Associates a package with a capability it requires, such as a shared library (libssl.so.3), virtual package name, or other functionality. Critical for shared library dependency resolution - enables 'what requires this .so' queries and CVE blast radius analysis.
Links a package to a capability it requires
requires capability
A direct provision relationship indicating that one package provides the functionality of another, optimized for efficient dependency resolution queries.
Direct provision relationship between packages for efficient querying
directly provides
The username, login, or unique identifier of a contributor on a specific platform.
The username or identifier on the platform
account username
Associates a binary package with the source package from which it was compiled, enabling grouping of related binary outputs.
Links a binary package to the source package it was built from
built from source
The HTTP/HTTPS URL of the package repository metadata that was used as the data source for collection. Enables traceability and re-collection.
The URL from which this repository data was collected
repository source URL
The specific hardware platform, instruction set, or system architecture for which a software package has been compiled or designed to run.
The hardware or software architecture for which a package is built
Architecture
Indicates that one distribution is derived from another (e.g., Ubuntu from Debian, CentOS from RHEL), establishing distribution lineage for package tracking.
Indicates that one distribution is derived from another
derived from distribution
A relationship that associates a software package with a specific version or release of that package.
Links a package to one of its versions
has version
Convenience property linking a package directly to the agent (Person or SoftwareAgent) maintaining it. For detailed role metadata (role type, start date), use hasMaintenanceRole.
Links a package directly to the agent (person or software agent) maintaining it
maintained by
Associates a source package with an architecture it declares support for building, as declared in the source package control file.
An architecture that the source package can be built for
supported architecture
An activity that deploys a package and its dependencies onto a target system, making the software available for use.
The process of installing a package on a system
Installation Activity
A textual representation of a package version, typically following semantic versioning or other versioning schemes to indicate the release sequence and compatibility.
The version identifier of a package
version string
Records when a maintainer began their maintenance responsibilities for a package.
Date when the maintainer started maintaining the package
maintainer since
Associates a package identity with the canonical upstream source code repository. This is the primary cross-distribution identity anchor — packages from different distros that share the same upstream repository are the same software, regardless of package name.
The upstream VCS repository this package is built from. Derived from Homepage/URL when it points to a known forge, or from dist-git spec files.
upstream repository
Associates a package with the specific build activity that compiled and created it from source materials.
Links a package to the build activity that created it
was built by
Associates a package with the application binary interface it conforms to.
Links a package to its application binary interface
has ABI
Links an upstream project to its primary source code repository. Makes UpstreamProject the central hub for cross-ecosystem identity - connect all ecosystem packages to the project, then to the shared repository.
Links an upstream project to its VCS repository
project repository
An identifier for the packaging release of a specific version of the upstream software.
The release number of the package, often indicating a packaging-specific update.
release
Links an installed file (typically a shared library .so artifact) to the abstract capability it satisfies, closing the loop between filesystem artifacts and package dependency requirements. This shortcut enables efficient queries for shared library resolution analysis: which specific file provides libssl.so.3?
The abstract capability that this installed file satisfies (typically for shared libraries)
satisfies capability
A maintenance role assignment linking a person to a package they maintain. This is an anti-rigid concept — a maintenance role assignment can begin or end without the person ceasing to exist.
A maintenance role assignment linking a person to a package
Maintainer
PackageGraph Core defines the foundational classes and properties for representing software packages across Linux distributions and other package ecosystems. It models binary and source packages, versioned dependencies with constraints, maintainers, architectures, and distribution releases as a connected RDF graph. The ontology serves as the shared schema that distribution-specific extensions (Debian, RPM, Arch, etc.) specialize, enabling cross-distribution queries over a unified SPARQL endpoint.
A comprehensive ontology for modeling software packages, dependencies, repositories, and package management systems across different platforms and ecosystems.
