Where to Find SPDX Specifications, the License List, and Tools on spdx.dev

Updated

The three resources you need are all reachable from the Use section of spdx.dev: Specifications for the standard itself, License List for the standardized license identifiers, and Tools for the workgroup and third-party utilities. The site's own Use menu lists these as Overview, Examples, Specifications, License List, and Tools, so you can go straight to the one you want rather than searching.

SPDX Specifications

The Specifications page is where the SPDX standard is documented. Per the site, SPDX is "a freely available international open standard (ISO/IEC 5962:2021)" — so the specification is published as an ISO/IEC standard, not a proprietary document.

Use this entry when you need to:

  • Understand the structure of an SPDX document before generating or parsing one.
  • Check which fields and relationships the standard defines.
  • Cite the standard's formal status (ISO/IEC 5962:2021) in procurement or compliance documentation.

If you are new to the format, start with Overview and Examples in the same Use section before opening the specification — the examples show what a populated document looks like, which makes the specification's field definitions easier to follow.

SPDX License List

The License List is a separate resource from the specification. It provides the standardized short identifiers used to reference licenses in SPDX documents, so that a license is expressed as a stable, machine-readable token rather than free text.

Reach for it when you need to:

  • Look up the correct SPDX identifier for a license you found in a dependency.
  • Check whether a particular license is on the list at all.
  • Keep license references consistent across SBOMs and other SPDX documents.

The site also lists Handling License Info under Areas of Interest, which is the topical entry point if your question is about how license information should be expressed rather than which identifier to use.

SPDX Tools

The Tools page collects "SPDX workgroup tools and others you can use." That phrasing matters: it is a mix of tools maintained by the SPDX workgroup and tools from elsewhere, so check the origin of a given tool if maintenance and support expectations matter to you.

Typical uses:

  • Generating an SPDX document from a codebase or build.
  • Validating an existing document against the specification.
  • Converting between SPDX and other SBOM formats.

Choosing the Right Entry Point

What you need Where to go on spdx.dev
The formal standard and its field definitions Use → Specifications
The correct license identifier Use → License List
Software to create, validate, or convert documents Use → Tools
A first look at what an SPDX document contains Use → Overview, then Examples
How license information should be represented Areas of Interest → Handling License Info

Context Worth Knowing

SPDX is described on the site as "an open standard capable of representing systems with software components in as SBOMs (Software Bill of Materials) and other AI, data and security references supporting a range of risk management use cases." That scope explains why the site is organized into Areas of Interest — AI, Build, Core, Dataset, Hardware, Licensing, Lite, Security, Services, and Software Supply Chain — rather than as a single document set. If your task is narrower than "the specification," one of those profiles is likely the better starting point.

The site also notes it is supported by foundations and lists SPDX supporters, and it publishes news and announcements (for example, articles in the Journal of Innovation and a whitepaper on leveraging SBOMs throughout the enterprise SDLC). Those are useful for tracking how the standard is being applied, but they are not substitutes for the Specifications, License List, or Tools pages when you need the actual artifacts.

One practical note: the site does not state pricing or login requirements for these resources in the material available here, so treat access terms as something to confirm on the individual pages rather than assuming.