ORD-2.2
An enterprise producing an sbom, under ORD 2.2
Large organisation with procurement, legal review, and an SBOM process. Generating a software bill of materials for a customer or regulator. This resolves to the Canopy tier.
Tier
Owed
A quarterly Canopy Report. Section 5.1 imposes a royalty only when the Canopy Licensee makes Production Use.
Sections in play
1.8, 16.1, 3.1, 5.1, 5.2, 8.1
Who and what
The situation being resolved.
Actor
An enterprise
Large organisation with procurement, legal review, and an SBOM process.
over 50M USD
Situation
Producing an SBOM
Generating a software bill of materials for a customer or regulator.
Rulings
3 questions resolved against the text.
Which tier applies?
Canopy. Large organisation with procurement, legal review, and an SBOM process. Section 5.2 reporting applies; the Section 5.1 royalty attaches when the Licensee makes Production Use and only to attributable revenue.
Sections 1.8, 3.1, 5.1
Is anything owed?
A quarterly Canopy Report. Section 5.1 imposes a royalty only when the Canopy Licensee makes Production Use.
Sections 5.1, 5.2
What goes in the SBOM?
Use the SPDX-valid LicenseRef form, the version, the canonical URL, and the attribution records Section 8.1 requires. Until a listed SPDX identifier is issued, do not use an unqualified ORL short form as though it were already on the SPDX License List.
Sections 8.1, 16.1
Cautions
What this situation gets wrong most often.
Section 8.3 of ORD requires a withdrawal of consent to propagate to any derivative you have distributed. Whether that is operationally achievable at depth is a published open question.
Same actor
Other situations for this party.
Non-normative. Where this and the licence text disagree, the licence text applies.