Knowledge

Software Package Data Exchange

Source đź“ť

2412: 2424: 1950: 1940: 31: 2398: 198:
SPDX 3.0 allows users to communicate information at a much more granular level without having to package it as “envelope” data. A key design principle in SPDX 3.0 is that all elements may be expressed and referenced independent of any other element. This independence is required to support a variety
218:
to support the expansion of use cases beyond software, without increasing overall complexity. Profiles allow users to define data for the use cases they need, while also increasing the amount of information that can be gathered directly from the SPDX data. There are eight profiles defined by SPDX
189:
The SPDX 2.x standard defines an SBOM document, which contains SPDX metadata about software. The document itself can be expressed in multiple formats, including JSON, YAML, RDF/XML, tag–value, and spreadsheet. Each SPDX document describes one or more elements, which can be a software package, a
167:
The original purpose of SPDX was to improve license compliance, and it has since been expanded to facilitate additional use cases such as supply-chain transparency and security. SPDX is authored by the community-driven SPDX Project involving key industry experts, organizations, and open-source
199:
of content exchange and analysis use cases and makes it easier to communicate single elements of interest. The relationship structure has also been updated to be both more expressive and easier to understand compared to older versions of the spec.
156:(BOMs). First designed to describe software components, SPDX can describe the components of software systems, AI models, software builds, security data, and other data packages. SPDX allows the expression of components, 175:
The SPDX specification is recognized as the international open standard for security, license compliance, and other software supply chain artifacts as ISO/IEC 5962:2021. The current version of the standard is 3.0.
547:
In 2020, the European Commission published its Joinup Licensing Assistant, which makes possible the selection and comparison of more than 50 licenses, with access to their SPDX identifier and full text.
206:(RDF). Data may be serialized in a variety of formats for storage and transmission, including formats defined in RDF 1.1 such as JSON-LD, Turtle (Terse RDF Triple Language), N-Triples, and RDF/XML. 306:
Introduced a comprehensive set of updates encompassing the model, specification, and license list, with the new addition of SPDX profiles to handle modern system use cases like security and AI.
540:
SPDX describes the exact terms under which a piece of software is licensed. It does not attempt to categorize licenses by type, for instance by describing licenses with similar terms to the
996: 975: 1443: 1024: 670: 564:
meant "exactly GPL version 2.0" or "GPL version 2.0 or any later version". Thus, since version 3.0 of the SPDX License List, the GNU family of licenses got new names.
452: 642: 1522: 479:
Each license is identified by a full name, such as "Mozilla Public License 2.0" and a short identifier, here "MPL-2.0". Licenses can be combined by operators
929: 1741: 1363: 1580: 447:
easier, but subsequent versions of the specification added capabilities intended for other use-cases, such as being able to contain references to known
2107: 663: 1512: 1532: 1418: 459: 346: 2112: 1517: 1500: 1170: 190:
specific file, or a snippet from a file. Each element is given a unique identifier, and metadata for an element can refer to other elements.
697: 1470: 1368: 2137: 1646: 1480: 1453: 1433: 1149: 585:
The SPDX license identifier can be added to the top of source code files as a short string unambiguously declaring the license used. The
2462: 1458: 1408: 1378: 525:
There is also a "+" operator which, when applied to a license, means that future versions of the license apply as well. For example,
2358: 1555: 1094: 405:
Improved interaction with the SPDX License List, and added new fields for documenting extra information about software projects.
560:) have the choice of choosing a later version of the license built in. Sometimes, it was not clear whether the SPDX expression 1224: 766: 1527: 1485: 1428: 319:
Added new fields to improve the ability to capture security related information and interoperability with other SBOM formats.
2416: 2371: 2122: 1943: 1891: 1821: 1505: 1070: 557: 376: 1465: 1358: 1045: 2593: 1846: 1698: 2485: 2381: 2097: 1761: 1671: 1666: 19:
This article is about the standard for describing software bills of materials. For the communications protocol, see
1490: 1398: 2510: 2117: 1986: 1756: 1588: 1495: 1017: 2536: 2455: 1335: 597:
launched REUSE, which provides tools to validate the comment and to efficiently extract copyright information.
203: 362:
Added 'SPDX-lite' profile for minimal software bill of materials and improved support for external references.
2376: 2074: 1851: 1746: 1570: 1560: 1344: 612:, replacing the earlier use of the Callaway system. Debian uses a slightly different license specification. 2069: 1917: 1771: 1565: 392:
Added the ability to describe multiple packages and the relationships between different packages and files.
