Knowledge

Software Package Data Exchange

Source đź“ť

2428: 2440: 1966: 1956: 42: 2414: 209:
SPDX 3.0 allows users to communicate information at a much more granular level without having to package it as “envelope” data. A key design principle in SPDX 3.0 is that all elements may be expressed and referenced independent of any other element. This independence is required to support a variety
229:
to support the expansion of use cases beyond software, without increasing overall complexity. Profiles allow users to define data for the use cases they need, while also increasing the amount of information that can be gathered directly from the SPDX data. There are eight profiles defined by SPDX
200:
The SPDX 2.x standard defines an SBOM document, which contains SPDX metadata about software. The document itself can be expressed in multiple formats, including JSON, YAML, RDF/XML, tag–value, and spreadsheet. Each SPDX document describes one or more elements, which can be a software package, a
178:
The original purpose of SPDX was to improve license compliance, and it has since been expanded to facilitate additional use cases such as supply-chain transparency and security. SPDX is authored by the community-driven SPDX Project involving key industry experts, organizations, and open-source
210:
of content exchange and analysis use cases and makes it easier to communicate single elements of interest. The relationship structure has also been updated to be both more expressive and easier to understand compared to older versions of the spec.
167:(BOMs). First designed to describe software components, SPDX can describe the components of software systems, AI models, software builds, security data, and other data packages. SPDX allows the expression of components, 186:
The SPDX specification is recognized as the international open standard for security, license compliance, and other software supply chain artifacts as ISO/IEC 5962:2021. The current version of the standard is 3.0.
558:
In 2020, the European Commission published its Joinup Licensing Assistant, which makes possible the selection and comparison of more than 50 licenses, with access to their SPDX identifier and full text.
217:(RDF). Data may be serialized in a variety of formats for storage and transmission, including formats defined in RDF 1.1 such as JSON-LD, Turtle (Terse RDF Triple Language), N-Triples, and RDF/XML. 317:
Introduced a comprehensive set of updates encompassing the model, specification, and license list, with the new addition of SPDX profiles to handle modern system use cases like security and AI.
551:
SPDX describes the exact terms under which a piece of software is licensed. It does not attempt to categorize licenses by type, for instance by describing licenses with similar terms to the
1012: 991: 1459: 1040: 686: 575:
meant "exactly GPL version 2.0" or "GPL version 2.0 or any later version". Thus, since version 3.0 of the SPDX License List, the GNU family of licenses got new names.
463: 658: 1538: 490:
Each license is identified by a full name, such as "Mozilla Public License 2.0" and a short identifier, here "MPL-2.0". Licenses can be combined by operators
945: 1757: 1379: 1596: 458:
easier, but subsequent versions of the specification added capabilities intended for other use-cases, such as being able to contain references to known
2123: 679: 1528: 1548: 1434: 470: 357: 2128: 1533: 1516: 1186: 201:
specific file, or a snippet from a file. Each element is given a unique identifier, and metadata for an element can refer to other elements.
713: 1486: 1384: 2153: 1662: 1496: 1469: 1449: 1165: 596:
The SPDX license identifier can be added to the top of source code files as a short string unambiguously declaring the license used. The
2478: 1474: 1424: 1394: 536:
There is also a "+" operator which, when applied to a license, means that future versions of the license apply as well. For example,
2374: 1571: 1110: 416:
Improved interaction with the SPDX License List, and added new fields for documenting extra information about software projects.
571:) have the choice of choosing a later version of the license built in. Sometimes, it was not clear whether the SPDX expression 1240: 782: 1543: 1501: 1444: 330:
Added new fields to improve the ability to capture security related information and interoperability with other SBOM formats.
2432: 2387: 2138: 1959: 1907: 1837: 1521: 1086: 568: 387: 1481: 1374: 1061: 2609: 1862: 1714: 2501: 2397: 2113: 1777: 1687: 1682: 30:
This article is about the standard for describing software bills of materials. For the communications protocol, see
1506: 1414: 2526: 2133: 2002: 1772: 1604: 1511: 1033: 2552: 2471: 1351: 608:
launched REUSE, which provides tools to validate the comment and to efficiently extract copyright information.
214: 373:
Added 'SPDX-lite' profile for minimal software bill of materials and improved support for external references.
2392: 2090: 1867: 1762: 1586: 1576: 1360: 623:, replacing the earlier use of the Callaway system. Debian uses a slightly different license specification. 2085: 1933: 1787: 1581: 403:
Added the ability to describe multiple packages and the relationships between different packages and files.
