Who Supports and Governs the SPDX Standard?

SPDX is a project of the Linux Foundation, and the spdx.dev site presents it as an open standard supported by multiple foundations and a broad set of organizational supporters. The specification itself is published as a freely available international open standard, ISO/IEC 5962:2021. If you need to know who stands behind the standard before adopting it, the governance and support signals are visible directly on the site: an About section covering Overview, Governance, and Legal Notices, a "Supported by These Foundations" block, and an "SPDX Supporters" listing.

Governance: how SPDX is organized

The site's About area is split into three parts — Overview, Governance, and Legal Notices — which is where the formal structure of the project is documented. SPDX operates under the Linux Foundation, whose copyright notice and trademark terms appear in the site footer. The Linux Foundation states that it has registered trademarks and uses trademarks, and directs readers to its Trademark Usage page for the full list; Linux itself is noted as a registered trademark of Linus Torvalds.

Participation is organized through teams rather than a single body. The Engage section lists a Technical Team, a Legal Team, and an Outreach Team, alongside a general Participate entry point and a Join option. That split matters if you are trying to work out where a given decision gets made: technical specification work, license-list and legal interpretation, and community outreach are handled by separate groups.

Work is also structured by "areas of interest," described on the site as profiles focused on specific user needs. The listed areas are:

• AI
• Build
• Core
• Dataset
• Hardware
• Licensing
• Lite
• Security
• Services
• Software Supply Chain
• Handling License Info

Support: foundations and supporters

Two distinct signals appear on the homepage. "Supported by These Foundations" indicates backing from more than one foundation, not only the Linux Foundation. Separately, "SPDX Supporters" lists organizations that support the effort. The site does not, in the material available here, enumerate the individual foundations or supporters by name, so treat those two blocks as the place to check the current lists rather than as a fixed roster.

What the standard covers

SPDX is described as an open standard capable of representing systems with software components as SBOMs (Software Bill of Materials), and also as AI, data, and security references supporting a range of risk management use cases. That scope explains why the areas of interest include AI, Dataset, and Hardware alongside the more familiar licensing and software supply chain topics.

Where to verify the current picture

Because governance membership and supporter lists change, check the live pages rather than relying on a summary:

The site also maintains a News section for announcements, which is where updates to the standard and its ecosystem tend to surface first.