271:: subset of the SPDX specification aimed at balancing SPDX standard and actual workflows in some industries 2334: 2588: 2165: 2102: 1879: 1786: 1621: 419: 880: 2203: 2064: 1776: 1661: 1438: 997:"The Linux Foundation's SPDX Workgroup Releases New Version of Software Package Data Exchange Standard" 976:"The Linux Foundation's SPDX Workgroup Releases New Version of Software Package Data Exchange Standard" 107: 2531: 2505: 2448: 2208: 1911: 1826: 1811: 1267: 1188: 448: 375:
Added support for describing 'snippets' of code and the ability to reference non-SPDX data (such as
2562: 2515: 2218: 2026: 1906: 1703: 1656: 1641: 1593: 1403: 259:: concepts related to a dataset, including preparation process, characteristics, and access methods 643:"SPDX: It's Already in Use for Global Software Bill of Materials (SBOM) and Supply Chain Security" 332:
Functionally equivalent to SPDX 2.2.1 but with spelling, grammar and other editorial improvements.
901: 2603: 2598: 2557: 2257: 2250: 2198: 2079: 1953: 1841: 1688: 1651: 1550: 1116: 2042: 1816: 1611: 1603: 1542: 1475: 621: 153: 1242: 2346: 2175: 1901: 1836: 1831: 1393: 722: 8: 1979: 1781: 1383: 605: 829: 2541: 2223: 2089: 2059: 1328: 1171:"Solving License Compliance at the Source: Adding SPDX License IDs - Linux Foundation" 805: 2495: 2031: 1939: 1861: 1708: 1388: 2471: 2180: 2170: 2011: 1626: 930:"The Linux Foundation's Open Compliance Initiative Releases New SPDX Specification" 742: 444: 169: 157: 89: 2366: 2127: 1896: 701: 600:
The SPDX license identifier is also used in a number of package managers such as
443:
The first version of the SPDX specification was intended to make compliance with
1313: 785: 2428: 2290: 2190: 2132: 2016: 1972: 1693: 1616: 601: 507: 345:
Functionally equivalent to SPDX 2.2 but with typesetting for publication as an
265:: license information necessary for compliance with typical licensing use cases 245: 1141: 2582: 2490: 2340: 2312: 2283: 2276: 2228: 2160: 1924: 1885: 1791: 1448: 1373: 1321: 149: 2402: 2269: 2213: 2036: 2003: 1766: 1723: 1636: 1049: 609: 856: 2567: 2318: 2304: 2244: 2021: 1856: 1683: 1678: 541: 515: 857:"ISO/IEC 5962:2021 Information technology — SPDX® Specification V2.2.1" 590: 2500: 2297: 2263: 2155: 1713: 464:
ISO/IEC 5962:2021 Information technology — SPDX® Specification V2.2.1
1206: 2440: 2324: 1751: 1631: 1307: 950: 161: 1207:"PEP 639 – Improving License Clarity with Better Package Metadata" 1117:"For Clarity's Sake, Please Don't Say "Licensed under GNU GPL 2"!" 2329: 954: 30: 1301: 604:, Python, and Rust cargo. SPDX license expressions are used in 1018:"The Minimum Elements For a Software Bill of Materials (SBOM)" 435:
The first release of the SPDX specification; handles packages.
253:: concepts and data elements related to an AI system and model 1995: 1718: 594: 152:
capable of representing systems with digital components as
20: 1297: 1025:
National Telecommunications and Information Administration
671:
National Telecommunications and Information Administration
593:
in 2013, became part of SPDX in version 2.1. In 2017, the
2397: 238:
security-related metadata specific to a piece of software
1964: 455:'Minimum Elements For a Software Bill of Materials'. 418:
Fixed a flaw in the SPDX Package Verification Code (a
1037: 1010: 1364:
Comparison of open-source and closed-source software
