					"Copyright me, 2023",
					myDoc.createChecksum(ChecksumAlgorithm.SHA1, "2fd4e1c67a2d28fced849ee1bb76e7391b93eb12"))
					.build();  // The more complex model objects follows a builder pattern
			myDoc.getDocumentDescribes().add(file);
```

--------------------------------

### Initialize SPDX Library (Java)

Source: https://github.com/spdx/spdx-java-library/blob/master/README-V3-UPGRADE.md

Demonstrates the new explicit initialization process for the SPDX Java Library, including optional ModelStore and CopyManager configuration. This process must be called early to ensure proper library setup.

```java
import org.spdx.core.DefaultModelStore;
import org.spdx.library.SpdxModelFactory;
import org.spdx.model.ModelStore;
import org.spdx.model.SimpleCopyManager;

// ...

// Optional: Initialize with custom ModelStore and CopyManager
// ModelStore modelStore = new MyCustomModelStore();
// SimpleCopyManager copyManager = new MyCustomCopyManager();
// DefaultModelStore.initialize(modelStore, copyManager);

// Required: Initialize the SpdxModelFactory
SpdxModelFactory.init();

// Now you can use other SPDX classes and methods.
```

--------------------------------

### Convert Between SPDX Versions with Java

Source: https://context7.com/spdx/spdx-java-library/llms.txt

This example demonstrates how to convert an SPDX 2.x document to the SPDX 3.x format using the SPDX Java library's migration utility. It involves setting up source and destination stores, a copy manager, and a converter instance. The conversion process takes the source document URI and a target prefix for the new SPDX 3.0 objects.

```java
import org.spdx.library.conversion.Spdx2to3Converter;
import org.spdx.library.model.v2.SpdxDocument;
import org.spdx.library.model.v3_0_1.core.SpdxDocument as SpdxDocumentV3;
import org.spdx.storage.simple.InMemSpdxStore;
import org.spdx.library.ModelCopyManager;
import org.spdx.core.InvalidSPDXAnalysisException;

public class ConversionExample {
    public static SpdxDocumentV3 convertDocument(SpdxDocument spdx2Doc)
            throws InvalidSPDXAnalysisException {
        // Create target store for SPDX 3.0 data
        InMemSpdxStore targetStore = new InMemSpdxStore();
        ModelCopyManager copyManager = new ModelCopyManager();

        // Create converter instance
        String targetPrefix = "https://example.com/spdx3/";
        Spdx2to3Converter converter = new Spdx2to3Converter(
                spdx2Doc.getModelStore(),  // source store
                targetStore,                // destination store
                copyManager,                // copy manager
                targetPrefix);              // URI prefix for SPDX 3.0 objects

        // Perform conversion
        String spdx3DocumentUri = converter.convert(
                spdx2Doc.getDocumentUri(),  // source document URI
                targetPrefix + "document/converted");

        // Retrieve converted document
        SpdxDocumentV3 spdx3Doc = (SpdxDocumentV3) SpdxModelFactory.inflateModelObject(
                targetStore,
                spdx3DocumentUri,
                "SpdxDocument",
                copyManager,
                SpdxModelFactory.getLatestSpecVersion(),
                false,
                null);

        System.out.println("Conversion complete. SPDX 3.0 document URI: " +
                spdx3DocumentUri);
        return spdx3Doc;
    }
}
```

--------------------------------

### Perform Dry Run of Maven Release Preparation

Source: https://github.com/spdx/spdx-java-library/blob/master/RELEASE-CHECKLIST.md

This Maven command simulates the release preparation process without actually creating any release artifacts or tags. It's a valuable step to verify that the release configuration is correct and to anticipate any issues that might arise during the actual release. This command requires Maven to be installed.

```shell
mvn release:prepare -DdryRun
```

--------------------------------

### Create SPDX 3.0 Creation Info (Java)

Source: https://github.com/spdx/spdx-java-library/blob/master/GETTING-STARTED.md

Programmatically create creation information for SPDX 3.0 elements using SpdxModelFactoryV3.createCreationInfo. This includes agent and creation info objects required for all SPDX elements.

