Software Package Data Exchange

Open standard for software bill of materials

This article is about the standard for describing software bills of materials. For the communications protocol, see SPDY.

Abbreviation| SPDX
Status| Published
First published| August 2011 (2011-08)
Latest version| 3.0
April 2024 (2024-04)
Organization| Linux Foundation
Committee| SPDX Project
Domain| Software bill of materials
License| CC-BY-3.0
Website| spdx.dev

System Package Data Exchange (SPDX, formerly Software Package Data Exchange) is an open standard capable of representing systems with digital components as bills of materials (BOMs).[1] First designed to describe software components, SPDX can describe the components of software systems, AI models, software builds, security data, and other data packages. SPDX allows the expression of components,  licenses, copyrights, security references and other metadata relating to systems.[2]

The original purpose of SPDX was to improve license compliance,[3] and it has since been expanded to facilitate additional use cases such as supply-chain transparency and security.[4] SPDX is authored by the community-driven SPDX Project involving key industry experts, organizations, and open-source enthusiasts under the auspices of the Linux Foundation.

The SPDX specification is recognized as the international open standard for security, license compliance, and other software supply chain artifacts as ISO/IEC 5962:2021. The current[when?] version of the standard is 3.0.[5]

## Structure

[edit]

### Version 2.x

[edit]

The SPDX 2.x standard defines an SBOM document, which contains SPDX metadata about software. The document itself can be expressed in multiple formats, including JSON, YAML, RDF/XML, tag–value, and spreadsheet. Each SPDX document describes one or more elements, which can be a software package, a specific file, or a snippet from a file. Each element is given a unique identifier, and metadata for an element can refer to other elements.[6]

### Version 3.0

[edit]

SPDX 3.0 allows users to communicate information at a much more granular level without having to package it as "envelope" data. A key design principle in SPDX 3.0 is that all elements may be expressed and referenced independent of any other element. This independence is required to support a variety of content exchange and analysis use cases and makes it easier to communicate single elements of interest. The relationship structure has also been updated to be both more expressive and easier to understand compared to older versions of the spec.

The SPDX 3.0 data model is based on the Resource Description Framework (RDF). Data may be serialized in a variety of formats for storage and transmission, including formats defined in RDF 1.1 such as JSON-LD, Turtle (Terse RDF Triple Language), N-Triples, and RDF/XML.

#### SPDX 3.0 Profiles

[edit]

The 3.0 specification introduced profiles to support the expansion of use cases beyond software, without increasing overall complexity. Profiles allow users to define data for the use cases they need, while also increasing the amount of information that can be gathered directly from the SPDX data. There are eight profiles defined by SPDX 3.0:

* Core: foundational concepts common to all profiles
* Software: concepts related to software artifacts
* Security: security-related metadata specific to a piece of software
* Build: information required to describe an instance of a software build
* AI: concepts and data elements related to an AI system and model
* Dataset: concepts related to a dataset, including preparation process, characteristics, and access methods
* Licensing: license information necessary for compliance with typical licensing use cases
* Lite: subset of the SPDX specification aimed at balancing SPDX standard and actual workflows in some industries

## Version history

[edit]

Specification versions  Version number | Publication date | Notes | References

|
|
|

3.0  | April 2024  | Introduced a comprehensive set of updates encompassing the model, specification, and license list, with the new addition of SPDX profiles to handle modern system use cases like security and AI.  | [7]
2.3 | November 2022 | Added new fields to improve the ability to capture security related information and interoperability with other SBOM formats. | [8]
2.2.2 | April 2022 | Functionally equivalent to SPDX 2.2.1 but with spelling, grammar and other editorial improvements. | [9]
2.2.1 | October 2020 | Functionally equivalent to SPDX 2.2 but with typesetting for publication as an ISO standard. | [10]
2.2 | May 2020 | Added 'SPDX-lite' profile for minimal software bill of materials and improved support for external references. | [11]
2.1 | November 2016 | Added support for describing 'snippets' of code and the ability to reference non-SPDX data (such as CVEs). | [12][13]
2.0 | May 2015 | Added the ability to describe multiple packages and the relationships between different packages and files. | [14]
1.2 | October 2013 | Improved interaction with the SPDX License List, and added new fields for documenting extra information about software projects. | [15]
1.1 | August 2012 | Fixed a flaw in the SPDX Package Verification Code (a cryptographic hash function) and added support for free-form comments. | [16]
1.0 | August 2011 | The first release of the SPDX specification; handles packages. | [3]

The first version of the SPDX specification was intended to make compliance with software licenses easier,[3] but subsequent versions of the specification added capabilities intended for other use-cases, such as being able to contain references to known software vulnerabilities.[13] Recent versions of SPDX fulfill the NTIA's 'Minimum Elements For a Software Bill of Materials'.[17]

SPDX 2.2.1 was submitted to the International Organization for Standardization (ISO) in October, 2020, and was published as ISO/IEC 5962:2021 Information technology — SPDX® Specification V2.2.1 in August, 2021.[10][18]

## SPDX-License-Identifier

[edit]

### Syntax

[edit]

Each license is identified by a full name, such as "Mozilla Public License 2.0" and a short identifier, here "MPL-2.0". Licenses can be combined by operators `AND` and `OR`, and grouping `(`, `)`.

