Passing branch names, a commit hash or a tag name is possible like so:

[-e] git://git.myproject.org/MyProject.git@master#egg=MyProject

[-e] git://git.myproject.org/MyProject.git@v1.0#egg=MyProject

[-e] git://git.myproject.org/MyProject.git@da39a3ee5e6b4b0d3255bfef95601890afd80709#egg=MyProject

For version-controlled files, the VCS location syntax is similar to a URL and has the:

<vcs_tool>+<transport>://<host_name>[/<path_to_repository>][@<revision_tag_or_branch>][#<sub_path>]

 

This VCS location compact notation (inspired and mostly adopted from https://pip.pypa.io/en/latest/reference/pip_install.html#vcs-support as of 20150220)  supports referencing locations in version control systems such as Git, Mercurial, Subversion and Bazaar, and specifies the type of VCS tool using url prefixes: “git+”, “hg+”, “bzr+”, “svn+” and specific transport schemes such as SSH or HTTPS.

 

Specifying sub-paths,  branch names, a commit hash, a revision   or a tag name is recommended, and supported using the "@"delimiter for commits and the "#" delimiter for sub-paths.

 

Using user names and password in the host_name is not supported and should be considered as an error. User access control to URLs or VCS repositories must be handled outside of an SPDX document.

 

In VCS location compact notations, the trailing slashes in <host_name>, <path_to_repository> are not significant. Leading and trailing slashes in <sub_path> are not significant.

To specify a sub-path to a file or directory inside a repository use the "#" delimiter:

 

PackageDownloadLocation: git://git.myproject.org/MyProject#src/somefile.c

PackageDownloadLocation: git+https://git.myproject.org/MyProject#src/Class.java

 

To specify branch names, a commit hash or a tag name, use the "@" delimiter:

 

PackageDownloadLocation: git://git.myproject.org/MyProject.git@master

PackageDownloadLocation: git+https://git.myproject.org/MyProject.git@v1.0

PackageDownloadLocation: git://git.myproject.org/MyProject.git@da39a3ee5e6b4b0d3255bfef95601890afd80709