SPDX
The Software Package Data Exchange (SPDX) project is an open standard and tooling ecosystem for communicating software bills of materials (SBOMs), license information, and related metadata across the software supply chain.
- Open standard specification for software Bill of Materials (BOM) (SBOMs) and related metadata (software supply chain management)
- Machine-readable formats and schemas for representing packages, components, licenses, and vulnerabilities (software compliance and governance)
- Reference tooling, libraries, and utilities to create, consume, and validate SPDX documents (developer tooling)
- Community-driven governance under the Linux Foundation with working groups and reference implementations (open standards collaboration)
- Guidance, documentation, and profiles to support regulatory, compliance, and procurement use cases (risk and compliance management)
More About SPDX
SPDX is an open standard hosted by the Linux Foundation that defines a common format for describing software bills of materials (SBOMs), license data, and associated metadata so that organizations can exchange this information across tools, suppliers, and enterprises in a consistent way. Enterprise architects, open source program offices, and security teams use SPDX artifacts to document the composition of applications, libraries, and containers, including component versions, origins, and licensing.
The core offering of SPDX is a specification (software supply chain management) that defines a data model and serialization formats for SBOMs and related documents. This specification covers entities such as software packages, files, snippets, relationships, and external references, as well as identifiers for licenses and security advisories. SPDX documents can be expressed in multiple technical formats, including tag-value text, Resource Description Framework (RDF), JSON, and YAML, which allows integration with a range of build systems, Continuous Integration and Continuous Deployment (CI/CD) pipelines, and asset management tools.
SPDX also maintains and publishes a license list (software compliance and governance) that provides standardized identifiers and metadata for commonly used open source licenses and license exceptions. This list is used by enterprises, legal teams, and tooling vendors to normalize license information, automate detection and reporting, and support compliance workflows. The alignment between Software Bill of Materials (SBOM) documents and the license list enables a structured approach to tracking license obligations at the component level.
To support adoption, the SPDX project provides reference tools and libraries (developer tooling) that can generate, parse, and validate SPDX documents. These utilities are often integrated into build pipelines and scanning tools so that SBOMs are produced automatically as part of software creation and distribution. The project also publishes profiles and usage guidance that Marketing Automation Platform (MAP) the specification to regulatory and policy requirements, such as government procurement or industry-specific security frameworks, making SPDX applicable in sectors like government, automotive, and enterprise IT.
Within an enterprise technology directory, SPDX aligns with categories such as software supply chain management, open source compliance, and security and risk governance. It is frequently considered alongside other SBOM-related standards and frameworks but is distinct in its focus on a structured, extensible data model that covers licensing, security, and provenance. Organizations use SPDX as a common language between development, legal, procurement, and security functions, and vendors use it to ensure interoperability of SBOM data across ecosystems.