1290: 698:"Linux Foundation eases open source licensing woes" 126: 1732: 1071:"The Software Package Data Exchange (SPDX) Format" 1046:"SPDX becomes internationally recognized standard" 244:information required to describe an instance of a 1343: 691: 689: 687: 551: 2580: 822: 1139: 767:"SPDX and NTIA Minimum Elements for SBOM HOWTO" 664:"Survey of Existing SBOM Formats and Standards" 924: 922: 798: 684: 460:International Organization for Standardization 2456: 1980: 1329: 462:(ISO) in October, 2020, and was published as 1369:Comparison of source-code-hosting facilities 1114: 943: 894: 634: 226:foundational concepts common to all profiles 160:, copyrights, security references and other 16:Open standard for software bill of materials 989: 968: 919: 873: 851: 849: 422:) and added support for free-form comments. 2463: 2449: 1987: 1973: 1336: 1322: 695: 656: 572:means "version 2.0 or any later version". 469: 29: 723:"Advancing SBOM standards: Snyk and SPDX" 720: 2417:Free and open-source software portal 1268:"Machine-readable debian/copyright file" 846: 714: 537:may apply (and future versions if any). 232:: concepts related to software artifacts 202:The SPDX 3.0 data model is based on the 1062: 1043: 640: 2581: 1225:"The Manifest Format - The Cargo Book" 1068: 759: 696:Bridgwater, Adrian (August 19, 2011). 451:. Recent versions of SPDX fulfill the 168:enthusiasts under the auspices of the 2444: 1968: 1317: 2470: 1892:Microsoft Open Specification Promise 1044:Bernard, Allen (September 9, 2021). 978:. Linux Foundation. October 22, 2013 902:"General Meeting/Minutes/2016-11-03" 786:"Understanding SPDX Profiles – SPDX" 558:GNU General Public License version 2 209: 2359:Professional related certifications 1359:Alternative terms for free software 999:. Linux Foundation. August 30, 2012 932:. Linux Foundation. October 4, 2016 783: 721:Rushgrove, Gareth (June 16, 2021). 13: 1699:Python Software Foundation License 1140:Jilayne Lovejoy (5 January 2018). 556:The GNU family of licenses (e.g., 502:means that one can choose between 275: 14: 2615: 2486:Cloud Native Computing Foundation 2138:List of software package managers 2123:Security-focused operating system 1762:Definition of Free Cultural Works 1379:Free software project directories 1282: 881:"SPDX 2.2 Specification Released" 214:The 3.0 specification introduced 2423: 2422: 2410: 2396: 1949: 1948: 1938: 1399:Open-source software development 580: 568:means "exactly version 2.0" and 522:means that both licenses apply. 458:SPDX 2.2.1 was submitted to the 2511:Open Source Security Foundation 2113:Distributions that run from RAM 1757:Debian Free Software Guidelines 1589:Free Software Movement of India 1260: 1235: 1217: 1199: 1181: 1163: 1152:from the original on 2018-01-05 1133: 1108: 1087: 883:. Linux Foundation. May 7, 2020 586: 2537:Core Infrastructure Initiative 777: 735: 641:Stewart, Kate (May 25, 2021). 552:Deprecated license identifiers 204:Resource Description Framework 193: 184: 146:Software Package Data Exchange 1: 1747:Contributor License Agreement 1561:Open-source-software movement 1345:Free and open-source software 1243:"License: field in Spec File" 673:. October 25, 2019. p. 9 627: 2070:GNU/Linux naming controversy 1918:The Cathedral and the Bazaar 1772:The Free Software Definition 1142:"License List 3.0 Released!" 1095:"Joinup Licensing Assistant" 179: 138:System Package Data Exchange 7: 2166:Linux Documentation Project 2108:Netbook-specific comparison 1822:Mozilla software rebranding 1787:Permissive software license 1069:Odence, Phil (2010-06-23). 