Core ontology for representing software packages and repositories across different package management systems. Upper ontology positioning: PackageGraph adopts lightweight alignment to established domain vocabularies (PROV-O, FOAF, SPDX, DOAP) rather than full BFO or DOLCE alignment. Software packages are informational artifacts whose lifecycle includes physical manifestations (installed files) and social roles (maintainers). BFO's material-entity/process distinction and DOLCE's cognitive/social focus do not cleanly categorize these hybrid entities. Our alignment strategy prioritizes semantic interoperability with domain-standard vocabularies over foundational ontology categorization. Multilingual metadata design: PackageGraph does not mandate @en language tags on data literals for graph efficiency — package names are technical identifiers, not translatable text, and adding language tags to 62.7M string literals increases storage cost and breaks existing SPARQL queries. However, the ontology acknowledges that multilingual package metadata is a real domain concern: Debian and Ubuntu maintain dedicated localisation teams (debian-l10n-english, ubuntu-translators) providing meticulously translated descriptions for packages like apache2, nginx, and postgresql. The RDF literal language tag mechanism remains available for collectors that ingest such translated metadata — the ontology does not prohibit language-tagged literals, it simply does not require them for monolingual English data.
Package Management Core Ontology
Specifies the architecture(s) for which this dependency applies. Many package ecosystems support architecture-conditional dependencies: RPM allows architecture qualifiers in Requires directives (e.g., glibc is required on x86_64 but not wasm), Debian allows architecture restrictions in Build-Depends fields (e.g., [amd64] [arm64]). When omitted, the dependency applies to all architectures.
The architecture(s) for which this dependency applies (architecture-conditional dependencies)
applicable architecture
A relationship that associates a software package with the specific hardware or system architecture for which it has been compiled or designed.
Links a package to the architecture it targets
target architecture
Indicates whether the upstream project was originated by the same organization that packages and distributes it, as opposed to being an independent community project.
Whether the upstream project was created by the packaging vendor
is vendor originated
A comprehensive package management ecosystem that may span multiple distributions, formats, and repositories, such as the Debian ecosystem including Ubuntu derivatives.
A broader ecosystem encompassing multiple distributions and package formats
Package Ecosystem
The identifier for a capability, such as a shared library name (libssl.so.3), virtual package name, or other capability identifier.
The name or identifier of a capability
capability name
The informal name or codename of a distribution release, such as 'bookworm' for Debian 12 or 'noble' for Ubuntu 24.04.
The codename of the distribution release
release codename
Indicates that this package's functionality has been absorbed into another package due to subpackage reorganization across architectures or builds. Used to track packages that exist on some arches but are merged into others on different arches.
Indicates that this package's functionality has been absorbed into another package (subpackage reorganization)
superseded by
Associates a packaging activity with the source code, files, or other materials it used as input.
Links a packaging activity to source materials it used
used source
Associates a source package with the upstream open source project that it packages for distribution.
Links a source package to the upstream project it packages
has upstream project
The web address from which the package file or archive can be directly downloaded or accessed.
The URL from which the package can be downloaded
download URL
A binary package containing compiled executables, libraries, or architecture-independent files, ready for installation on a target system.
A compiled, installable package produced from a source package
Binary Package
Indicates that this package supplements the functionality of another package, working in tandem with it. Used in some Debian-derived distributions.
Indicates that this package supplements another package
supplements
Indicates an architecture on which this package is known to be unavailable due to architectural constraints or hardware requirements, not build failures. Used to distinguish missing packages from architecturally impossible ones.
Indicates an architecture on which this package is known to be unavailable due to architectural constraints
excluded architecture
Associates an agent (Person or SoftwareAgent) with a contribution or maintenance role assignment.
Links an agent (person or software agent) to a contributor or maintainer role they hold
holds role
A file that is installed on the target filesystem when a binary package is installed, including executables, libraries, configuration files, and documentation.
A file installed on the system by a binary package
Installed File
The primary website or homepage URL for an upstream open source project.
The primary URL for the upstream project
project URL
Associates a package with a Checksum instance containing a hash value and algorithm.
Links a package to one of its checksums
has checksum
Associates a build activity with the packages or dependencies it required during the build process.
Links a build activity to dependencies it required
used dependency
Identifies the specific package that satisfies a dependency, linking the reified Dependency to its target Package.
The package that a dependency relationship targets
dependency target
The date when a distribution release ceases to receive security updates and support.
The date when the distribution release reaches end of life
end of life date
An activity that compiles source code and creates executable binaries or libraries as part of the packaging process. Aligned with PROV-O Activity concept — builds are time-bounded activities with agents (builders) and entities (source/binary artifacts).
The process of compiling and building software from source
Build Activity
An activity that uploads and makes a package available for distribution through a package repository.
The process of making a package available in a repository
Publishing Activity
The size of the package file or archive, measured in bytes, before installation or extraction.
The size of the package file
package size
The total time duration required to complete a packaging-related activity.
