SPDX
Software Package Data Exchange
A Linux Foundation standard for SBOMs and license information, published as ISO/IEC 5962:2021 for version 2.2.1; SPDX 3.0 adds profiles for security, AI models and datasets, among others.
- Defined in
- SPDX specifications
Covered in
Choose SBOM formats and identify components accurately
Separate schema versions, document references and package identities so inventory conversion and advisory matching preserve meaning.
Open source license compliance: SPDX expressions, obligations and SBOM checks
Know which licenses you ship, read SPDX license expressions correctly, meet the obligations of common licenses for the way you distribute, and enforce a license policy in CI from the SBOM.
Generate an SBOM for the software you actually release
Define the inventory boundary, compare build and artifact evidence, and connect the resulting SBOM to an immutable release.
Practice: SBOM completeness lab: Find the dependencies missing from a release SBOM · Local project: Build and verify a signed software release