```java
CreationInfo creationInfo = SpdxModelFactoryV3.createCreationInfo(
			modelStore, prefix + "Agent/Gary01123", "Gary O\'Neall",
			copyManager);
```

--------------------------------

### Perform Maven Release

Source: https://github.com/spdx/spdx-java-library/blob/master/RELEASE-CHECKLIST.md

This Maven command executes the release process after `mvn release:prepare` has been successfully completed. It will deploy the release artifacts to the configured repositories, such as Maven Central. Ensure that your Maven settings are correctly configured for deployment. Maven must be installed.

```shell
mvn release:perform
```

--------------------------------

### Create SPDX Document URI

Source: https://github.com/spdx/spdx-java-library/blob/master/GETTING-STARTED.md

Generates a unique document URI required for an SPDX document. This URI serves as a prefix for all IDs within the document and must be globally unique.

```java
String newDocumentUri = "http://spdx.org/spdxdocs/spdx-example2-444504E0-4F89-41D3-9A0C-0305E82CCCCC";
```

--------------------------------

### Add SPDX 3.0 Package to SBOM (Java)

Source: https://github.com/spdx/spdx-java-library/blob/master/GETTING-STARTED.md

Add an SPDX 3.0 package as a root element to an existing SBOM. The package builder inherits creation information from the SBOM.

```java
SpdxPackage pkg = sbom.createSpdxPackage(prefix + "package/mypackage")
        .setName("Package Name")
        .build();
        sbom.getElements().add(pkg);
        sbom.getRootElements().add(pkg);
```

--------------------------------

### Initialize SpdxDocument

Source: https://github.com/spdx/spdx-java-library/blob/master/GETTING-STARTED.md

Initializes a new SPDX document using an in-memory store, a unique document URI, and an optional copy manager. The boolean parameter indicates whether to create a new document.

```java
SpdxDocument myDoc = new SpdxDocument(
					inMemStore,							// here we'll just use a very simple in memory store which doesn't support serialization
					newDocumentUri,					// the URI of the document - must be globally unique
					null,									// an optional copy manager can be provided if working with more than one store
					true);									// this time, we want to create it
```

--------------------------------

### Perform Maven Dependency Check

Source: https://github.com/spdx/spdx-java-library/blob/master/RELEASE-CHECKLIST.md

This Maven command initiates a dependency check to identify any potential security vulnerabilities within the project's dependencies. It requires Maven to be installed and configured. The output will list any identified CVEs and suggest remediation steps. This is crucial for maintaining the security of the library.

```shell
mvn dependency-check:check
```

--------------------------------

### Create SPDX 3.0 SBOM Element (Java)

Source: https://github.com/spdx/spdx-java-library/blob/master/GETTING-STARTED.md

Build an SPDX 3.0 SBOM element using its builder pattern. The creationInfo object passed to the builder provides necessary context like model store and prefix.

```java
Sbom sbom = creationInfo.createSbom(prefix + "sbom/mysbom")
        .setName("My SBOM")
        .build();
```

--------------------------------

### Set SPDX Document Creation Information

Source: https://github.com/spdx/spdx-java-library/blob/master/GETTING-STARTED.md

Configures the required creation information for an SPDX document, including creators and the creation date. Convenience methods are available for creating model objects.

```java
myDoc.setCreationInfo(			// Set the required creationInfo
					myDoc.createCreationInfo(	// All model objects have a set of convenience methods to create 
														// other model objects using the same model store and document URI
														Arrays.asList(new String[] {"Tool: Sample App"}), // creators
														new SimpleDateFormat(SpdxConstants.SPDX_DATE_FORMAT).format(new Date())));
																															// creation date - note that SpdxConstants has several useful constant values
			myDoc.setSpecVersion(Version.CURRENT_SPDX_VERSION);	// the Version class has constants defined for all supported SPDX spec versions
			myDoc.setName("My Document");
			// The LicenseInfoFactory contains some convenient static methods to manage licenses including
			// a license parser.  Note that we have to pass in the model store and document URI so that the
			// license is created in the same store.
			myDoc.setDataLicense(LicenseInfoFactory.parseSPDXLicenseString("CC0-1.0", inMemStore, newDocumentUri, null));
```

--------------------------------

### Add Spdx-Java-Library Dependency to Maven POM

Source: https://github.com/spdx/spdx-java-library/blob/master/README.md

This snippet shows how to add the Spdx-Java-Library dependency to a Maven project's POM file. It specifies the group ID, artifact ID, and a version range. Ensure you have Maven installed and configured.