How long a packaging activity took to complete
activity duration
A named collection of packages within a distribution or product, used to define subsets such as base systems, application streams, or product-specific package sets.
A named subset of packages within a distribution or product
Package Set
A requirement relationship between software packages where one package needs another package to be present and functional in order to operate correctly.
A relationship indicating that one package requires another package to function properly
Dependency
The inverse relationship of hasVersion, linking a version back to the package it belongs to. Critical for security queries that start from an affected version and need to find the package.
Links a version to the package it belongs to
version of
A legal document or agreement that specifies the terms and conditions under which a software package may be used, modified, and distributed.
The legal license under which a package is distributed
License
Provides a numeric weight indicating the relative importance or strength of a dependency relationship.
Relative weight or importance of a dependency
dependency weight
The canonical or commonly used name of an upstream open source project, such as 'openssl' or 'gcc'.
The canonical name of the upstream project
project name
The inverse of maintainedBy, linking an agent (Person or SoftwareAgent) to the packages they maintain.
Links an agent (person or software agent) to the packages they maintain
maintains
A platform-specific identity for a contributor, such as a GitHub username, Debian maintainer email, or Fedora Account System login, enabling cross-platform contributor identification.
An identity or account for a contributor on a specific platform
Contributor Account
DEPRECATED: A string representation of the package's license. Use hasLicense to link to a License entity instead. The spdxId of the License entity linked via hasLicense is the canonical representation. This property is retained for backward compatibility with existing data but should not be used in new collectors.
DEPRECATED in favor of hasLicense. The SPDX license expression or license name string for the package
license name
Associates a dependency with a structured version constraint that specifies acceptable version ranges.
Links a dependency to a structured version constraint
has version constraint
Links a package to the upstream software ecosystem it originates from, enabling ecosystem-level cross-referencing and analysis. The Ecosystem entity allows traversal to all packages from that ecosystem rather than matching string literals.
The upstream package ecosystem entity (cargo, pypi, npm, gomod, etc.)
upstream ecosystem
The date of the most recent release or version of the package, enabling recency analysis and stale package detection.
The date of the most recent release or version
last release date
Associates a package with a named package set that it belongs to, enabling classification of packages into product-specific or distribution-specific groupings.
Links a package to a package set it belongs to
member of package set
The inverse of holdsRole — links a role assignment to the agent (Person or SoftwareAgent) holding it, enabling representation of both human maintainers and automated bot contributors.
Links a role assignment back to the agent (person or software agent) who holds it
held by
A relationship that associates a package manager with the repositories it controls and provides access to.
Links a package manager to the repositories it manages
manages
The inverse relationship of dependsOn, indicating that this package is required by another package.
Indicates that this package is a dependency of another package
is dependency of
A relationship that associates a software package with the repository where it is stored and made available for distribution.
Links a package to the repository that contains it
contained in
A functional capability provided by or required by a package, such as a shared library (e.g., libssl.so.3), virtual package name, or other abstract functionality. Critical for shared library dependency resolution - enables blast radius analysis via .so linking.
A capability provided or required by packages (shared library, virtual package, etc.)
Capability
Associates a source package with the binary packages produced by building it.
Links a source package to binary packages it produces
produced binary
Associates a package with the specific VCS commit from which it was built, enabling precise source-to-binary traceability and build reproducibility verification.
Links a package to the VCS commit it was built from
derived from commit
Associates a packaging activity with the agent (person, organization, or automated system) that performed it.
Links a packaging activity to the agent that performed it
performed by
The version identifier of a distribution release, such as '12' for Debian 12 or '41' for Fedora 41.
The version number of the distribution release
release version
A source package containing the original source code, build scripts, and packaging metadata required to produce one or more binary packages for distribution.
A package containing source code that can be built into one or more binary packages
Source Package
The processor instruction set architecture that defines the machine code interface, such as x86_64, ARM64, or RISC-V.
The specific instruction set architecture (ISA) for binary packages
Instruction Set Architecture
The canonical name of the upstream software in its native package ecosystem, extracted from RPM provides entries like crate(foo) or python3dist(bar). Enables cross-ecosystem identity linking. Retained for backward compatibility - prefer upstreamPackageIdentity for new data.
The name of the package in its upstream ecosystem (e.g., crate name, PyPI name)
upstream package name
Associates a binary package with the specific instruction set architecture it was compiled for.
