Home / Knowledge hub / SPDX
Knowledge hub
SPDX
A standard format for listing software components and their licences.
What it means
SPDX stands for Software Package Data Exchange. It is an open standard from the Linux Foundation for describing software components, their licences, copyright details and relationships. It is also published as the international standard ISO/IEC 5962:2021.
An SPDX document can be written in several formats, including JSON, YAML, tag-value and RDF. It started as a way to record licences, and has grown to cover security uses such as listing component versions for an SBOM.
Why it matters
Licence terms are a business risk. Using a component under terms that clash with how you sell your product can lead to legal trouble or forced rework. A clear list of what you ship, and under which licence, is the first step to managing it.
For security, a standard list lets customers and regulators check your components against known flaws. It is one of the two formats most often named in buyer demands, the other being CycloneDX.
How it shows up
Build tools and scanners can generate SPDX documents. They are attached to releases or exchanged during due diligence, for example when a company is being acquired or a large customer reviews a vendor.
Mistakes include listing only direct dependencies, leaving out the contents of the container image, and treating the licence field as legal advice. Combine it with licence compliance review, and regenerate it whenever dependencies change.
Questions people ask
SPDX, answered
Is SPDX only about licences?
No. It began there, but it now also records component versions, hashes and relationships useful for security.
Is SPDX an ISO standard?
Yes. SPDX is published as ISO/IEC 5962:2021.
SPDX or CycloneDX?
Either works. Choose what your customers ask for. Many tools can produce both.
Who maintains SPDX?
The SPDX community under the Linux Foundation.
Does SPDX list vulnerabilities?
Its main job is listing components. Vulnerability status is usually handled with other tools or with VEX statements.
Sources
Where this comes from
Related
Terms that sit next to this one
SBOM
A list of every component your application includes, with versions.
CycloneDX
A standard format for writing an SBOM so tools can exchange it.
Open source licence compliance
Meeting the legal terms attached to the open-source code you use.
SBOM requirement
A customer or regulator asking you to supply an SBOM with your software.
Software composition analysis
Inventorying your open-source parts and flagging the ones with known flaws.
Do you know what you ship?
A component list is a start. We test the running application and report what we actually exploited. Ask us to run it on one of your applications.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.