```xml
<dependency>
  <groupId>org.spdx</groupId>
  <artifactId>java-spdx-library</artifactId>
  <version>[2.0,3.0)</version>
</dependency>
```

--------------------------------

### Get SPDX Documents After Deserialization (Java)

Source: https://github.com/spdx/spdx-java-library/blob/master/README-V3-UPGRADE.md

This code snippet demonstrates how to retrieve a list of all SPDX documents from a store after deserialization in Java. It utilizes SpdxModelFactory to filter for SPDX document classes and collects them into a list. This is useful when a serialization might contain multiple SPDX documents.

```java
List<SpdxDocument> docs = 
    (List<SpdxDocument>) SpdxModelFactory.getSpdxObjects(store, null, SpdxConstantsCompatV2.CLASS_SPDX_DOCUMENT, null, null)
    .collect(Collectors.toList());
```

--------------------------------

### Create SPDX 3.0 SBOM from Scratch

Source: https://context7.com/spdx/spdx-java-library/llms.txt

Demonstrates how to build a Software Bill of Materials (SBOM) conforming to the SPDX 3.0 specification. This involves initializing the library, creating creation information, and then constructing an SBOM object with packages. It requires the `org.spdx:java-spdx-library` dependency and utilizes `SpdxModelFactory`, `SpdxModelClassFactoryV3`, and `InMemSpdxStore`.

```java
import org.spdx.library.SpdxModelFactory;
import org.spdx.library.model.v3_0_1.SpdxModelClassFactoryV3;
import org.spdx.library.model.v3_0_1.core.CreationInfo;
import org.spdx.library.model.v3_0_1.software.Sbom;
import org.spdx.library.model.v3_0_1.software.SpdxPackage;
import org.spdx.storage.simple.InMemSpdxStore;
import org.spdx.library.ModelCopyManager;
import org.spdx.core.InvalidSPDXAnalysisException;

public class CreateSbomExample {
    public static Sbom createSbom() throws InvalidSPDXAnalysisException {
        // Initialize library
        SpdxModelFactory.init();
        InMemSpdxStore modelStore = new InMemSpdxStore();
        ModelCopyManager copyManager = new ModelCopyManager();

        // Create unique URI prefix for this session
        String prefix = "https://org.spdx.spdxdata/899b1918-f72a-4755-9215-6262b3c346df/";

        // Create creation info with agent information
        CreationInfo creationInfo = SpdxModelClassFactoryV3.createCreationInfo(
                modelStore,
                prefix + "Agent/Gary01123",
                "Gary O'Neall",
                copyManager);

        // Build SBOM with builder pattern
        Sbom sbom = creationInfo.createSbom(prefix + "sbom/mysbom")
                .setName("My Application SBOM")
                .build();

        // Create and add a package to the SBOM
        SpdxPackage pkg = sbom.createSpdxPackage(prefix + "package/mypackage")
                .setName("com.example:my-application")
                .setVersion("1.0.0")
                .build();

        // Add package as both element and root element
        sbom.getElements().add(pkg);
        sbom.getRootElements().add(pkg);

        return sbom;
    }
}
```

--------------------------------

### Create SPDX 2.X Document with Files and Licenses (Java)

Source: https://context7.com/spdx/spdx-java-library/llms.txt

Demonstrates the creation of a legacy SPDX 2.X document. It includes setting document metadata, adding files with license information, and calculating checksums. Dependencies include the SPDX Java library and its associated storage and model components.