615: 575: 420:cryptographic hash function 10: 2622: 2065:Criticism of desktop Linux 1827:Proprietary device drivers 1777:The Open Source Definition 1247:Fedora Legal Documentation 108:Software bill of materials 18: 2594:Linux Foundation projects 2550: 2532:Open Container Initiative 2524: 2478: 2390: 2357: 2237: 2189: 2148: 2088: 2075:Tanenbaum–Torvalds debate 2052: 2002: 1994: 1934: 1912:Source-available software 1870: 1812:Digital rights management 1804: 1602: 1579: 1541: 1417: 1351: 1189:"package.json | npm Docs" 474: 121: 113: 103: 95: 85: 68: 53: 45: 37: 28: 2516:Overture Maps Foundation 1907:Shared Source Initiative 1704:Shared Source Initiative 1657:Free Software Foundation 1594:Free Software Foundation 1444:Configuration management 951:"What's new in SPDX 2.0" 449:software vulnerabilities 1842:SCO/Linux controversies 1175:www.linuxfoundation.org 587:SPDX-License-Identifier 470:SPDX-License-identifier 281:Specification versions 2558:Open Mainframe Project 2251:Free Software Magazine 2181:Linux User Group (LUG) 1742:Comparison of licenses 1551:Free software movement 743:"SPDX Current version" 518:). On the other hand, 1817:License proliferation 622:License proliferation 589:syntax, pioneered by 164:relating to systems. 2176:Linux Mark Institute 1902:Open-source hardware 1837:Proprietary software 1832:Proprietary firmware 1533:Formerly open-source 1528:Formerly proprietary 1394:Open-source software 608:package metadata in 520:(Apache-2.0 AND MIT) 1782:Open-source license 1384:Gratis versus libre 500:(Apache-2.0 OR MIT) 282: 2589:Computer standards 2542:OpenAPI Initiative 2103:Distributions list 2098:General comparison 2060:Criticism of Linux 1115:Richard Stallman. 908:. November 3, 2016 645:. Linux Foundation 280: 154:bills of materials 2576: 2575: 2506:Presto Foundation 2496:OpenJS Foundation 2438: 2437: 1962: 1961: 1862:Trusted Computing 1852:Software security 1800: 1799: 1481:Operating systems 1389:Long-term support 1308:A SPDX case study 1229:doc.rust-lang.org 466:in August, 2021. 445:software licenses 441: 440: 210:SPDX 3.0 Profiles 135: 134: 2611: 2472:Linux Foundation 2465: 2458: 2451: 2442: 2441: 2426: 2425: 2415: 2414: 2413: 2403:Linux portal 2401: 2400: 2372:Linux Foundation 2171:Linux Foundation 1989: 1982: 1975: 1966: 1965: 1952: 1951: 1942: 1847:Software patents 1730: 1729: 1642:Creative Commons 1501:Web applications 1338: 1331: 1324: 1315: 1314: 1294: 1293: 1291:Official website 1276: 1275: 1264: 1258: 1257: 1255: 1253: 1239: 1233: 1232: 1221: 1215: 1214: 1203: 1197: 1196: 1185: 1179: 1178: 1167: 1161: 1160: 1158: 1157: 1137: 1131: 1130: 1128: 1127: 1112: 1106: 1105: 1103: 1101: 1091: 1085: 1084: 1082: 1081: 1066: 1060: 1059: 1057: 1056: 1041: 1035: 1034: 1032: 1031: 1022: 1014: 1008: 1007: 1005: 1004: 993: 987: 986: 984: 983: 972: 966: 965: 963: 962: 947: 941: 940: 938: 937: 926: 917: 916: 914: 913: 898: 892: 891: 889: 888: 877: 871: 870: 868: 867: 853: 844: 843: 841: 840: 830:"Release v2.2.2" 826: 820: 819: 817: 816: 802: 796: 795: 793: 792: 781: 775: 774: 763: 757: 756: 754: 753: 739: 733: 732: 730: 729: 718: 712: 711: 709: 708: 693: 682: 681: 679: 678: 668: 660: 654: 653: 651: 650: 638: 588: 571: 570:GPL-2.0-or-later 567: 563: 536: 532: 528: 521: 513: 505: 501: 494: 490: 486: 482: 289:Publication date 283: 279: 