Links a package to its instruction set architecture
has instruction set architecture
Associates a maintainer with their specific role and responsibilities for packages.
Links a maintainer to their specific role
has maintainer role
An activity that executes test suites to verify the functionality and quality of a software package.
The process of running tests on a package
Test Activity
Links a distribution package identity to the upstream package identity in the native ecosystem (e.g., Debian python3-requests → PyPI requests). Replaces dead-end upstreamPackageName literal with a traversable object property - critical for supply chain analysis.
Links to the upstream package identity in its native ecosystem
upstream package identity
Associates packages from different distributions that provide similar functionality or serve analogous purposes. This is a correspondence assertion, not formal equivalence — it is symmetric but intentionally NOT transitive, as cross-distribution package equivalence is context-dependent (e.g., Debian libssl-dev corresponds to Fedora openssl-devel, but Alpine equivalents may differ in ABI or capabilities).
Links packages that serve similar functions across distributions. Intentionally non-transitive: A~B and B~C does not imply A~C.
cross-distribution alternative
Associates packages, repositories, or other components with a specific versioned release of a distribution.
Links packages or repositories to a specific distribution release
part of release
A role assignment representing a person's contribution to a package or repository. This is an anti-rigid concept — a person can start or stop holding this role without ceasing to exist.
A contribution role assignment linking a person to a package or repository
Contributor
Links a distribution release to packages it contains, enabling efficient 'what packages are in this release' queries.
Links a distribution release to packages it contains
release contains
A software application or system that automates the process of installing, upgrading, configuring, and removing software packages, including dependency resolution and conflict management.
A software tool that manages the installation, updating, and removal of packages
Package Manager
The inverse relationship of replaces, indicating that this package is superseded by another package.
Indicates that this package is replaced by another package
is replaced by
A discrete unit of software represented in package repository metadata, typically containing executable code, configuration files, documentation, and metadata. Most packages can be installed, updated, or removed by a package management system, though some entries (such as phantom packages) exist only as metadata references.
A software package that can be installed, maintained, or distributed through a package management system
Package
A package that exists in repository primary metadata (e.g., primary.xml for RPM) but has no corresponding files in the file list metadata. Common for TeX Live virtual subpackages and auto-generated meta-entries. Structurally different from a regular Package because it cannot be installed.
A package entry in repository metadata that has no installable files
Phantom Package
A stable, version-independent identifier for a package name within a specific distribution, release, and architecture. BinaryPackage instances link to their identity via isVersionOf. Dependencies point to the identity, enabling direct name-based joins without URI parsing.
The version-agnostic identity of a package within a distribution and architecture. Dependency targets point to this instead of versioned instances.
Package Identity
Indicates whether a contributor is currently active in package development or maintenance.
Whether the contributor is currently active
active contributor
Associates a distribution with the broader package ecosystem it belongs to.
Links a distribution to its broader ecosystem
part of ecosystem
The low-level binary interface that defines calling conventions, data layouts, and system call interfaces for a specific platform.
The binary interface specification for a platform
Application Binary Interface
A relationship that associates a software package with the legal license under which it is distributed and may be used.
Links a package to its license
has license
Indicates whether the package contains processor-specific optimizations or machine code that is optimized for a particular instruction set architecture.
Indicates whether the package contains ISA-specific optimizations
ISA-specific code
A direct conflict relationship between packages, providing an efficient query path for identifying incompatible packages.
Direct conflict relationship between packages for efficient querying
directly conflicts with
Defines the specific responsibilities and authority level of a maintainer for a package, such as primary maintainer, co-maintainer, or sponsor.
The specific role a maintainer plays for a package
Maintainer Role
The date when a distribution release was officially published or made available.
The date the distribution release was published
release date
A complete operating system distribution that packages and distributes software using specific package management systems.
A specific Linux/Unix distribution
Distribution
The unique identifier or name by which a software package is known within a package management system.
The name of a package
package name
A relationship indicating that one package is required to compile or build a source package from its source code, but is not required for the resulting binary packages to function.
Indicates a build-time dependency that is required to build the source package but not needed at runtime.
build depends on
The inverse relationship of directlyDependsOn, indicating that this package is a direct dependency of another package. Critical for blast radius analysis - enables efficient queries for 'what directly depends on this package'.
