Software Package Data Exchange

System Package Data Exchange (SPDX, formerly Software Package Data Exchange) is an <a href="/facts/Open_standard/RGvhGQVI">open standard</a> capable of representing systems with digital components as <a href="/facts/Software_supply_chain/FdXSbyeu">bills of materials</a> (BOMs). First designed to describe software components, SPDX can describe the components of software systems, AI models, software builds, security data, and other data packages. SPDX allows the expression of components, <a href="/facts/Software_license/7enfIqhL"> licenses</a>, copyrights, security references and other <a href="/facts/Metadata/qt35z79C">metadata</a> relating to systems.
The original purpose of SPDX was to improve license compliance, and it has since been expanded to facilitate additional use cases such as supply-chain transparency and security. SPDX is authored by the community-driven SPDX Project involving key industry experts, organizations, and open-source enthusiasts under the auspices of the <a href="/facts/Linux_Foundation/5wbe2Vp0">Linux Foundation</a>. 
The SPDX specification is recognized as the international open standard for security, license compliance, and other software supply chain artifacts as ISO/IEC 5962:2021. The current[when?] version of the standard is 3.0.

Software Package Data Exchange open-in-new

Software Package Data Exchange