For example, `(Apache-2.0 OR MIT)` means that one can choose between `Apache-2.0` (Apache License) or `MIT` (MIT license). On the other hand, `(Apache-2.0 AND MIT)` means that both licenses apply.

There is also a "+" operator which, when applied to a license, means that future versions of the license apply as well. For example, `Apache-1.1+` means that `Apache-1.1` and `Apache-2.0` may apply (and future versions if any).

SPDX describes the exact terms under which a piece of software is licensed. It does not attempt to categorize licenses by type, for instance by describing licenses with similar terms to the BSD License as "BSD-like".[19]

In 2020, the European Commission published its Joinup Licensing Assistant,[20] which makes possible the selection and comparison of more than 50 licenses, with access to their SPDX identifier and full text.

### Deprecated license identifiers

[edit]

The GNU family of licenses (e.g., GNU General Public License version 2) have the choice of choosing a later version of the license built in. Sometimes, it was not clear whether the SPDX expression `GPL-2.0` meant "exactly GPL version 2.0" or "GPL version 2.0 or any later version".[21] Thus, since version 3.0 of the SPDX License List, the GNU family of licenses got new names.[22] `GPL-2.0-only` means "exactly version 2.0" and `GPL-2.0-or-later` means "version 2.0 or any later version".

## Adoption

[edit]

### For licensing

[edit]

The SPDX license identifier can be added to the top of source code files as a short string unambiguously declaring the license used. The `SPDX-License-Identifier` syntax, pioneered by Das U-Boot in 2013, became part of SPDX in version 2.1. In 2017, the FSFE launched REUSE, which provides tools to validate the comment and to efficiently extract copyright information.[23]

The SPDX license identifier is also used in a number of package managers such as npm,[24] Python,[25] and Rust cargo.[26] SPDX license expressions are used in RPM package metadata in Fedora Linux, replacing the earlier use of the Callaway system.[27] Debian uses a slightly different license specification.[28]

## See also

[edit]

* License proliferation
* Rights Expression Language

## References

[edit]

1. ^ Stewart, Kate (May 25, 2021). "SPDX: It's Already in Use for Global Software Bill of Materials (SBOM) and Supply Chain Security". Linux Foundation. Retrieved 2021-08-13.
2. ^ "Survey of Existing SBOM Formats and Standards" (PDF). National Telecommunications and Information Administration. October 25, 2019. p. 9. Retrieved 2021-08-13.
3. ^ a b c Bridgwater, Adrian (August 19, 2011). "Linux Foundation eases open source licensing woes". Open Source Insider. Computer Weekly. Archived from the original on Aug 20, 2021. Retrieved 2021-08-13.
4. ^ Rushgrove, Gareth (June 16, 2021). "Advancing SBOM standards: Snyk and SPDX". Snyk. Retrieved 2021-08-14.
5. ^ "Specifications - Current version". SPDX. Retrieved 2022-11-22.
6. ^ Winslow, Steve (2023-04-06). "SPDX and NTIA Minimum Elements for SBOM HOWTO". spdx.github.io.
7. ^ goneall (October 9, 2023). "Understanding SPDX Profiles". SPDX. Retrieved 2024-05-19.
8. ^ goneall (Nov 2, 2022). "Release v2.3". spdx/spdx-spec. GitHub. Retrieved 2022-11-22.
9. ^ kestewart (Apr 27, 2022). "Release v2.2.2". spdx/spdx-spec. GitHub. Retrieved 2022-06-11.
10. ^ a b "ISO/IEC 5962:2021 Information technology — SPDX® Specification V2.2.1". ISO. Aug 2021. Retrieved 2021-12-01.
11. ^ Stewart, Kate (May 7, 2020). "SPDX 2.2 Specification Released". Linux Foundation. Retrieved 2021-12-01.
12. ^ "General Meeting/Minutes/2016-11-03". SPDX Wiki. November 3, 2016. Retrieved 2021-12-01.
13. ^ a b "The Linux Foundation's Open Compliance Initiative Releases New SPDX Specification". Linux Foundation. October 4, 2016. Retrieved 2021-12-01.
14. ^ "What's new in SPDX 2.0". LWN.net. May 20, 2015. Retrieved 2021-12-01.
15. ^ "The Linux Foundation's SPDX Workgroup Releases New Version of Software Package Data Exchange Standard". Linux Foundation. October 22, 2013. Retrieved 2021-12-01.
16. ^ "The Linux Foundation's SPDX Workgroup Releases New Version of Software Package Data Exchange Standard". Linux Foundation. August 30, 2012. Retrieved 2021-12-01.
17. ^ "The Minimum Elements For a Software Bill of Materials (SBOM)" (PDF). National Telecommunications and Information Administration. Retrieved 2021-12-01.
18. ^ Bernard, Allen (September 9, 2021). "SPDX becomes internationally recognized standard". TechRepublic. Retrieved 2021-12-01.
19. ^ Odence, Phil (2010-06-23). "The Software Package Data Exchange (SPDX) Format". Dr Dobb's. Retrieved 2012-08-31.
20. ^ "Joinup Licensing Assistant". Retrieved 31 March 2020.
21. ^ Richard Stallman. "For Clarity's Sake, Please Don't Say "Licensed under GNU GPL 2"!". GNU. Retrieved 2018-05-24.
22. ^ Jilayne Lovejoy (5 January 2018). "License List 3.0 Released!". spdx.dev. Archived from the original on 2018-01-05. Retrieved 2021-09-02.
23. ^ "Solving License Compliance at the Source: Adding SPDX License IDs - Linux Foundation". www.linuxfoundation.org.
24. ^ "package.json | npm Docs". docs.npmjs.com.
25. ^ "PEP 639 – Improving License Clarity with Better Package Metadata". peps.python.org.
26. ^ "The Manifest Format - The Cargo Book". doc.rust-lang.org.
27. ^ "License: field in Spec File". Fedora Legal Documentation. Retrieved 30 July 2023.
28. ^ "Machine-readable debian/copyright file". www.debian.org.