170:Linux Foundation 131: 128: 90:Linux Foundation 81: 79: 64: 62: 57:August 2011 33: 26: 25: 2621: 2620: 2614: 2613: 2612: 2610: 2609: 2608: 2579: 2578: 2577: 2572: 2546: 2520: 2479:Sub-foundations 2474: 2469: 2439: 2434: 2411: 2409: 2395: 2386: 2353: 2233: 2185: 2144: 2128:Package manager 2084: 2048: 2027:Booting process 1998: 1993: 1963: 1958: 1930: 1897:Open-core model 1872: 1866: 1796: 1734: 1728: 1598: 1575: 1537: 1420: 1413: 1347: 1342: 1306:Nathan Willis: 1289: 1288: 1285: 1280: 1279: 1266: 1265: 1261: 1251: 1249: 1241: 1240: 1236: 1223: 1222: 1218: 1211:peps.python.org 1205: 1204: 1200: 1187: 1186: 1182: 1169: 1168: 1164: 1155: 1153: 1138: 1134: 1125: 1123: 1113: 1109: 1099: 1097: 1093: 1092: 1088: 1079: 1077: 1067: 1063: 1054: 1052: 1042: 1038: 1029: 1027: 1020: 1016: 1015: 1011: 1002: 1000: 995: 994: 990: 981: 979: 974: 973: 969: 960: 958: 949: 948: 944: 935: 933: 928: 927: 920: 911: 909: 900: 899: 895: 886: 884: 879: 878: 874: 865: 863: 855: 854: 847: 838: 836: 834:github.com/spdx 828: 827: 823: 814: 812: 810:github.com/spdx 804: 803: 799: 790: 788: 782: 778: 765: 764: 760: 751: 749: 741: 740: 736: 727: 725: 719: 715: 706: 704: 702:Computer Weekly 694: 685: 676: 674: 666: 662: 661: 657: 648: 646: 639: 635: 630: 618: 583: 578: 569: 565: 561: 554: 544:as "BSD-like". 534: 530: 526: 519: 511: 503: 499: 492: 488: 487:, and grouping 484: 480: 477: 472: 278: 276:Version history 212: 196: 187: 182: 125: 77: 75: 74:April 2024 73: 60: 58: 54:First published 24: 17: 12: 11: 5: 2619: 2618: 2607: 2606: 2601: 2596: 2591: 2574: 2573: 2571: 2570: 2565: 2560: 2554: 2552: 2548: 2547: 2545: 2544: 2539: 2534: 2528: 2526: 2522: 2521: 2519: 2518: 2513: 2508: 2503: 2498: 2493: 2488: 2482: 2480: 2476: 2475: 2468: 2467: 2460: 2453: 2445: 2436: 2435: 2433: 2432: 2420: 2406: 2391: 2388: 2387: 2385: 2384: 2379: 2374: 2369: 2367:CompTIA Linux+ 2363: 2361: 2355: 2354: 2352: 2351: 2344: 2337: 2332: 2327: 2322: 2315: 2310: 2309: 2308: 2294: 2291:Linux Magazine 2287: 2280: 2273: 2266: 2261: 2254: 2247: 2241: 2239: 2235: 2234: 2232: 2231: 2226: 2221: 2216: 2211: 2206: 2201: 2195: 2193: 2187: 2186: 2184: 2183: 2178: 2173: 2168: 2163: 2158: 2152: 2150: 2146: 2145: 2143: 2142: 2141: 2140: 2135: 2133:Package format 2125: 2120: 2115: 2110: 2105: 2100: 2094: 2092: 2086: 2085: 2083: 2082: 2077: 2072: 2067: 2062: 2056: 2054: 2050: 2049: 2047: 2046: 2039: 2034: 2029: 2024: 2019: 2014: 2008: 2006: 2000: 1999: 1992: 1991: 1984: 1977: 1969: 1960: 1959: 1957: 1956: 1946: 1935: 1932: 1931: 1929: 1928: 1921: 1914: 1909: 1904: 1899: 1894: 1889: 1882: 1876: 1874: 1868: 1867: 1865: 1864: 1859: 1854: 1849: 1844: 1839: 1834: 1829: 1824: 1819: 1814: 1808: 1806: 1802: 1801: 1798: 1797: 1795: 1794: 1789: 1784: 1779: 1774: 1769: 1764: 1759: 1754: 1749: 1744: 1738: 1736: 1727: 1726: 1721: 1716: 1711: 1706: 1701: 1696: 1691: 1686: 1681: 1676: 1675: 1674: 1669: 1664: 1654: 1649: 1644: 1639: 1634: 1629: 1624: 1619: 1614: 1608: 1606: 1600: 1599: 1597: 1596: 1591: 1585: 1583: 1577: 1576: 1574: 1573: 1568: 1563: 1558: 1553: 1547: 1545: 1539: 1538: 1536: 1535: 1530: 1525: 1520: 1515: 1510: 1509: 1508: 1498: 1493: 1488: 1483: 1478: 1473: 1468: 1463: 1462: 1461: 1456: 1446: 1441: 1436: 1434:Bioinformatics 1431: 1425: 1423: 1415: 1414: 1412: 1411: 1406: 1401: 1396: 1391: 1386: 1381: 1376: 1371: 1366: 1361: 1355: 1353: 1349: 1348: 1341: 1340: 1333: 1326: 1318: 1312: 1311: 1304: 1295: 1284: 