282:: subset of the SPDX specification aimed at balancing SPDX standard and actual workflows in some industries 2350: 2604: 2181: 2118: 1895: 1802: 1637: 430: 896: 2219: 2080: 1792: 1677: 1454: 1013:"The Linux Foundation's SPDX Workgroup Releases New Version of Software Package Data Exchange Standard" 992:"The Linux Foundation's SPDX Workgroup Releases New Version of Software Package Data Exchange Standard" 637: 118: 2547: 2521: 2464: 2224: 1927: 1842: 1827: 1283: 1204: 459: 386:
Added support for describing 'snippets' of code and the ability to reference non-SPDX data (such as
2578: 2531: 2234: 2042: 1922: 1719: 1672: 1657: 1609: 1419: 270:: concepts related to a dataset, including preparation process, characteristics, and access methods 659:"SPDX: It's Already in Use for Global Software Bill of Materials (SBOM) and Supply Chain Security" 343:
Functionally equivalent to SPDX 2.2.1 but with spelling, grammar and other editorial improvements.
917: 2619: 2614: 2573: 2273: 2266: 2214: 2095: 1969: 1857: 1704: 1667: 1566: 1132: 2058: 1832: 1627: 1619: 1558: 1491: 632: 164: 1258: 2362: 2191: 1917: 1852: 1847: 1409: 738: 17: 8: 1995: 1797: 1399: 616: 845: 2557: 2239: 2105: 2075: 1344: 1187:"Solving License Compliance at the Source: Adding SPDX License IDs - Linux Foundation" 821: 2511: 2047: 1955: 1877: 1724: 1404: 2487: 2196: 2186: 2027: 1642: 946:"The Linux Foundation's Open Compliance Initiative Releases New SPDX Specification" 758: 455: 180: 168: 100: 2382: 2143: 1912: 717: 611:
The SPDX license identifier is also used in a number of package managers such as
454:
The first version of the SPDX specification was intended to make compliance with
1329: 801: 2444: 2306: 2206: 2148: 2032: 1988: 1709: 1632: 612: 518: 356:
Functionally equivalent to SPDX 2.2 but with typesetting for publication as an
276:: license information necessary for compliance with typical licensing use cases 256: 1157: 2598: 2506: 2356: 2328: 2299: 2292: 2244: 2176: 1940: 1901: 1807: 1464: 1389: 1337: 160: 2418: 2285: 2229: 2052: 2019: 1782: 1739: 1652: 1065: 620: 872: 2583: 2334: 2320: 2260: 2037: 1872: 1699: 1694: 552: 526: 873:"ISO/IEC 5962:2021 Information technology — SPDX® Specification V2.2.1" 601: 2516: 2313: 2279: 2171: 1729: 475:
ISO/IEC 5962:2021 Information technology — SPDX® Specification V2.2.1
1222: 2456: 2340: 1767: 1647: 1323: 966: 172: 1223:"PEP 639 – Improving License Clarity with Better Package Metadata" 1133:"For Clarity's Sake, Please Don't Say "Licensed under GNU GPL 2"!" 2345: 970: 41: 1317: 615:, Python, and Rust cargo. SPDX license expressions are used in 1034:"The Minimum Elements For a Software Bill of Materials (SBOM)" 446:
The first release of the SPDX specification; handles packages.
