SPDX

Identity

Software Package Data Exchange, created within the Linux Foundation and standardised as ISO/IEC 5962 for version 2.2.1. Serialisations: tag-value, JSON, YAML, RDF/XML and spreadsheet.

Designed by a legal compliance community, around the licensing question.

Document structure (SPDX 2.x)

Section	Content
Document creation information	SPDX version, document identifier, data licence, creator, timestamp
Packages	Packages: name, version, supplier, hash, declared and concluded licence, copyright notice, provenance
Files	File-by-file detail, with licence and copyright — a rare granularity, decisive in an audit
Snippets	Fragments of code of distinct origin within a file
Relationships	Relationships: contains, depends on, is generated by, is a source file of…
Annotations	Timestamped, attributed comments
Other licensing information	Licences not in the SPDX list

The distinction between the declared licence (PackageLicenseDeclared, what the project asserts) and the concluded licence (PackageLicenseConcluded, what analysis establishes) is specific to SPDX and has no direct equivalent elsewhere. It is valuable in litigation: it documents that you verified rather than took someone’s word.

SPDX 3 and profiles

SPDX 3 reorganises the model around activatable profiles: core, software, licensing, security, build, AI, dataset, extension. That brings SPDX closer to CycloneDX’s functional coverage while keeping its legal depth.

The SPDX licence list

This is the project’s most universal contribution: a standardised list of licence identifiers — MIT, Apache-2.0, GPL-3.0-or-later, LGPL-2.1-only, MPL-2.0, BSD-3-Clause, AGPL-3.0-only — used across the whole ecosystem, including by CycloneDX.

Licence expressions cover compound cases:

Expression	Meaning
MIT	A single licence
MIT OR Apache-2.0	Dual licence, at the recipient’s choice
GPL-2.0-only AND MIT	Both apply cumulatively
GPL-2.0-only WITH Classpath-exception-2.0	A licence with a standardised exception
NOASSERTION	Licence undetermined — treat as a blocking defect

What each of these licences actually requires is set out in The licence families.

Annotated example (tag-value)

SPDXVersion: SPDX-2.3
DataLicense: CC0-1.0
SPDXID: SPDXRef-DOCUMENT
DocumentName: acme-gateway-4.2.1
DocumentNamespace: https://acme.example.org/spdx/acme-gateway-4.2.1
Creator: Tool: syft-1.x
Created: 2026-08-19T09:12:04Z

PackageName: acme-gateway
SPDXID: SPDXRef-Package-acme-gateway
PackageVersion: 4.2.1
PackageDownloadLocation: NOASSERTION
FilesAnalyzed: true
PackageLicenseDeclared: Apache-2.0
PackageLicenseConcluded: Apache-2.0
PackageCopyrightText: NOASSERTION

PackageName: http-client
SPDXID: SPDXRef-Package-http-client
PackageVersion: 5.3.1
PackageLicenseDeclared: MIT
PackageLicenseConcluded: MIT
ExternalRef: PACKAGE-MANAGER purl pkg:maven/org.example/[email protected]

Relationship: SPDXRef-Package-acme-gateway DEPENDS_ON SPDXRef-Package-http-client

Points to note:

• PackageLicenseConcluded: NOASSERTION in bulk signals a tool that did not analyse the files; that is a quality defect, not a property of the component;
• ExternalRef … purl carries the identifier that makes correlation reliable;
• DocumentNamespace must be unique and stable: it is the document’s identity.

When you produce SPDX

• When a customer requires it contractually.
• For legal deliverables: attribution file, diligence responses, preparation of a licence audit.
• When an upstream ecosystem already publishes in that format and you aggregate it.

In every other case your pivot format remains CycloneDX, with documented conversion.