1283:External links 1281: 1278: 1277: 1272:www.debian.org 1259: 1234: 1216: 1198: 1193:docs.npmjs.com 1180: 1162: 1132: 1107: 1086: 1061: 1036: 1009: 988: 967: 957:. May 20, 2015 942: 918: 893: 872: 845: 821: 806:"Release v2.3" 797: 776: 771:spdx.github.io 758: 734: 713: 683: 655: 632: 631: 629: 626: 625: 624: 617: 614: 582: 579: 577: 574: 553: 550: 508:Apache License 476: 473: 471: 468: 439: 438: 436: 433: 430: 426: 425: 423: 416: 413: 409: 408: 406: 403: 400: 396: 395: 393: 390: 387: 383: 382: 380: 373: 370: 366: 365: 363: 360: 357: 353: 352: 350: 343: 340: 336: 335: 333: 330: 327: 323: 322: 320: 317: 314: 310: 309: 307: 304: 301: 297: 296: 293: 290: 287: 286:Version number 277: 274: 273: 272: 266: 260: 254: 248: 246:software build 239: 233: 227: 211: 208: 195: 192: 186: 183: 181: 178: 133: 132: 123: 119: 118: 115: 111: 110: 105: 101: 100: 97: 93: 92: 87: 83: 82: 70: 69:Latest version 66: 65: 55: 51: 50: 47: 43: 42: 39: 35: 34: 15: 9: 6: 4: 3: 2: 2617: 2616: 2605: 2604:IEC standards 2602: 2600: 2599:ISO standards 2597: 2595: 2592: 2590: 2587: 2586: 2584: 2569: 2566: 2564: 2561: 2559: 2556: 2555: 2553: 2549: 2543: 2540: 2538: 2535: 2533: 2530: 2529: 2527: 2523: 2517: 2514: 2512: 2509: 2507: 2504: 2502: 2499: 2497: 2494: 2492: 2491:Cloud Foundry 2489: 2487: 2484: 2483: 2481: 2477: 2473: 2466: 2461: 2459: 2454: 2452: 2447: 2446: 2443: 2431: 2430: 2421: 2419: 2418: 2407: 2405: 2404: 2399: 2393: 2392: 2389: 2383: 2380: 2378: 2375: 2373: 2370: 2368: 2365: 2364: 2362: 2360: 2356: 2350: 2349: 2345: 2343: 2342: 2341:Revolution OS 2338: 2336: 2333: 2331: 2328: 2326: 2323: 2321: 2320: 2316: 2314: 2313:Linux Outlaws 2311: 2307: 2306: 2302: 2301: 2300: 2299: 2295: 2293: 2292: 2288: 2286: 2285: 2284:Linux Journal 2281: 2279: 2278: 2277:Linux Gazette 2274: 2272: 2271: 2267: 2265: 2262: 2260: 2259: 2255: 2253: 2252: 2248: 2246: 2243: 2242: 2240: 2236: 2230: 2229:Linux malware 2227: 2225: 2222: 2220: 2217: 2215: 2212: 2210: 2207: 2205: 2202: 2200: 2197: 2196: 2194: 2192: 2188: 2182: 2179: 2177: 2174: 2172: 2169: 2167: 2164: 2162: 2161:Linux Counter 2159: 2157: 2154: 2153: 2151: 2149:Organizations 2147: 2139: 2136: 2134: 2131: 2130: 2129: 2126: 2124: 2121: 2119: 2116: 2114: 2111: 2109: 2106: 2104: 2101: 2099: 2096: 2095: 2093: 2091: 2090:Distributions 2087: 2081: 2080:SCO and Linux 2078: 2076: 2073: 2071: 2068: 2066: 2063: 2061: 2058: 2057: 2055: 2053:Controversies 2051: 2045: 2044: 2040: 2038: 2035: 2033: 2030: 2028: 2025: 2023: 2020: 2018: 2015: 2013: 2010: 2009: 2007: 2005: 2001: 1997: 1990: 1985: 1983: 1978: 1976: 1971: 1970: 1967: 1955: 1947: 1945: 1941: 1937: 1936: 1933: 1927: 1926: 1925:Revolution OS 1922: 1920: 1919: 1915: 1913: 1910: 1908: 1905: 1903: 1900: 1898: 1895: 1893: 1890: 1888: 1887: 1886:GNU Manifesto 1883: 1881: 1878: 1877: 1875: 1869: 1863: 1860: 1858: 1855: 1853: 1850: 1848: 1845: 1843: 1840: 1838: 1835: 1833: 1830: 1828: 1825: 1823: 1820: 1818: 1815: 1813: 1810: 1809: 1807: 1803: 1793: 1792:Public domain 1790: 1788: 1785: 1783: 1780: 1778: 1775: 1773: 1770: 1768: 1765: 1763: 1760: 1758: 1755: 1753: 1750: 1748: 1745: 1743: 1740: 1739: 1737: 1731: 1725: 1722: 1720: 1717: 1715: 1712: 1710: 1707: 1705: 1702: 1700: 1697: 1695: 1692: 1690: 1687: 1685: 1682: 1680: 1677: 1673: 1670: 1668: 1665: 1663: 1660: 1659: 1658: 1655: 1653: 1650: 1648: 1645: 1643: 1640: 1638: 1635: 1633: 1630: 1628: 1625: 1623: 1620: 1618: 1615: 1613: 1610: 