264:: concepts and data elements related to an AI system and model 2011: 1734: 605: 163:
capable of representing systems with digital components as
31: 1313: 1041:
National Telecommunications and Information Administration
687:
National Telecommunications and Information Administration
604:
in 2013, became part of SPDX in version 2.1. In 2017, the
2413: 249:
security-related metadata specific to a piece of software
1980: 466:'Minimum Elements For a Software Bill of Materials'. 429:
Fixed a flaw in the SPDX Package Verification Code (a
1053: 1026: 1380:
Comparison of open-source and closed-source software
1306: 714:"Linux Foundation eases open source licensing woes" 137: 1748: 1087:"The Software Package Data Exchange (SPDX) Format" 1062:"SPDX becomes internationally recognized standard" 255:information required to describe an instance of a 1359: 707: 705: 703: 562: 2596: 838: 1155: 783:"SPDX and NTIA Minimum Elements for SBOM HOWTO" 680:"Survey of Existing SBOM Formats and Standards" 940: 938: 814: 700: 471:International Organization for Standardization 2472: 1996: 1345: 473:(ISO) in October, 2020, and was published as 1385:Comparison of source-code-hosting facilities 1130: 959: 910: 650: 237:foundational concepts common to all profiles 171:, copyrights, security references and other 27:Open standard for software bill of materials 1005: 984: 935: 889: 867: 865: 433:) and added support for free-form comments. 2479: 2465: 2003: 1989: 1352: 1338: 711: 672: 583:means "version 2.0 or any later version". 480: 40: 739:"Advancing SBOM standards: Snyk and SPDX" 736: 2433:Free and open-source software portal 1284:"Machine-readable debian/copyright file" 862: 730: 548:may apply (and future versions if any). 243:: concepts related to software artifacts 213:The SPDX 3.0 data model is based on the 1078: 1059: 656: 14: 2597: 1241:"The Manifest Format - The Cargo Book" 1084: 775: 712:Bridgwater, Adrian (August 19, 2011). 462:. Recent versions of SPDX fulfill the 179:enthusiasts under the auspices of the 2460: 1984: 1333: 2486: 1908:Microsoft Open Specification Promise 1060:Bernard, Allen (September 9, 2021). 994:. Linux Foundation. October 22, 2013 918:"General Meeting/Minutes/2016-11-03" 802:"Understanding SPDX Profiles – SPDX" 569:GNU General Public License version 2 220: 2375:Professional related certifications 1375:Alternative terms for free software 1015:. Linux Foundation. August 30, 2012 948:. Linux Foundation. October 4, 2016 799: 737:Rushgrove, Gareth (June 16, 2021). 24: 1715:Python Software Foundation License 1156:Jilayne Lovejoy (5 January 2018). 567:The GNU family of licenses (e.g., 513:means that one can choose between 286: 25: 2631: 2502:Cloud Native Computing Foundation 2154:List of software package managers 2139:Security-focused operating system 1778:Definition of Free Cultural Works 1395:Free software project directories 1298: 897:"SPDX 2.2 Specification Released" 225:The 3.0 specification introduced 2439: 2438: 2426: 2412: 1965: 1964: 1954: 1415:Open-source software development 591: 579:means "exactly version 2.0" and 533:means that both licenses apply. 469:SPDX 2.2.1 was submitted to the 2527:Open Source Security Foundation 2129:Distributions that run from RAM 1773:Debian Free Software Guidelines 1605:Free Software Movement of India 1276: 1251: 1233: 1215: 1197: 1179: 1168:from the original on 2018-01-05 1149: 1124: 1103: 899:. Linux Foundation. May 7, 2020 2553:Core Infrastructure Initiative 793: 751: 657:Stewart, Kate (May 25, 2021). 