Thank you for your interest in Spdx-Java-Library. The project is open-source software, and bug reports, suggestions, and most especially patches are welcome.
Spdx-Java-Library has a project page on GitHub where you can create an issue to report a bug, make a suggestion, or propose a substantial change or improvement that you might like to make. You may also wish to contact the SPDX working group technical team through its mailing list, spdx-tech@lists.spdx.org.
If you would like to work on a fix for any issue, please assign the issue to yourself prior to creating a Pull Request.
The source code for Spdx-Java-Library is hosted on github.com/spdx/Spdx-Java-Library. Please review open pull requests and active branches before committing time to a substantial revision. Work along similar lines may already be in progress.
To submit a pull request via GitHub, fork the repository, create a topic branch from master for your work, and send a pull request when ready. If you would prefer to send a patch or grant access to pull from your own Git repository, please contact the project's contributors by e-mail.
To contribute an implementation of a feature defined by a version of the SPDX specification later than the one supported by the current SPDX Tools release, clone the branch spec/X.X, where X.X is the major.minor version of the targeted specification (e.g. "3.0").
Once implemented, submit a pull request with spec/X.X branch as the parent branch.
However you choose to contribute, please sign-off in each of your commits that you license your contributions under the terms of the Developer Certificate of Origin. Git has utilities for signing off on commits: git commit -s signs a current commit, and git rebase --signoff <revision-range> retroactively signs a range of past commits.
AI tools (e.g., LLMs, code assistants, and proofreaders) are permitted as assistive supplements, not replacements for human judgment.
- Code review: AI tools may act as a preliminary "peer reviewer" to catch syntax or style issues, similar to a non-AI code analysis tool. However, a human must perform the final review, validate logic, and take full responsibility for all decisions.
- Automation: AI is acceptable for offloading repetitive, well-understood, and time-consuming boilerplate tasks.
- Verification: All AI-generated suggestions must be manually verified for security, performance, and project alignment.