Indicates that this package is a direct dependency of another package
is direct dependency of
A relationship that associates a package repository with the package management system that controls and provides access to it.
Links a repository to the package manager that manages it
managed by
Identifies the platform or service where a contributor account is registered, such as GitHub, Debian, Fedora, or GitLab.
The platform or service where the account exists
account platform
A package that contains minimal or no files itself but serves to group related packages together through dependencies, commonly used for task-based installations.
A package that exists primarily to depend on other packages
Meta Package
An automated software system that performs package maintenance tasks, such as dependency update bots (Renovate, Dependabot), CI/CD pipelines, or automated security patchers. Distinguished from Person to preserve OntoClean rigidity — a bot is not a foaf:Person.
An automated software agent performing package maintenance tasks
Software Agent
A relationship indicating that one package requires another package to be present and functional in order to operate correctly.
Indicates that a package requires another package to function
depends on
A boolean flag indicating whether this snapshot is the most recent for its data source. Used for tiered storage lifecycle management.
Whether this snapshot represents the current active data for its source.
is current
The actual cryptographic hash value as a hexadecimal string.
The hexadecimal hash string
checksum value
Associates a specific versioned binary package with the canonical package identity it belongs to. Enables queries that traverse from a versioned instance to all other versions of the same package.
Links a versioned binary package to its version-agnostic package identity.
is version of
The specific version string that the constraint is compared against using the constraint operator.
The version value used in a version constraint
version constraint value
Indicates that this package absorbs the functionality of another package, typically due to subpackage consolidation or reorganization across architectures.
Indicates that this package absorbs the functionality of another package
supersedes
A symmetric relationship indicating that two packages cannot be installed simultaneously on the same system due to incompatibilities or resource conflicts. If package A conflicts with package B, then B conflicts with A.
Indicates that a package cannot be installed alongside another package (symmetric relationship)
conflicts
The comparison operator that defines how the version constraint should be evaluated, such as greater than, equal to, or less than.
The comparison operator used in a version constraint (e.g., '>=', '=', '<=')
version constraint operator
Associates a package with a Maintainer role assignment, providing access to role type (via hasMaintainerRole), start date (via maintainerSince), and the agent holding the role (via heldBy).
Links a package to a maintenance role assignment providing detailed role metadata
has maintenance role
Classifies the repository source type to enable proper comparison semantics. Release repos are composed for end-user installation. Build repos are Koji build targets. Updates are post-release patches.
The type of package repository (release, development, build, updates, updates-testing)
repository type
Associates a package identity with the distribution-specific repository that contains the packaging metadata (debian/ directory, spec files, patches). Distinct from the upstream repository — packaging repos are distro-specific while upstream repos are universal.
The distribution-specific packaging repository (e.g., Debian Salsa, Fedora dist-git). Contains packaging rules, patches, and build configuration.
packaging repository
A strict dependency that must be fully installed and configured before this package can even be unpacked. Stronger than regular depends. Used in Debian Pre-Depends tag for critical system dependencies.
Indicates a pre-installation dependency (stronger than regular depends)
pre-depends
Categorizes the nature of contributions made to a package, such as code, documentation, packaging, or security updates.
The type of contribution made to a package
Contribution Type
Associates a contributor with the organization they are affiliated with, enabling analysis of contributor diversity and organizational representation in package maintenance.
Links a contributor to their affiliated organization
contributor organization
The inverse relationship of isVersionOf, linking a package identity to all versioned binary packages that belong to it. Enables efficient 'list all versions of package X' queries from the identity node.
Links a package identity to its versioned binary package instances.
has package
A reverse-direction weak dependency indicating that installing this package enhances the functionality of the target package. Used in Debian Enhances tag. If package A enhances package B, installing A provides additional features to B.
Indicates that this package enhances another package's functionality
enhances
The web URL of a contributor's profile page on a specific platform.
The URL of the contributor's profile on the platform
account URL
Symmetric relationship between package identities from different ecosystems that represent the same software (e.g., Debian python3-requests ↔ PyPI requests). Enables bidirectional cross-ecosystem identity queries.
This package identity is equivalent to another package identity from a different ecosystem
upstream equivalent
The amount of disk space, measured in bytes, that the package will occupy after being fully installed on the target system.
The disk space required when the package is installed
install size
Associates a package with a capability it provides, such as a shared library (libssl.so.3), virtual package name, or other functionality. Critical for shared library dependency resolution - enables 'what provides this .so' queries.