563:Deprecated license identifiers 215:Resource Description Framework 204: 195: 157:Software Package Data Exchange 13: 1: 1763:Contributor License Agreement 1577:Open-source-software movement 1361:Free and open-source software 1259:"License: field in Spec File" 689:. October 25, 2019. p. 9 643: 2086:GNU/Linux naming controversy 1934:The Cathedral and the Bazaar 1788:The Free Software Definition 1158:"License List 3.0 Released!" 1111:"Joinup Licensing Assistant" 190: 149:System Package Data Exchange 7: 2182:Linux Documentation Project 2124:Netbook-specific comparison 1838:Mozilla software rebranding 1803:Permissive software license 1085:Odence, Phil (2010-06-23). 626: 586: 431:cryptographic hash function 10: 2636: 2081:Criticism of desktop Linux 1843:Proprietary device drivers 1793:The Open Source Definition 1263:Fedora Legal Documentation 638:Rights Expression Language 119:Software bill of materials 29: 2610:Linux Foundation projects 2566: 2548:Open Container Initiative 2540: 2494: 2406: 2373: 2253: 2205: 2164: 2104: 2091:Tanenbaum–Torvalds debate 2068: 2018: 2010: 1950: 1928:Source-available software 1886: 1828:Digital rights management 1820: 1618: 1595: 1557: 1433: 1367: 1205:"package.json | npm Docs" 597: 485: 132: 124: 114: 106: 96: 79: 64: 56: 48: 39: 2532:Overture Maps Foundation 1923:Shared Source Initiative 1720:Shared Source Initiative 1673:Free Software Foundation 1610:Free Software Foundation 1460:Configuration management 967:"What's new in SPDX 2.0" 460:software vulnerabilities 1858:SCO/Linux controversies 1191:www.linuxfoundation.org 598:SPDX-License-Identifier 481:SPDX-License-identifier 292:Specification versions 2574:Open Mainframe Project 2267:Free Software Magazine 2197:Linux User Group (LUG) 1758:Comparison of licenses 1567:Free software movement 759:"SPDX Current version" 529:). On the other hand, 1833:License proliferation 633:License proliferation 600:syntax, pioneered by 175:relating to systems. 2192:Linux Mark Institute 1918:Open-source hardware 1853:Proprietary software 1848:Proprietary firmware 1549:Formerly open-source 1544:Formerly proprietary 1410:Open-source software 619:package metadata in 531:(Apache-2.0 AND MIT) 1798:Open-source license 1400:Gratis versus libre 511:(Apache-2.0 OR MIT) 293: 2605:Computer standards 2558:OpenAPI Initiative 2119:Distributions list 2114:General comparison 2076:Criticism of Linux 1131:Richard Stallman. 924:. November 3, 2016 661:. Linux Foundation 291: 165:bills of materials 2592: 2591: 2522:Presto Foundation 2512:OpenJS Foundation 2454: 2453: 1978: 1977: 1878:Trusted Computing 1868:Software security 1816: 1815: 1497:Operating systems 1405:Long-term support 1324:A SPDX case study 1245:doc.rust-lang.org 477:in August, 2021. 456:software licenses 452: 451: 221:SPDX 3.0 Profiles 146: 145: 16:(Redirected from 2627: 2488:Linux Foundation 2481: 2474: 2467: 2458: 2457: 2442: 2441: 2431: 2430: 2429: 2419:Linux portal 2417: 2416: 2388:Linux Foundation 2187:Linux Foundation 2005: 1998: 1991: 1982: 1981: 1968: 1967: 1958: 1863:Software patents 1746: 1745: 1658:Creative Commons 1517:Web applications 1354: 1347: 1340: 1331: 1330: 1310: 1309: 1307:Official website 1292: 1291: 1280: 1274: 1273: 1271: 1269: 1255: 1249: 1248: 1237: 1231: 1230: 1219: 1213: 