1609: 1607: 1605: 1601: 1595: 1592: 1590: 1587: 1586: 1584: 1582: 1581:Organisations 1578: 1572: 1569: 1567: 1564: 1562: 1559: 1557: 1554: 1552: 1549: 1548: 1546: 1544: 1540: 1534: 1531: 1529: 1526: 1524: 1521: 1519: 1516: 1514: 1511: 1507: 1504: 1503: 1502: 1499: 1497: 1494: 1492: 1489: 1487: 1484: 1482: 1479: 1477: 1476:Office suites 1474: 1472: 1469: 1467: 1464: 1460: 1457: 1455: 1452: 1451: 1450: 1447: 1445: 1442: 1440: 1437: 1435: 1432: 1430: 1427: 1426: 1424: 1422: 1416: 1410: 1407: 1405: 1402: 1400: 1397: 1395: 1392: 1390: 1387: 1385: 1382: 1380: 1377: 1375: 1374:Free software 1372: 1370: 1367: 1365: 1362: 1360: 1357: 1356: 1354: 1350: 1346: 1339: 1334: 1332: 1327: 1325: 1320: 1319: 1316: 1309: 1305: 1303: 1299: 1296: 1292: 1287: 1286: 1273: 1269: 1263: 1248: 1244: 1238: 1230: 1226: 1220: 1212: 1208: 1202: 1194: 1190: 1184: 1176: 1172: 1166: 1151: 1147: 1143: 1136: 1122: 1118: 1111: 1096: 1090: 1076: 1072: 1065: 1051: 1047: 1040: 1026: 1019: 1013: 998: 992: 977: 971: 956: 952: 946: 931: 925: 923: 907: 906:wiki.spdx.org 903: 897: 882: 876: 862: 858: 852: 850: 835: 831: 825: 811: 807: 801: 787: 780: 772: 768: 762: 748: 744: 738: 724: 717: 703: 699: 692: 690: 688: 672: 665: 659: 644: 637: 633: 623: 620: 619: 613: 611: 607: 603: 598: 596: 592: 581:For licensing 573: 559: 549: 545: 543: 538: 523: 517: 509: 498:For example, 496: 467: 465: 461: 456: 454: 450: 446: 437: 434: 431: 428: 427: 424: 421: 417: 414: 411: 410: 407: 404: 401: 398: 397: 394: 391: 388: 385: 384: 381: 378: 374: 372:November 2016 371: 368: 367: 364: 361: 358: 355: 354: 351: 348: 344: 341: 338: 337: 334: 331: 328: 325: 324: 321: 318: 316:November 2022 315: 312: 311: 308: 305: 302: 299: 298: 294: 291: 288: 285: 284: 270: 267: 264: 261: 258: 255: 252: 249: 247: 243: 240: 237: 234: 231: 228: 225: 222: 221: 220: 217: 207: 205: 200: 191: 177: 173: 171: 165: 163: 159: 155: 151: 150:open standard 147: 143: 139: 130: 124: 120: 116: 112: 109: 106: 102: 98: 94: 91: 88: 84: 71: 67: 56: 52: 48: 44: 40: 36: 32: 27: 22: 2427: 2408: 2394: 2347: 2339: 2317: 2303: 2296: 2289: 2282: 2275: 2270:Linux Format 2268: 2256: 2249: 2224:Range of use 2041: 2004:Linux kernel 1923: 1916: 1884: 1767:Free license 1513:Android apps 1271: 1262: 1250:. Retrieved 1246: 1237: 1228: 1219: 1210: 1201: 1192: 1183: 1174: 1165: 1154:. Retrieved 1145: 1135: 1124:. Retrieved 1120: 1110: 1098:. Retrieved 1089: 1078:. Retrieved 1074: 1064: 1053:. Retrieved 1050:TechRepublic 1039: 1028:. Retrieved 1012: 1001:. Retrieved 991: 980:. Retrieved 970: 959:. Retrieved 945: 934:. Retrieved 910:. Retrieved 905: 896: 885:. Retrieved 875: 864:. Retrieved 860: 837:. Retrieved 833: 824: 813:. Retrieved 809: 800: 789:. Retrieved 779: 770: 761: 750:. Retrieved 746: 737: 726:. Retrieved 716: 705:. Retrieved 675:. Retrieved 658: 647:. Retrieved 636: 610:Fedora Linux 599: 584: 566:GPL-2.0-only 555: 546: 539: 524: 497: 478: 463: 457: 442: 402:October 2013 342:October 2020 268: 262: 256: 250: 241: 235: 229: 223: 215: 213: 201: 197: 188: 174: 166: 145: 141: 137: 136: 99:SPDX Project 86:Organization 38:Abbreviation 2568:Hyperledger 2525:Initiatives 2319:Linux Voice 2305:Ubuntu User 2258:Full Circle 2245:DistroWatch 2118:Lightweight 2032:Kernel oops 2022:Linux-libre 2017:Linus's law 1857:Tivoization 1496:Video games 1471:Mathematics 542:BSD License 529:means that 527:Apache-1.1+ 516:MIT license 432:August 2011 415:August 2012 