Fedora 44 native package

php-composer-spdx-licenses

SPDX licenses list and validation library

Packages / Fedora 44 / Unspecified / php-composer-spdx-licenses

[Source: php-composer-spdx-licenses]

Package: php-composer-spdx-licenses (1.6.0-1.fc44)

[Project overview: php-composer-spdx-licenses]

External Resources:

Homepage: [github.com]

SPDX licenses list and validation library

SPDX licenses list and validation library. Originally written as part of composer/composer, now extracted and made available as a stand-alone library.

Other Packages Related to php-composer-spdx-licenses:

dep: php(language) (>= 7.2)
Package not available
dep: php-composer(fedora/autoloader)
Package not available
dep: php-json
Package not available

Download php-composer-spdx-licenses

Architecture	Package Size	Installed Size	Files
noarch	25 KiB	98 KiB	[list of files]

Package file paths (14)

Paths come from the repository package-file index for the observed builds. They describe archive/package associations, not every file that will exist on a running system after maintainer scripts, alternatives, generated state, diversions, or installation choices.

/usr/share/doc/php-composer-spdx-licenses
/usr/share/doc/php-composer-spdx-licenses/CHANGELOG.md
/usr/share/doc/php-composer-spdx-licenses/composer.json
/usr/share/doc/php-composer-spdx-licenses/CONTRIBUTING.md
/usr/share/doc/php-composer-spdx-licenses/README.md
/usr/share/licenses/php-composer-spdx-licenses
/usr/share/licenses/php-composer-spdx-licenses/LICENSE
/usr/share/php/Composer
/usr/share/php/Composer/Spdx
/usr/share/php/Composer/Spdx/autoload.php
/usr/share/php-composer-spdx-licenses
/usr/share/php-composer-spdx-licenses/spdx-exceptions.json
/usr/share/php-composer-spdx-licenses/spdx-licenses.json
/usr/share/php/Composer/Spdx/SpdxLicenses.php

Field source: Fedora 44 updates x86_64 revision 44-updates-x86_64:ffcac72d41afd8a62019714dd668a27f333f8ac19678580178b5b67c23ca6419

Use this package

OpenFactory can boot this operating system in a browser VM, or start a build that includes the native package name from this record.

Try Fedora 44 in the browser Build an image that includes php-composer-spdx-licenses

Versions, suites, and repositories

Each row is recorded package-index metadata for one version, architecture, suite, and repository. Names, URLs, and sizes are source-reported; a link is a potentially mutable retrieval location, not an OpenFactory redistribution claim or proof that OpenFactory retained the artifact bytes.

Version	Release	Architecture	Repository	Package size	Installed size	Publisher repository artifact
1.6.0-1.fc44	44 / updates	noarch	Fedora 44 · updates · x86_64	25 KiB	98 KiB	Packages/p/php-composer-spdx-licenses-1.6.0-1.fc44.noarch.rpm
1.6.0-1.fc44	44 / updates	noarch	Fedora 44 · updates · aarch64	25 KiB	98 KiB	Packages/p/php-composer-spdx-licenses-1.6.0-1.fc44.noarch.rpm
1.5.9-3.fc44	44 / everything	noarch	Fedora 44 · Everything · x86_64	25 KiB	94 KiB	Packages/p/php-composer-spdx-licenses-1.5.9-3.fc44.noarch.rpm
1.5.9-3.fc44	44 / everything	noarch	Fedora 44 · Everything · aarch64	25 KiB	94 KiB	Packages/p/php-composer-spdx-licenses-1.5.9-3.fc44.noarch.rpm

Field source: Fedora 44 updates x86_64 revision 44-updates-x86_64:ffcac72d41afd8a62019714dd668a27f333f8ac19678580178b5b67c23ca6419

Checksums and observation dates

For an APT source, signature verification authenticates the repository metadata chain and the Packages index containing this source-reported artifact digest. It does not certify package safety.

1.6.0-1.fc44 / noarchObserved Sep 1, 2026 to Sep 1, 2026

Verification status: Metadata observed; artifact bytes were not independently fetched or hashed by this catalog import. The digest below is source-reported.

Source-reported sha256: dd3fed8de15889c6635e7159129c0516948dec8ab407724ccfc56c4e6a8b50eb

After downloading that exact artifact, compare its bytes with the source-reported expected digest:

printf '%s  %s\n' 'dd3fed8de15889c6635e7159129c0516948dec8ab407724ccfc56c4e6a8b50eb' 'php-composer-spdx-licenses-1.6.0-1.fc44.noarch.rpm' | sha256sum --check --strict -

A match establishes equality with the repository metadata value. It does not establish safety or catalog-side artifact retrieval.