```java
import org.spdx.library.SpdxModelFactory;
import org.spdx.library.model.v2.SpdxDocument;
import org.spdx.library.model.v2.SpdxFile;
import org.spdx.library.model.v2.enumerations.ChecksumAlgorithm;
import org.spdx.library.model.v2.license.AnyLicenseInfo;
import org.spdx.library.LicenseInfoFactory;
import org.spdx.library.model.v2.SpdxConstantsCompatV2;
import org.spdx.storage.simple.InMemSpdxStore;
import org.spdx.core.InvalidSPDXAnalysisException;
import java.util.Arrays;
import java.util.Date;
import java.text.SimpleDateFormat;

public class CreateSpdxV2Example {
    public static SpdxDocument createDocument() throws InvalidSPDXAnalysisException {
        SpdxModelFactory.init();
        InMemSpdxStore inMemStore = new InMemSpdxStore();

        // Create unique document URI
        String newDocumentUri = "http://spdx.org/spdxdocs/example-444504E0-4F89-41D3-9A0C-0305E82CCCCC";

        // Create SPDX document
        SpdxDocument myDoc = new SpdxDocument(
                inMemStore,           // model store
                newDocumentUri,       // globally unique URI
                null,                 // optional copy manager
                true);                // create new document

        // Set required creation info
        myDoc.setCreationInfo(
                myDoc.createCreationInfo(
                        Arrays.asList("Tool: My SBOM Generator v1.0", "Person: John Doe"),
                        new SimpleDateFormat(SpdxConstantsCompatV2.SPDX_DATE_FORMAT).format(new Date())));

        // Set required fields
        myDoc.setSpecVersion("SPDX-2.3");
        myDoc.setName("Example Software SBOM");
        myDoc.setDataLicense(
                LicenseInfoFactory.parseSPDXLicenseStringCompatV2(
                        "CC0-1.0", inMemStore, newDocumentUri, null));

        // Create a file with license and checksum
        AnyLicenseInfo apacheLicense = LicenseInfoFactory.parseSPDXLicenseStringCompatV2(
                "Apache-2.0", inMemStore, newDocumentUri, null);

        SpdxFile file = myDoc.createSpdxFile(
                SpdxConstantsCompatV2.SPDX_ELEMENT_REF_PRENUM + "MyFile",
                "./src/main/MyFile.java",
                apacheLicense,
                Arrays.asList(apacheLicense),
                "Copyright (c) 2023 Example Corp.",
                myDoc.createChecksum(ChecksumAlgorithm.SHA1,
                        "2fd4e1c67a2d28fced849ee1bb76e7391b93eb12"))
                .build();

        // Add file to document
        myDoc.getDocumentDescribes().add(file);

        return myDoc;
    }
}
```

--------------------------------

### Configure SPDX Java Library Settings (Java)

Source: https://context7.com/spdx/spdx-java-library/llms.txt

Illustrates how to configure the SPDX Java library's behavior, including settings for license data sources (online vs. offline) and download caching. Configuration can be done via Java system properties before initialization or by using a properties file. Key settings include 'useJARLicenseInfoOnly', 'downloadCacheEnabled', and 'downloadCacheCheckIntervalSecs'.

```java
import org.spdx.Configuration;

public class ConfigurationExample {
    public static void configureLibrary() {
        // Option 1: Using Java system properties (set before library initialization)
        System.setProperty("org.spdx.useJARLicenseInfoOnly", "false");
        System.setProperty("org.spdx.downloadCacheEnabled", "true");
        System.setProperty("org.spdx.downloadCacheCheckIntervalSecs", "86400");

        // Initialize library after setting properties
        SpdxModelFactory.init();

        // Option 2: Using properties file
        // Create file: resources/spdx-java-library.properties
        // Contents:
        // org.spdx.useJARLicenseInfoOnly=false
        // org.spdx.downloadCacheEnabled=true
        // org.spdx.downloadCacheCheckIntervalSecs=86400

        // Configuration meanings:
        // - useJARLicenseInfoOnly: true = use bundled licenses (offline)
        //                          false = download latest from spdx.org (default)
        // - downloadCacheEnabled: true = enable XDG cache directory caching
        //                         false = no caching (default)
        // - downloadCacheCheckIntervalSecs: seconds between cache staleness checks
        //                                   default = 86400 (24 hours)

        System.out.println("Library configuration complete");
    }
}
```

--------------------------------

### Initialize SPDX Java Library

Source: https://context7.com/spdx/spdx-java-library/llms.txt

Initializes the SPDX model factory and sets up the default model store. This must be called before using other library functionalities. It requires the `org.spdx:java-spdx-library` dependency and utilizes `InMemSpdxStore` for in-memory storage and `ModelCopyManager` for cross-store operations.