1212: 1201: 1195: 1194: 1183: 1177: 1176: 1174: 1173: 1153: 1147: 1146: 1144: 1143: 1128: 1122: 1121: 1119: 1117: 1107: 1101: 1100: 1098: 1097: 1082: 1076: 1075: 1073: 1072: 1057: 1051: 1050: 1048: 1047: 1038: 1030: 1024: 1023: 1021: 1020: 1009: 1003: 1002: 1000: 999: 988: 982: 981: 979: 978: 963: 957: 956: 954: 953: 942: 933: 932: 930: 929: 914: 908: 907: 905: 904: 893: 887: 886: 884: 883: 869: 860: 859: 857: 856: 846:"Release v2.2.2" 842: 836: 835: 833: 832: 818: 812: 811: 809: 808: 797: 791: 790: 779: 773: 772: 770: 769: 755: 749: 748: 746: 745: 734: 728: 727: 725: 724: 709: 698: 697: 695: 694: 684: 676: 670: 669: 667: 666: 654: 599: 582: 581:GPL-2.0-or-later 578: 574: 547: 543: 539: 532: 524: 516: 512: 505: 501: 497: 493: 300:Publication date 294: 290: 181:Linux Foundation 142: 139: 101:Linux Foundation 92: 90: 75: 73: 68:August 2011 44: 37: 36: 21: 2635: 2634: 2630: 2629: 2628: 2626: 2625: 2624: 2595: 2594: 2593: 2588: 2562: 2536: 2495:Sub-foundations 2490: 2485: 2455: 2450: 2427: 2425: 2411: 2402: 2369: 2249: 2201: 2160: 2144:Package manager 2100: 2064: 2043:Booting process 2014: 2009: 1979: 1974: 1946: 1913:Open-core model 1888: 1882: 1812: 1750: 1744: 1614: 1591: 1553: 1436: 1429: 1363: 1358: 1322:Nathan Willis: 1305: 1304: 1301: 1296: 1295: 1282: 1281: 1277: 1267: 1265: 1257: 1256: 1252: 1239: 1238: 1234: 1227:peps.python.org 1221: 1220: 1216: 1203: 1202: 1198: 1185: 1184: 1180: 1171: 1169: 1154: 1150: 1141: 1139: 1129: 1125: 1115: 1113: 1109: 1108: 1104: 1095: 1093: 1083: 1079: 1070: 1068: 1058: 1054: 1045: 1043: 1036: 1032: 1031: 1027: 1018: 1016: 1011: 1010: 1006: 997: 995: 990: 989: 985: 976: 974: 965: 964: 960: 951: 949: 944: 943: 936: 927: 925: 916: 915: 911: 902: 900: 895: 894: 890: 881: 879: 871: 870: 863: 854: 852: 850:github.com/spdx 844: 843: 839: 830: 828: 826:github.com/spdx 820: 819: 815: 806: 804: 798: 794: 781: 780: 776: 767: 765: 757: 756: 752: 743: 741: 735: 731: 722: 720: 718:Computer Weekly 710: 701: 692: 690: 682: 678: 677: 673: 664: 662: 655: 651: 646: 629: 594: 589: 580: 576: 572: 565: 555:as "BSD-like". 545: 541: 537: 530: 522: 514: 510: 503: 499: 498:, and grouping 495: 491: 488: 483: 289: 287:Version history 223: 207: 198: 193: 136: 88: 86: 85:April 2024 84: 71: 69: 65:First published 35: 28: 23: 22: 15: 12: 11: 5: 2633: 2623: 2622: 2617: 2612: 2607: 2590: 2589: 2587: 2586: 2581: 2576: 2570: 2568: 2564: 2563: 2561: 2560: 2555: 2550: 2544: 2542: 2538: 2537: 2535: 2534: 2529: 2524: 2519: 2514: 2509: 2504: 2498: 2496: 2492: 2491: 2484: 2483: 2476: 2469: 2461: 2452: 2451: 2449: 2448: 2436: 2422: 2407: 2404: 2403: 2401: 2400: 2395: 2390: 2385: 2383:CompTIA Linux+ 2379: 2377: 2371: 2370: 2368: 2367: 2360: 2353: 2348: 2343: 2338: 2331: 2326: 2325: 2324: 2310: 2307:Linux Magazine 2303: 2296: 2289: 2282: 2277: 2270: 2263: 2257: 2255: 2251: 2250: 2248: 2247: 2242: 2237: 2232: 2227: 2222: 2217: 2211: 2209: 2203: 2202: 2200: 2199: 2194: 2189: 2184: 2179: 2174: 2168: 2166: 2162: 2161: 2159: 2158: 2157: 2156: 2151: 2149:Package format 2141: 2136: 2131: 2126: 2121: 2116: 2110: 2108: 2102: 2101: 2099: 2098: 2093: 2088: 2083: 2078: 2072: 2070: 2066: 2065: 2063: 2062: 2055: 2050: 2045: 2040: 2035: 2030: 2024: 2022: 2016: 2015: 2008: 2007: 2000: 1993: 1985: 1976: 1975: 1973: 1972: 1962: 1951: 1948: 1947: 1945: 1944: 1937: 1930: 1925: 1920: 1915: 1910: 1905: 1898: 1892: 1890: 1884: 1883: 1881: 1880: 