303:April 2024 295:References 194:Version 3.0 185:Version 2.x 144:, formerly 2583:Categories 1805:Challenges 1523:Commercial 1506:E-commerce 1491:Television 1156:2021-09-02 1126:2018-05-24 1080:2012-08-31 1055:2021-12-01 1030:2021-12-01 1003:2021-12-01 982:2021-12-01 961:2021-12-01 936:2021-12-01 912:2021-12-01 887:2021-12-01 866:2021-12-01 839:2022-06-11 815:2022-11-22 791:2024-05-19 752:2022-11-22 728:2021-08-14 707:2021-08-13 677:2021-08-13 649:2021-08-13 628:References 591:Das U-Boot 535:Apache-2.0 531:Apache-1.1 504:Apache-2.0 329:April 2022 2501:LF Energy 2298:LinuxUser 2264:Linux.com 2156:LinuxChix 1735:standards 1733:Types and 1714:Unlicense 1709:Sleepycat 1543:Community 1075:Dr Dobb's 784:goneall. 349:standard. 263:Licensing 236:Security: 180:Structure 117:CC-BY-3.0 96:Committee 49:Published 2551:Projects 2429:Category 2348:The Code 2335:Phoronix 2325:LugRadio 2209:Embedded 2199:Adopters 2191:Adoption 1954:Category 1871:Related 1752:Copyleft 1672:GNU LGPL 1667:GNU AGPL 1632:Beerware 1627:Artistic 1604:Licenses 1571:Advocacy 1518:iOS apps 1459:Wireless 1454:Graphics 1421:packages 1419:Software 1409:Timeline 1150:Archived 1146:spdx.dev 1100:31 March 747:spdx.dev 616:See also 576:Adoption 389:May 2015 359:May 2020 230:Software 216:profiles 162:metadata 158:licenses 148:) is an 2377:Red Hat 2330:LWN.net 2204:Desktop 2012:History 1880:Forking 1662:GNU GPL 1556:History 1486:Routing 1449:Drivers 1404:Outline 1352:General 1310:LWN.net 1252:30 July 955:LWN.net 861:iso.org 562:GPL-2.0 257:Dataset 122:Website 114:License 78:2024-04 76: ( 61:2011-08 59: ( 2382:Ubuntu 2219:Mobile 2214:Gaming 1944:Portal 1873:topics 1694:Python 1617:Apache 1566:Events 1466:Health 1439:Codecs 1302:GitHub 475:Syntax 453:NTIA's 242:Build: 219:3.0: 104:Domain 46:Status 2563:SONiC 2238:Media 2043:more… 1996:Linux 1719:WTFPL 1429:Audio 1021:(PDF) 667:(PDF) 510:) or 339:2.2.1 326:2.2.2 292:Notes 224:Core: 1724:zlib 1647:CDDL 1622:APSL 1298:SPDX 1254:2023 1102:2020 595:FSFE 533:and 483:and 377:CVEs 300:3.0 269:Lite 142:SPDX 129:.dev 127:spdx 41:SPDX 21:SPDY 2037:Tux 1689:MPL 1684:MIT 1679:ISC 1652:EPL 1637:BSD 1612:AFL 1300:on 1121:GNU 606:RPM 602:npm 512:MIT 481:AND 429:1.0 412:1.1 399:1.2 386:2.0 369:2.1 356:2.2 347:ISO 313:2.3 172:. 72:3.0 2585:: 1270:. 1245:. 1227:. 1209:. 1191:. 1173:. 1148:. 1144:. 1119:. 1073:. 1048:. 1023:. 953:. 921:^ 904:. 859:. 848:^ 832:. 808:. 769:. 745:. 700:. 686:^ 669:. 495:. 491:, 485:OR 379:). 251:AI 2464:e 2457:t 2450:v 1988:e 1981:t 1974:v 1337:e 1330:t 1323:v 1274:. 1256:. 1231:. 1213:. 1195:. 1177:. 1159:. 1129:. 1104:. 1083:. 1058:. 1033:. 1006:. 985:. 964:. 939:. 915:. 890:. 869:. 842:. 818:. 794:. 773:. 755:. 731:. 710:. 680:. 652:. 514:( 506:( 493:) 489:( 140:( 80:) 63:) 23:.

Index

SPDY

Linux Foundation
Software bill of materials
spdx.dev
open standard
bills of materials
licenses
metadata
Linux Foundation
Resource Description Framework
software build
ISO
CVEs
cryptographic hash function
software licenses
software vulnerabilities
NTIA's
International Organization for Standardization
Apache License
MIT license
BSD License
GNU General Public License version 2
Das U-Boot
FSFE
npm
RPM
Fedora Linux
License proliferation
"SPDX: It's Already in Use for Global Software Bill of Materials (SBOM) and Supply Chain Security"

Text is available under the Creative Commons Attribution-ShareAlike License. Additional terms may apply.

↑