```java
import org.spdx.library.SpdxModelFactory;
import org.spdx.storage.simple.InMemSpdxStore;
import org.spdx.library.ModelCopyManager;
import org.spdx.core.IModelCopyManager;

// Initialize the library - must be called first
SpdxModelFactory.init();

// Create an in-memory model store for SPDX data
InMemSpdxStore modelStore = new InMemSpdxStore();

// Create a copy manager for handling cross-store operations
IModelCopyManager copyManager = new ModelCopyManager();

// The SpdxModelFactory.init() automatically creates a default store
// but you can override it if needed
String documentUri = "https://my.company.com/spdx/doc-123";
DefaultModelStore.initialize(modelStore, documentUri, copyManager);
```

--------------------------------

### Query SPDX Objects from Model Store with Filtering (Java)

Source: https://context7.com/spdx/spdx-java-library/llms.txt

Demonstrates how to search and retrieve SPDX objects from an in-memory model store using filters for object type and URI prefix. It also shows how to check for the existence of an object within the store. Dependencies include classes from org.spdx.library, org.spdx.storage, and java.util.stream.

```java
import org.spdx.library.SpdxModelFactory;
import org.spdx.storage.IModelStore;
import org.spdx.storage.simple.InMemSpdxStore;
import org.spdx.library.ModelCopyManager;
import org.spdx.core.CoreModelObject;
import org.spdx.core.InvalidSPDXAnalysisException;
import java.util.stream.Stream;
import java.util.List;
import java.util.stream.Collectors;

public class QueryStoreExample {
    public static void queryObjects() throws InvalidSPDXAnalysisException {
        SpdxModelFactory.init();
        InMemSpdxStore store = new InMemSpdxStore();
        ModelCopyManager copyManager = new ModelCopyManager();

        // Query all objects with a specific type
        Stream<CoreModelObject> packages = (Stream<CoreModelObject>) 
                SpdxModelFactory.getSpdxObjects(
                        store,
                        copyManager,
                        "SpdxPackage",           // type filter
                        null,                    // no URI prefix filter
                        null);                   // no ID prefix

        List<CoreModelObject> packageList = packages.collect(Collectors.toList());
        System.out.println("Found " + packageList.size() + " packages");

        // Query objects with URI prefix filter
        String uriPrefix = "https://example.com/spdx/";
        Stream<CoreModelObject> filteredObjects = (Stream<CoreModelObject>) 
                SpdxModelFactory.getSpdxObjects(
                        store,
                        copyManager,
                        null,                    // no type filter
                        uriPrefix,               // filter by URI prefix
                        null);

        filteredObjects.forEach(obj -> {
            System.out.println("Object URI: " + obj.getObjectUri());
            System.out.println("Object Type: " + obj.getType());
        });

        // Check if object exists in store
        String objectUri = "https://example.com/spdx/package/example-pkg";
        boolean exists = store.exists(objectUri);
        System.out.println("Object exists: " + exists);
    }
}
```

--------------------------------

### Run Slow Unit Tests with Environment Variable

Source: https://github.com/spdx/spdx-java-library/blob/master/RELEASE-CHECKLIST.md

This command executes the extended unit tests for the SPDX Java Library by setting the `SPDX_JAVA_LIB_RUN_SLOW_TESTS` environment variable to true. This ensures that all functionalities, including those that are computationally intensive, are thoroughly tested before release. No external dependencies are required beyond the Java Development Kit and Maven.

```shell
export SPDX_JAVA_LIB_RUN_SLOW_TESTS=true
```

--------------------------------

### Retrieve SPDX Listed Licenses with Java

Source: https://context7.com/spdx/spdx-java-library/llms.txt

This snippet shows how to access SPDX license list information using the SPDX Java library. It demonstrates retrieving both SPDX 3.0 and SPDX 2.x compatible licenses by their IDs, and accessing all available listed licenses. It requires the 'spdx-java-library' dependency.