Links a package to a capability it provides
provides capability
A structured specification that defines acceptable version ranges for package dependencies, including operators and target versions.
A structured representation of version constraints for dependencies
Version Constraint
A weak dependency relationship suggesting that installing the target package enhances functionality but is not required. Used in Debian Recommends and RPM Recommends tags. If package A recommends package B, A works without B but gains features when B is present.
Suggests installing another package for enhanced functionality
recommends
An asymmetric relationship indicating that one package is intended to supersede and replace another package, typically during system upgrades or package transitions. If package A replaces package B, then package B does not replace package A.
Indicates that a package replaces another package (asymmetric relationship)
replaces
A reified checksum associating a cryptographic hash value with the algorithm used to compute it, enabling packages to carry multiple checksums of different types (e.g., SHA-256 and MD5 simultaneously).
A cryptographic hash of a package file, pairing the hash value with its algorithm
Checksum
A version component used to differentiate between incompatible versioning schemes or to correct mistakes in version ordering.
The epoch of the version, used in some systems to manage version comparison across different numbering schemes.
epoch
A string identifying the tool and data source that produced this snapshot.
Identifier of the data source that produced this snapshot (e.g., 'pg-collect debian', 'enricher-osv').
snapshot source
Associates a binary package with a file it installs on the target filesystem.
Links a binary package to a file it installs on the system
installs file
A relationship indicating that one package offers the same functionality or interface as another package, potentially serving as a substitute or alternative implementation.
Indicates that a package provides the functionality of another package
provides
A record of a data collection or enrichment run, tracking the named graph URI, source identifier, timestamp, and currency status for graph lifecycle management.
Metadata about a named graph — when it was collected, from what source, whether it is current.
Data Snapshot
Associates a distribution with a specific versioned release, such as Debian 12 or Fedora 41.
Links a distribution to one of its releases
has release
A centralized storage location where software packages are hosted and made available for distribution, typically accessible via network protocols and managed by package management systems.
A storage location for packages, accessible through a package management system
Repository
A direct dependency relationship between packages, providing an efficient query path that bypasses the detailed dependency metadata structure. This property is a materialized convenience shortcut semantically grounded by the property chain axiom: if X hasDependency D and D dependencyTarget Y, then X directlyDependsOn Y. For version constraint details, traverse the Dependency reification.
Materialized convenience shortcut of the hasDependency → dependencyTarget chain. For version constraint details, traverse the Dependency reification. NOTE: owl:propertyChainAxiom requires OWL 2 reasoning to materialize — Fuseki without OWL reasoning will not auto-derive this property from hasDependency chains.
directly depends on
An activity that transforms source code, configuration files, and other materials into a distributable package format.
The process of creating a package from source materials
Packaging Activity
The absolute filesystem path where a file is installed on the target system, such as /usr/bin/gcc or /usr/lib/libssl.so.3.
The filesystem path where the file is installed
installed file path
Specifies that one distribution is based on or derived from another distribution's codebase and package set.
derived from
A version component that specifies a minor update or packaging-specific revision.
The revision of the package, often indicating a minor packaging update or a source control revision.
revision
Associates packages, repositories, or other components with their parent distribution.
Links packages or repositories to their parent distribution
part of distribution
A textual explanation of the package's purpose, functionality, and features, intended to help users understand what the package provides.
A human-readable description of what the package does
description
Associates a package with a structured dependency that captures the target package, version constraints, and dependency type. Detailed dependency with type and version constraint. The directlyDependsOn shortcut provides a simpler graph traversal path for queries that don't need constraint details.
Links a package to a reified dependency relationship with version constraints. The directlyDependsOn property provides a materialized shortcut (via owl:propertyChainAxiom) for simpler traversal.
has dependency
The URI of the named graph in Fuseki that contains this snapshot's data.
The named graph URI this snapshot was loaded into.
snapshot graph
The SPDX License List identifier for this license (e.g., 'GPL-2.0-only', 'MIT', 'Apache-2.0'), enabling mechanically queryable license classification and compatibility analysis.
The SPDX license identifier
SPDX identifier
A specific release or iteration of a software package, identified by a version string and representing a particular state of the package's development.
A specific version or release of a package
Version
The inverse relationship of provides, indicating that this package's functionality is offered by another package.
