SPDX SBOM Project

The Software Package Data Exchange (SPDX ) is an open standard for communicating software bill of material information, including components, licenses, copyrights, and security references. SPDX reduces redundant work by providing a common format for companies and communities to share important data, thereby streamlining and improving compliance.

An open source project under the Linux Foundation, the SPDX specification is an international open standard (ISO/IEC 5962:2021).

SPDX.dev and github.com/spdx for more.