1875: 1870: 1865: 1860: 1855: 1850: 1845: 1840: 1835: 1830: 1824: 1822: 1818: 1817: 1814: 1813: 1811: 1810: 1805: 1800: 1795: 1790: 1785: 1780: 1775: 1770: 1765: 1760: 1754: 1752: 1743: 1742: 1737: 1732: 1727: 1722: 1717: 1712: 1707: 1702: 1697: 1692: 1691: 1690: 1685: 1680: 1670: 1665: 1660: 1655: 1650: 1645: 1640: 1635: 1630: 1624: 1622: 1616: 1615: 1613: 1612: 1607: 1601: 1599: 1593: 1592: 1590: 1589: 1584: 1579: 1574: 1569: 1563: 1561: 1555: 1554: 1552: 1551: 1546: 1541: 1536: 1531: 1526: 1525: 1524: 1514: 1509: 1504: 1499: 1494: 1489: 1484: 1479: 1478: 1477: 1472: 1462: 1457: 1452: 1450:Bioinformatics 1447: 1441: 1439: 1431: 1430: 1428: 1427: 1422: 1417: 1412: 1407: 1402: 1397: 1392: 1387: 1382: 1377: 1371: 1369: 1365: 1364: 1357: 1356: 1349: 1342: 1334: 1328: 1327: 1320: 1311: 1300: 1299:External links 1297: 1294: 1293: 1288:www.debian.org 1275: 1250: 1232: 1214: 1209:docs.npmjs.com 1196: 1178: 1148: 1123: 1102: 1077: 1052: 1025: 1004: 983: 973:. May 20, 2015 958: 934: 909: 888: 861: 837: 822:"Release v2.3" 813: 792: 787:spdx.github.io 774: 750: 729: 699: 671: 648: 647: 645: 642: 641: 640: 635: 628: 625: 593: 590: 588: 585: 564: 561: 519:Apache License 487: 484: 482: 479: 450: 449: 447: 444: 441: 437: 436: 434: 427: 424: 420: 419: 417: 414: 411: 407: 406: 404: 401: 398: 394: 393: 391: 384: 381: 377: 376: 374: 371: 368: 364: 363: 361: 354: 351: 347: 346: 344: 341: 338: 334: 333: 331: 328: 325: 321: 320: 318: 315: 312: 308: 307: 304: 301: 298: 297:Version number 288: 285: 284: 283: 277: 271: 265: 259: 257:software build 250: 244: 238: 222: 219: 206: 203: 197: 194: 192: 189: 144: 143: 134: 130: 129: 126: 122: 121: 116: 112: 111: 108: 104: 103: 98: 94: 93: 81: 80:Latest version 77: 76: 66: 62: 61: 58: 54: 53: 50: 46: 45: 26: 9: 6: 4: 3: 2: 2632: 2621: 2620:IEC standards 2618: 2616: 2615:ISO standards 2613: 2611: 2608: 2606: 2603: 2602: 2600: 2585: 2582: 2580: 2577: 2575: 2572: 2571: 2569: 2565: 2559: 2556: 2554: 2551: 2549: 2546: 2545: 2543: 2539: 2533: 2530: 2528: 2525: 2523: 2520: 2518: 2515: 2513: 2510: 2508: 2507:Cloud Foundry 2505: 2503: 2500: 2499: 2497: 2493: 2489: 2482: 2477: 2475: 2470: 2468: 2463: 2462: 2459: 2447: 2446: 2437: 2435: 2434: 2423: 2421: 2420: 2415: 2409: 2408: 2405: 2399: 2396: 2394: 2391: 2389: 2386: 2384: 2381: 2380: 2378: 2376: 2372: 2366: 2365: 2361: 2359: 2358: 2357:Revolution OS 2354: 2352: 2349: 2347: 2344: 2342: 2339: 2337: 2336: 2332: 2330: 2329:Linux Outlaws 2327: 2323: 2322: 2318: 2317: 2316: 2315: 2311: 2309: 2308: 2304: 2302: 2301: 2300:Linux Journal 2297: 2295: 2294: 2293:Linux Gazette 2290: 2288: 2287: 2283: 2281: 2278: 2276: 2275: 2271: 2269: 2268: 2264: 2262: 2259: 2258: 2256: 2252: 2246: 2245:Linux malware 2243: 2241: 2238: 2236: 2233: 2231: 2228: 2226: 2223: 2221: 2218: 2216: 2213: 2212: 2210: 2208: 2204: 2198: 2195: 2193: 2190: 2188: 2185: 2183: 2180: 2178: 2177:Linux Counter 2175: 2173: 2170: 2169: 2167: 2165:Organizations 2163: 2155: 2152: 2150: 2147: 2146: 2145: 2142: 2140: 2137: 2135: 2132: 2130: 2127: 2125: 2122: 2120: 2117: 2115: 2112: 2111: 2109: 2107: 2106:Distributions 2103: 2097: 2096:SCO and Linux 2094: 2092: 2089: 2087: 2084: 2082: 2079: 2077: 2074: 2073: 2071: 2069:Controversies 2067: 2061: 2060: 2056: 2054: 2051: 2049: 2046: 2044: 2041: 2039: 2036: 2034: 2031: 2029: 2026: 2025: 2023: 2021: 2017: 2013: 2006: 2001: 1999: 1994: 1992: 1987: 1986: 1983: 1971: 1963: 