```java
import org.spdx.library.LicenseInfoFactory;
import org.spdx.library.ListedLicenses;
import org.spdx.library.model.v3_0_1.expandedlicensing.ListedLicense;
import org.spdx.library.model.v2.license.SpdxListedLicense;
import org.spdx.core.InvalidSPDXAnalysisException;

public class ListedLicenseExample {
    public static void accessListedLicenses() throws InvalidSPDXAnalysisException {
        // Get SPDX 3.0 listed license
        ListedLicense license = LicenseInfoFactory.getListedLicenseById("Apache-2.0");
        if (license != null) {
            System.out.println("License Name: " + license.getName());
            System.out.println("Is OSI Approved: " + license.getIsOsiApproved());
            System.out.println("License Text: " + license.getLicenseText());
        }

        // Get SPDX 2.X compatible listed license
        SpdxListedLicense licenseV2 = LicenseInfoFactory.getListedLicenseByIdCompatV2("MIT");
        if (licenseV2 != null) {
            System.out.println("License ID: " + licenseV2.getLicenseId());
            System.out.println("Name: " + licenseV2.getName());
            System.out.println("See Also URLs: " + licenseV2.getSeeAlso());
            System.out.println("Is Deprecated: " + licenseV2.isDeprecated());
            System.out.println("Standard License Header: " +
                    licenseV2.getStandardLicenseHeader());
        }

        // Access all available listed licenses
        ListedLicenses listedLicenses = ListedLicenses.getListedLicenses();
        System.out.println("Total listed licenses: " +
                listedLicenses.getSpdxListedLicenseIds().size());
    }
}
```

--------------------------------

### Parse SPDX License Expressions (Java)

Source: https://context7.com/spdx/spdx-java-library/llms.txt

Shows how to parse and validate SPDX license expressions using the SPDX Java library. It covers simple, compound (OR), and complex (AND, WITH) license expressions, as well as special cases like NOASSERTION and NONE. Requires the SPDX Java library.

```java
import org.spdx.library.LicenseInfoFactory;
import org.spdx.library.model.v2.license.AnyLicenseInfo;
import org.spdx.storage.simple.InMemSpdxStore;
import org.spdx.core.InvalidSPDXAnalysisException;

public class LicenseParsingExample {
    public static void parseLicenses() throws InvalidSPDXAnalysisException {
        InMemSpdxStore store = new InMemSpdxStore();
        String documentUri = "https://example.com/spdx/doc1";

        // Parse simple license
        AnyLicenseInfo simpleLicense = LicenseInfoFactory.parseSPDXLicenseStringCompatV2(
                "Apache-2.0", store, documentUri, null);
        System.out.println("License: " + simpleLicense.toString());

        // Parse compound license expression with OR
        AnyLicenseInfo dualLicense = LicenseInfoFactory.parseSPDXLicenseStringCompatV2(
                "(MIT OR Apache-2.0)", store, documentUri, null);
        System.out.println("Dual license: " + dualLicense.toString());

        // Parse complex expression with AND, OR, and WITH
        AnyLicenseInfo complexLicense = LicenseInfoFactory.parseSPDXLicenseStringCompatV2(
                "(GPL-2.0-or-later WITH Classpath-exception-2.0) AND MIT",
                store, documentUri, null);
        System.out.println("Complex license: " + complexLicense.toString());

        // Handle NOASSERTION and NONE
        AnyLicenseInfo noAssertion = LicenseInfoFactory.parseSPDXLicenseStringCompatV2(
                "NOASSERTION", store, documentUri, null);

        AnyLicenseInfo none = LicenseInfoFactory.parseSPDXLicenseStringCompatV2(
                "NONE", store, documentUri, null);
    }
}
```

--------------------------------

### Thread-Safe Access to SPDX Packages with Critical Sections (Java)

Source: https://context7.com/spdx/spdx-java-library/llms.txt

Demonstrates how to ensure thread-safe operations when accessing and modifying SPDX package objects using critical sections. This involves entering and leaving critical sections with appropriate lock types (read or write) to prevent race conditions in multi-threaded environments. It requires the `spdx-java-library` core and model dependencies.