Field source: Fedora 44 updates x86_64 revision 44-updates-x86_64:ffcac72d41afd8a62019714dd668a27f333f8ac19678580178b5b67c23ca6419

1.6.0-1.fc44 / noarchObserved Sep 1, 2026 to Sep 1, 2026

Verification status: Metadata observed; artifact bytes were not independently fetched or hashed by this catalog import. The digest below is source-reported.

Source-reported sha256: dd3fed8de15889c6635e7159129c0516948dec8ab407724ccfc56c4e6a8b50eb

After downloading that exact artifact, compare its bytes with the source-reported expected digest:

printf '%s  %s\n' 'dd3fed8de15889c6635e7159129c0516948dec8ab407724ccfc56c4e6a8b50eb' 'php-composer-spdx-licenses-1.6.0-1.fc44.noarch.rpm' | sha256sum --check --strict -

A match establishes equality with the repository metadata value. It does not establish safety or catalog-side artifact retrieval.

Field source: Fedora 44 updates aarch64 revision 44-updates-aarch64:6ecf7f9a3a707e537dd0c542e2f5fabb365c3c76c03b091b23e9c82d7f8ff88b

1.5.9-3.fc44 / noarchObserved Sep 1, 2026 to Sep 1, 2026

Verification status: Metadata observed; artifact bytes were not independently fetched or hashed by this catalog import. The digest below is source-reported.

Source-reported sha256: 8aca92167355f7d64544062c1b6b9a90c5df6262d236044999ad8a5c7d48edee

After downloading that exact artifact, compare its bytes with the source-reported expected digest:

printf '%s  %s\n' '8aca92167355f7d64544062c1b6b9a90c5df6262d236044999ad8a5c7d48edee' 'php-composer-spdx-licenses-1.5.9-3.fc44.noarch.rpm' | sha256sum --check --strict -

A match establishes equality with the repository metadata value. It does not establish safety or catalog-side artifact retrieval.

Field source: Fedora 44 Everything x86_64 revision 44-everything-x86_64:da3845427d188097f6fd71b417a039bdfb8efefc4f38ca44b5cbb94f95a18991

1.5.9-3.fc44 / noarchObserved Sep 1, 2026 to Sep 1, 2026

Verification status: Metadata observed; artifact bytes were not independently fetched or hashed by this catalog import. The digest below is source-reported.

Source-reported sha256: 8aca92167355f7d64544062c1b6b9a90c5df6262d236044999ad8a5c7d48edee

After downloading that exact artifact, compare its bytes with the source-reported expected digest:

printf '%s  %s\n' '8aca92167355f7d64544062c1b6b9a90c5df6262d236044999ad8a5c7d48edee' 'php-composer-spdx-licenses-1.5.9-3.fc44.noarch.rpm' | sha256sum --check --strict -

A match establishes equality with the repository metadata value. It does not establish safety or catalog-side artifact retrieval.

Field source: Fedora 44 Everything aarch64 revision 44-everything-aarch64:ad124f8125666e9059d7a8180427bdaea80f6286f71140457e5c7edd95883eee

Catalog record completeness

The completeness score measures metadata coverage, not software quality, security, compatibility, or suitability.

Summary and description: 25/25
Artifact path and source digest: 25/25
Dependency metadata: 15/15
Package-file index: 15/15
Homepage: 5/5
License text: 5/5
Source package or maintainer: 10/10

Recorded total: 100/100

Field source: Fedora 44 Everything aarch64 revision 44-everything-aarch64:ad124f8125666e9059d7a8180427bdaea80f6286f71140457e5c7edd95883eee, Fedora 44 Everything x86_64 revision 44-everything-x86_64:da3845427d188097f6fd71b417a039bdfb8efefc4f38ca44b5cbb94f95a18991, Fedora 44 updates aarch64 revision 44-updates-aarch64:6ecf7f9a3a707e537dd0c542e2f5fabb365c3c76c03b091b23e9c82d7f8ff88b, Fedora 44 updates x86_64 revision 44-updates-x86_64:ffcac72d41afd8a62019714dd668a27f333f8ac19678580178b5b67c23ca6419. The cross-OS mapping is catalog-derived from the source-reported homepage; it does not establish authorship or publisher identity

Sources and provenance

Field-source links above resolve here. Each source entry names the metadata publisher, trust tier, exact snapshot revision, signature result, and observation time; catalog-derived mappings are labeled separately.