Indicates that this package's functionality is provided by another package
is provided by
Classifies the nature of a dependency relationship by linking the reified Dependency node directly to the formal property predicate that defines its semantics. Values are property URIs (pkg:dependsOn, pkg:buildDependsOn, pkg:recommends, etc.) using OWL 2 punning. This harmonizes the dual-model: the reified node references the exact shortcut predicate it represents, unifying what was previously a disconnected magic string with the traversable property hierarchy.
The type of dependency relationship, represented by the URI of the corresponding shortcut property
dependency type
Associates a contributor role with repositories it contributes to, enabling analysis of contributor activity across repositories.
Links a contributor role to repositories it contributes to. Conceptually related to hasContributor (Repository→Agent convenience shortcut), but not formally inverse to avoid OntoClean role/identity collapse.
contributes to
A specific versioned release of a Linux distribution, such as Debian 12 (bookworm) or Fedora 41, containing a defined set of packages.
A specific versioned release of a distribution
Distribution Release
Package URL (PURL) - a standardized, universal identifier for software packages across ecosystems (e.g., pkg:npm/lodash@4.17.21, pkg:pypi/requests@2.28.0). Enables cross-tool interoperability and SBOM generation.
Package URL (PURL) - standardized package identifier
purl
An even weaker dependency relationship than recommends, indicating that the target package may be useful in certain contexts but is not typically needed. Used in Debian Suggests and RPM Suggests tags.
Suggests another package that may be useful in some scenarios
suggests
Links an upstream project to package identities in various ecosystems (PyPI, npm, Cargo, etc.). Enables queries like 'what packages from different ecosystems come from the same project'.
Links an upstream project to a package identity in a specific ecosystem
ecosystem package
The textual log output generated during the execution of a packaging activity, useful for debugging and auditing.
Log output generated during a packaging activity
activity log output
An abstract functional promise that can be satisfied by one or more concrete packages. Virtual packages have no artifact (no size, no checksum, no installable files) — they represent a capability that multiple packages can provide.
An abstract functional promise that can be satisfied by one or more concrete packages
Virtual Package
A relationship that associates a repository with the packages it hosts and makes available for distribution.
Links a repository to the packages it contains
contains
The web address of the main website or homepage associated with the software package or its development project.
The homepage URL of the package or project
homepage
Records the date and time when a packaging-related activity was initiated.
When a packaging activity began
activity start time
A rigid identity representing a human individual. Persons hold roles (Contributor, Maintainer) which are time-dependent and context-dependent. The same Person can maintain packages in multiple distributions and hold different roles over time.
A human individual who can hold contributor or maintainer roles across packages and distributions
Person
Records the date and time when a packaging-related activity was completed.
When a packaging activity completed
activity end time
The numeric exit code returned by a packaging activity, indicating success (typically 0) or failure (non-zero).
The exit code returned by a packaging activity
exit code
The date and time when the data collection or enrichment run completed.
When this data snapshot was created.
snapshot timestamp
The name of the cryptographic hash algorithm used to compute this checksum value.
The hash algorithm (e.g., SHA-256, MD5, SHA-1)
checksum algorithm
Convenience property linking a repository directly to the agents (Person or SoftwareAgent) contributing to it. For detailed role information, traverse via contribution role assignments.
Links a repository directly to contributing agents (persons or software agents). Conceptually related to contributesTo (Contributor→Repository), but not formally inverse to avoid OntoClean role/identity collapse.
has contributor
A test-time dependency required to run a source package's test suite but not needed for building or runtime. Used in RPM BuildRequires with check context.
Indicates a test-time dependency for running the package's test suite
check requires
The date of the most recent commit to the upstream repository, indicating active development status.
The date of the most recent commit to the upstream repository
last commit date
The package name as used for the version-agnostic identity within a distribution and architecture context. This provides a lexical anchor for PackageIdentity instances, distinct from the versioned packageName on Package instances.
The name of the package identity
identity name
Associates a person with a ContributorAccount representing their identity on a specific platform (e.g., GitHub username, Fedora Account System login, Debian maintainer email).
Links a person to their platform account identifier
has account
An upstream software project that serves as the origin for packages across multiple distributions, enabling cross-distribution analysis through a shared identity. Aligned with DOAP (Description of a Project) vocabulary — upstream projects are software projects with maintainers, repositories, and releases.
An upstream open source project that is packaged by one or more distributions
Upstream Project