1961: 1957: 1953: 1952: 1949: 1943: 1942: 1941:Revolution OS 1938: 1936: 1935: 1931: 1929: 1926: 1924: 1921: 1919: 1916: 1914: 1911: 1909: 1906: 1904: 1903: 1902:GNU Manifesto 1899: 1897: 1894: 1893: 1891: 1885: 1879: 1876: 1874: 1871: 1869: 1866: 1864: 1861: 1859: 1856: 1854: 1851: 1849: 1846: 1844: 1841: 1839: 1836: 1834: 1831: 1829: 1826: 1825: 1823: 1819: 1809: 1808:Public domain 1806: 1804: 1801: 1799: 1796: 1794: 1791: 1789: 1786: 1784: 1781: 1779: 1776: 1774: 1771: 1769: 1766: 1764: 1761: 1759: 1756: 1755: 1753: 1747: 1741: 1738: 1736: 1733: 1731: 1728: 1726: 1723: 1721: 1718: 1716: 1713: 1711: 1708: 1706: 1703: 1701: 1698: 1696: 1693: 1689: 1686: 1684: 1681: 1679: 1676: 1675: 1674: 1671: 1669: 1666: 1664: 1661: 1659: 1656: 1654: 1651: 1649: 1646: 1644: 1641: 1639: 1636: 1634: 1631: 1629: 1626: 1625: 1623: 1621: 1617: 1611: 1608: 1606: 1603: 1602: 1600: 1598: 1597:Organisations 1594: 1588: 1585: 1583: 1580: 1578: 1575: 1573: 1570: 1568: 1565: 1564: 1562: 1560: 1556: 1550: 1547: 1545: 1542: 1540: 1537: 1535: 1532: 1530: 1527: 1523: 1520: 1519: 1518: 1515: 1513: 1510: 1508: 1505: 1503: 1500: 1498: 1495: 1493: 1492:Office suites 1490: 1488: 1485: 1483: 1480: 1476: 1473: 1471: 1468: 1467: 1466: 1463: 1461: 1458: 1456: 1453: 1451: 1448: 1446: 1443: 1442: 1440: 1438: 1432: 1426: 1423: 1421: 1418: 1416: 1413: 1411: 1408: 1406: 1403: 1401: 1398: 1396: 1393: 1391: 1390:Free software 1388: 1386: 1383: 1381: 1378: 1376: 1373: 1372: 1370: 1366: 1362: 1355: 1350: 1348: 1343: 1341: 1336: 1335: 1332: 1325: 1321: 1319: 1315: 1312: 1308: 1303: 1302: 1289: 1285: 1279: 1264: 1260: 1254: 1246: 1242: 1236: 1228: 1224: 1218: 1210: 1206: 1200: 1192: 1188: 1182: 1167: 1163: 1159: 1152: 1138: 1134: 1127: 1112: 1106: 1092: 1088: 1081: 1067: 1063: 1056: 1042: 1035: 1029: 1014: 1008: 993: 987: 972: 968: 962: 947: 941: 939: 923: 922:wiki.spdx.org 919: 913: 898: 892: 878: 874: 868: 866: 851: 847: 841: 827: 823: 817: 803: 796: 788: 784: 778: 764: 760: 754: 740: 733: 719: 715: 708: 706: 704: 688: 681: 675: 660: 653: 649: 639: 636: 634: 631: 630: 624: 622: 618: 614: 609: 607: 603: 592:For licensing 584: 570: 560: 556: 554: 549: 534: 528: 520: 509:For example, 507: 478: 476: 472: 467: 465: 461: 457: 448: 445: 442: 439: 438: 435: 432: 428: 425: 422: 421: 418: 415: 412: 409: 408: 405: 402: 399: 396: 395: 392: 389: 385: 383:November 2016 382: 379: 378: 375: 372: 369: 366: 365: 362: 359: 355: 352: 349: 348: 345: 342: 339: 336: 335: 332: 329: 327:November 2022 326: 323: 322: 319: 316: 313: 310: 309: 305: 302: 299: 296: 295: 281: 278: 275: 272: 269: 266: 263: 260: 258: 254: 251: 248: 245: 242: 239: 236: 233: 232: 231: 228: 218: 216: 211: 202: 188: 184: 182: 176: 174: 170: 166: 162: 161:open standard 158: 154: 150: 141: 135: 131: 127: 123: 120: 117: 113: 109: 105: 102: 99: 95: 82: 78: 67: 63: 59: 55: 51: 47: 43: 38: 33: 19: 2443: 2424: 2410: 2363: 2355: 2333: 2319: 2312: 2305: 2298: 2291: 2286:Linux Format 2284: 2272: 2265: 2240:Range of use 2057: 2020:Linux kernel 1939: 1932: 1900: 1783:Free license 1529:Android apps 1287: 1278: 1266:. Retrieved 1262: 1253: 1244: 1235: 1226: 1217: 1208: 1199: 1190: 1181: 1170:. Retrieved 1161: 1151: 1140:. Retrieved 1136: 1126: 1114:. Retrieved 1105: 1094:. Retrieved 1090: 1080: 1069:. Retrieved 1066:TechRepublic 1055: 1044:. Retrieved 1028: 1017:. Retrieved 1007: 996:. Retrieved 986: 975:. Retrieved 961: 950:. Retrieved 