## External links

[edit]

* Official website
* SPDX on GitHub
* Nathan Willis: A SPDX case study LWN.net

* v
* t
* e

Free and open-source software

General|

* Alternative terms for free software
* Comparison of open-source and closed-source software
* Comparison of source-code-hosting facilities
* Free software
* Free software project directories
* Gratis versus libre
* Long-term support
* Open-source software
* Open-source software development
* Outline
* Timeline

Software
packages|

* Audio
* Bioinformatics
* Codecs
* Configuration management
* Drivers
* Graphics
* Wireless
* Health
* Mathematics
* Office suites
* Operating systems
* Routing
* Television
* Video games
* Web applications
* E-commerce
* Android apps
* iOS apps
* Commercial
* Formerly proprietary
* Formerly open-source

Community|

* Free software movement
* History
* Open-source-software movement
* Events
* Advocacy

Organisations|

* Free Software Movement of India
* Free Software Foundation

Licenses|

* AFL
* Apache
* APSL
* Artistic
* Beerware
* BSD
* Creative Commons
* CDDL
* EPL
* Free Software Foundation
* GNU GPL
* GNU AGPL
* GNU LGPL
* ISC
* MIT
* MPL
* Python
* Python Software Foundation License
* Shared Source Initiative
* Sleepycat
* Unlicense
* WTFPL
* zlib

| Types and
standards|

* Comparison of licenses
* Contributor License Agreement
* Copyleft
* Debian Free Software Guidelines
* Definition of Free Cultural Works
* Free license
* The Free Software Definition
* The Open Source Definition
* Open-source license
* Permissive software license
* Public domain

|

Challenges|

* Digital rights management
* License proliferation
* Mozilla software rebranding
* Proprietary device drivers
* Proprietary firmware
* Proprietary software
* SCO/Linux controversies
* Software patents
* Software security
* Tivoization
* Trusted Computing

Related
topics|

* Forking
* GNU Manifesto
* Microsoft Open Specification Promise
* Open-core model
* Open-source hardware
* Shared Source Initiative
* Source-available software
* The Cathedral and the Bazaar
* Revolution OS

* Portal
* Category

* v
* t
* e

Linux

Linux kernel|

* History
* Linus's law
* Linux-libre
* Booting process
* Kernel oops
* Tux
* more…

Controversies|

* Criticism of Linux
* Criticism of desktop Linux
* GNU/Linux naming controversy
* Tanenbaum–Torvalds debate
* SCO and Linux

Distributions|

* General comparison
* Distributions list
* Netbook-specific comparison
* Distributions that run from RAM
* Lightweight
* Security-focused operating system
* Package manager
* Package format
* List of software package managers

Organizations|

* LinuxChix
* Linux Counter
* Linux Documentation Project
* Linux Foundation
* Linux Mark Institute
* Linux User Group (LUG)

Adoption|

* Adopters
* Desktop
* Embedded
* Gaming
* Mobile
* Range of use
* Linux malware

Media|

* DistroWatch
* Free Software Magazine
* Full Circle
* Linux.com
* Linux Format
* Linux Gazette
* Linux Journal
* Linux Magazine
* LinuxUser
* Ubuntu User
* Linux Outlaws
* Linux Voice
* LugRadio
* LWN.net
* Phoronix
* Revolution OS
* The Code

Professional related certifications|

* CompTIA Linux+
* Linux Foundation
* Red Hat

* Linux portal
* Free and open-source software portal
* Category

* v
* t
* e

Linux Foundation

Sub-foundations|

* Cloud Native Computing Foundation
* Cloud Foundry
* OpenJS Foundation
* LF Energy
* Presto Foundation
* Open Source Security Foundation
* Overture Maps Foundation

Initiatives|

* Open Container Initiative
* Core Infrastructure Initiative
* OpenAPI Initiative

Projects|

* Open Mainframe Project
* SONiC
* Hyperledger

*[v]: View this template
*[t]: Discuss this template
*[e]: Edit this template