简体中文
EnglishWhat is SPDX and what does the spdx.dev website offer?
Updated
SPDX is an open standard for representing software components and related data, most commonly as a Software Bill of Materials (SBOM). The spdx.dev website is the official home of the project, maintained under the Linux Foundation, and it provides the specification, license list, tools, examples, and ways to participate. The SPDX specification is a freely available international open standard (ISO/IEC 5962:2021). If you need to understand, produce, or consume SBOMs or related AI, data, and security references, this site is the starting point.
What SPDX actually is
SPDX stands for System Package Data Exchange. It is an open standard capable of representing systems with software components as SBOMs and other AI, data, and security references, supporting a range of risk management use cases. It is not a product or a single tool; it is a specification that different tools and organizations can implement.
The site notes that the specification is a freely available international open standard, identified as ISO/IEC 5962:2021.
What the spdx.dev website offers
The site is organized around four main areas, each aimed at a different stage of engagement:
| Section | What it covers |
|---|---|
| About | Overview, governance, and legal notices |
| Learn | Structure of SPDX, areas of interest, and how to participate |
| Use | Examples, specifications, license list, and tools |
| Engage | Participate, technical team, legal team, outreach team, and join |
Learn
The Learn section explains the structure of SPDX and how to participate. It also lists areas of interest, which the site describes as profiles focused on specific user needs. These include AI, Build, Core, Dataset, Hardware, Licensing, Lite, Security, Services, Software Supply Chain, and Handling License Info.
Use
The Use section is where you find practical resources:
- Examples – sample SPDX documents to work from
- Specifications – the SPDX specification itself
- License List – the standardized list of license identifiers
- Tools – SPDX workgroup tools and others you can use
Engage
The Engage section covers participation through the technical team, legal team, and outreach team, plus a join option.
Who maintains it
SPDX is a Linux Foundation project. The site lists supporting foundations and SPDX supporters, and the footer notes that the Linux Foundation holds registered trademarks and uses trademarks, with Linux being a registered trademark of Linus Torvalds.
When to use this site
Use spdx.dev when you need to:
- Read or reference the SPDX specification
- Look up a standardized license identifier
- Find tools for generating or consuming SBOMs
- See examples of SPDX documents
- Understand how to participate in the project
If you only need a quick definition, the key facts are that SPDX is an open standard for SBOMs and related data, it is ISO/IEC 5962:2021, and it is freely available. For anything beyond that, the site's Learn and Use sections are the places to go.