```java
import org.spdx.library.model.v3_0_1.software.SpdxPackage;
import org.spdx.core.InvalidSPDXAnalysisException;

public class ThreadSafetyExample {
    public static void threadSafeAccess(SpdxPackage pkg)
            throws InvalidSPDXAnalysisException {
        try {
            // Enter critical section for exclusive access
            pkg.enterCriticalSection(false); // false = write lock, true = read lock

            // Perform thread-safe modifications
            pkg.setName("Updated Package Name");
            pkg.setVersion("2.0.0");
            pkg.getSummary().ifPresent(summary ->
                    System.out.println("Current summary: " + summary));

        } finally {
            // Always release lock in finally block
            pkg.leaveCriticalSection();
        }

        // For read-only operations, use read lock
        try {
            pkg.enterCriticalSection(true); // read lock allows concurrent reads

            String name = pkg.getName().orElse("Unknown");
            String version = pkg.getVersion().orElse("Unknown");
            System.out.println("Package: " + name + " v" + version);

        } finally {
            pkg.leaveCriticalSection();
        }
    }

    public static void parallelProcessing() throws Exception {
        SpdxPackage pkg = createPackage(); // assume this creates a package

        // Multiple threads can safely read concurrently
        Thread reader1 = new Thread(() -> {
            try {
                pkg.enterCriticalSection(true);
                System.out.println("Reader 1: " + pkg.getName());
                pkg.leaveCriticalSection();
            } catch (InvalidSPDXAnalysisException e) {
                e.printStackTrace();
            }
        });

        Thread reader2 = new Thread(() -> {
            try {
                pkg.enterCriticalSection(true);
                System.out.println("Reader 2: " + pkg.getName());
                pkg.leaveCriticalSection();
            } catch (InvalidSPDXAnalysisException e) {
                e.printStackTrace();
            }
        });

        reader1.start();
        reader2.start();
        reader1.join();
        reader2.join();
    }
    
    // Dummy method for example compilation
    private static SpdxPackage createPackage() {
        return null; // Replace with actual package creation
    }
}
```

--------------------------------

### SPDX 3.X Model Package Structure (Java)

Source: https://github.com/spdx/spdx-java-library/blob/master/README-V3-UPGRADE.md

Shows the package structure for SPDX 3.0.1 model objects in the Java library. These are found under `org.spdx.library.model.v3_0_1` and are part of a separate repository.

```java
import org.spdx.library.model.v3_0_1.core.SoftwarePurpose;
import org.spdx.library.model.v3_0_1.core.ExternalElement;
import org.spdx.library.model.v3_0_1.generated.licensing.License;

// Example usage of v3_0_1 classes
SoftwarePurpose purpose = null; // ... create or get a SoftwarePurpose
ExternalElement externalElement = null; // ... create or get an ExternalElement
License license = null; // ... get a License object
```

--------------------------------

### Changes to ExternalElement and ExternalExtractedLicenseInfo Constructors (Java)

Source: https://github.com/spdx/spdx-java-library/blob/master/README-V3-UPGRADE.md

Details the changes in constructors for `ExternalElement` and `ExternalExtractedLicenseInfo` in the SPDX Java Library. Constructors now require the document URI of the document containing the external element or license, differing from the previous `DocumentRef-XX:[ID]` format.

```java
import org.spdx.library.model.v2.ExternalElement;
import org.spdx.library.model.v2.SPDXDocument;

// ...

// Assuming 'documentUri' is the URI of the document containing the external element
// and 'externalId' is the ID of the external element within that document.
// The constructor now requires the documentUri of the *containing* document.
ExternalElement externalElement = new ExternalElement(documentUri, externalId, "description");

// Method to get the DocumentRef format for compatibility
String documentRefId = externalElement.referenceElementId(spdxDocumentReferencingExternal);
// This should be used in place of the old getId() method.
```

--------------------------------

### SPDX 2.X Model Package Structure (Java)

Source: https://github.com/spdx/spdx-java-library/blob/master/README-V3-UPGRADE.md

Illustrates the new package naming convention for accessing SPDX 2.X model objects in the updated Java library. Classes are now located under `org.spdx.library.model.v2.[package]`.

```java
import org.spdx.library.model.v2.SPDXDocument;
import org.spdx.library.model.v2.license.SpdxListedLicense;
import org.spdx.library.model.v2.InvalidSPDXAnalysisException;

// Example usage of v2 classes
SPDXDocument spdxDoc = null; // ... create or load a v2 document
SpdxListedLicense license = null; // ... get a license object
try {
    // ... perform operations
} catch (InvalidSPDXAnalysisException e) {
    // ... handle exception
}
```
Tokens:
Raw