Fedora 44 Everything aarch64Sep 1, 2026
Authoritative source; repository metadata signature verified, revision 44-everything-aarch64:ad124f8125666e9059d7a8180427bdaea80f6286f71140457e5c7edd95883eee
Signature verification covers the configured repository metadata chain. It does not certify that the package is safe or suitable.
Repository-signature verification record
Signed object
https://mirrors.fedoraproject.org/metalink?repo=fedora-44&arch=aarch64
Signed-object SHA-256
236514c32119ab3c85b81fbb9e5e9d92b07aeba0d19d64c9b4fc9117a1863769
Signer fingerprint
Not recorded
Keyring revision
RPM-GPG-KEY-fedora-44-primary
SHA-256 93642aec521a1e5e96dd715f7ae0ec0850ebc9de09a94ce03cae5263f26cc18a
Tool and policy
1
openfactory-software-catalog-signature-v1
Verification time
Sep 1, 2026
Signed Release → package-index hash linkage
Path: Not recorded
Expected SHA-256: Not recorded
Observed SHA-256: Not recorded
Result: match verified
Fedora 44 Everything x86_64Sep 1, 2026
Authoritative source; repository metadata signature verified, revision 44-everything-x86_64:da3845427d188097f6fd71b417a039bdfb8efefc4f38ca44b5cbb94f95a18991
Signature verification covers the configured repository metadata chain. It does not certify that the package is safe or suitable.
Repository-signature verification record
Signed object
https://mirrors.fedoraproject.org/metalink?repo=fedora-44&arch=x86_64
Signed-object SHA-256
1300b99ac5d04b5561ad901320c8bd59ed1553f4971c3ce2ca48c40242c66676
Signer fingerprint
Not recorded
Keyring revision
RPM-GPG-KEY-fedora-44-primary
SHA-256 93642aec521a1e5e96dd715f7ae0ec0850ebc9de09a94ce03cae5263f26cc18a
Tool and policy
1
openfactory-software-catalog-signature-v1
Verification time
Sep 1, 2026
Signed Release → package-index hash linkage
Path: Not recorded
Expected SHA-256: Not recorded
Observed SHA-256: Not recorded
Result: match verified
Fedora 44 updates aarch64Sep 1, 2026
Authoritative source; repository metadata signature verified, revision 44-updates-aarch64:6ecf7f9a3a707e537dd0c542e2f5fabb365c3c76c03b091b23e9c82d7f8ff88b
Signature verification covers the configured repository metadata chain. It does not certify that the package is safe or suitable.
Repository-signature verification record
Signed object
https://mirrors.fedoraproject.org/metalink?repo=updates-released-f44&arch=aarch64
Signed-object SHA-256
2ec0ba92e556309075d8efe3c3301b36bb7ecd47c4e17566f0192c9c5436ed5f
Signer fingerprint
Not recorded
Keyring revision
RPM-GPG-KEY-fedora-44-primary
SHA-256 93642aec521a1e5e96dd715f7ae0ec0850ebc9de09a94ce03cae5263f26cc18a
Tool and policy
1
openfactory-software-catalog-signature-v1
Verification time
Sep 1, 2026
Signed Release → package-index hash linkage
Path: Not recorded
Expected SHA-256: Not recorded
Observed SHA-256: Not recorded
Result: match verified
Fedora 44 updates x86_64Sep 1, 2026
Authoritative source; repository metadata signature verified, revision 44-updates-x86_64:ffcac72d41afd8a62019714dd668a27f333f8ac19678580178b5b67c23ca6419
Signature verification covers the configured repository metadata chain. It does not certify that the package is safe or suitable.
Repository-signature verification record
Signed object
https://mirrors.fedoraproject.org/metalink?repo=updates-released-f44&arch=x86_64
Signed-object SHA-256
a69a0ab020457a7af2515066b7caccb3950bcf9dc7bedb52b1850098d9857ae1
Signer fingerprint
Not recorded
Keyring revision
RPM-GPG-KEY-fedora-44-primary
SHA-256 93642aec521a1e5e96dd715f7ae0ec0850ebc9de09a94ce03cae5263f26cc18a
Tool and policy
1
openfactory-software-catalog-signature-v1
Verification time
Sep 1, 2026
Signed Release → package-index hash linkage
Path: Not recorded
Expected SHA-256: Not recorded
Observed SHA-256: Not recorded
Result: match verified