926:. Retrieved 921: 912: 901:. Retrieved 891: 880:. Retrieved 876: 853:. Retrieved 849: 840: 829:. Retrieved 825: 816: 805:. Retrieved 795: 786: 777: 766:. Retrieved 762: 753: 742:. Retrieved 732: 721:. Retrieved 691:. Retrieved 674: 663:. Retrieved 652: 621:Fedora Linux 610: 595: 577:GPL-2.0-only 566: 557: 550: 535: 508: 489: 474: 468: 453: 413:October 2013 353:October 2020 279: 273: 267: 261: 252: 246: 240: 234: 226: 224: 212: 208: 199: 185: 177: 156: 152: 148: 147: 110:SPDX Project 97:Organization 49:Abbreviation 2584:Hyperledger 2541:Initiatives 2335:Linux Voice 2321:Ubuntu User 2274:Full Circle 2261:DistroWatch 2134:Lightweight 2048:Kernel oops 2038:Linux-libre 2033:Linus's law 1873:Tivoization 1512:Video games 1487:Mathematics 553:BSD License 540:means that 538:Apache-1.1+ 527:MIT license 443:August 2011 426:August 2012 314:April 2024 306:References 205:Version 3.0 196:Version 2.x 155:, formerly 2599:Categories 1821:Challenges 1539:Commercial 1522:E-commerce 1507:Television 1172:2021-09-02 1142:2018-05-24 1096:2012-08-31 1071:2021-12-01 1046:2021-12-01 1019:2021-12-01 998:2021-12-01 977:2021-12-01 952:2021-12-01 928:2021-12-01 903:2021-12-01 882:2021-12-01 855:2022-06-11 831:2022-11-22 807:2024-05-19 768:2022-11-22 744:2021-08-14 723:2021-08-13 693:2021-08-13 665:2021-08-13 644:References 602:Das U-Boot 546:Apache-2.0 542:Apache-1.1 515:Apache-2.0 340:April 2022 2517:LF Energy 2314:LinuxUser 2280:Linux.com 2172:LinuxChix 1751:standards 1749:Types and 1730:Unlicense 1725:Sleepycat 1559:Community 1091:Dr Dobb's 800:goneall. 360:standard. 274:Licensing 247:Security: 191:Structure 128:CC-BY-3.0 107:Committee 60:Published 2567:Projects 2445:Category 2364:The Code 2351:Phoronix 2341:LugRadio 2225:Embedded 2215:Adopters 2207:Adoption 1970:Category 1887:Related 1768:Copyleft 1688:GNU LGPL 1683:GNU AGPL 1648:Beerware 1643:Artistic 1620:Licenses 1587:Advocacy 1534:iOS apps 1475:Wireless 1470:Graphics 1437:packages 1435:Software 1425:Timeline 1166:Archived 1162:spdx.dev 1116:31 March 763:spdx.dev 627:See also 587:Adoption 400:May 2015 370:May 2020 241:Software 227:profiles 173:metadata 169:licenses 159:) is an 2393:Red Hat 2346:LWN.net 2220:Desktop 2028:History 1896:Forking 1678:GNU GPL 1572:History 1502:Routing 1465:Drivers 1420:Outline 1368:General 1326:LWN.net 1268:30 July 971:LWN.net 877:iso.org 573:GPL-2.0 268:Dataset 133:Website 125:License 89:2024-04 87: ( 72:2011-08 70: ( 2398:Ubuntu 2235:Mobile 2230:Gaming 1960:Portal 1889:topics 1710:Python 1633:Apache 1582:Events 1482:Health 1455:Codecs 1318:GitHub 486:Syntax 464:NTIA's 253:Build: 230:3.0: 115:Domain 57:Status 2579:SONiC 2254:Media 2059:more… 2012:Linux 1735:WTFPL 1445:Audio 1037:(PDF) 683:(PDF) 521:) or 350:2.2.1 337:2.2.2 303:Notes 235:Core: 1740:zlib 1663:CDDL 1638:APSL 1314:SPDX 1270:2023 1118:2020 606:FSFE 544:and 494:and 388:CVEs 311:3.0 280:Lite 153:SPDX 140:.dev 138:spdx 52:SPDX 32:SPDY 18:SPDX 2053:Tux 1705:MPL 1700:MIT 1695:ISC 1668:EPL 1653:BSD 1628:AFL 1316:on 1137:GNU 617:RPM 613:npm 523:MIT 492:AND 440:1.0 423:1.1 410:1.2 397:2.0 380:2.1 367:2.2 358:ISO 324:2.3 183:. 83:3.0 2601:: 1286:. 1261:. 1243:. 1225:. 1207:. 1189:. 1164:. 1160:. 1135:. 1089:. 1064:. 1039:. 969:. 937:^ 920:. 875:. 864:^ 848:. 824:. 785:. 761:. 716:. 702:^ 685:. 506:. 502:, 496:OR 390:). 262:AI 2480:e 2473:t 2466:v 2004:e 1997:t 1990:v 1353:e 1346:t 1339:v 1290:. 1272:. 1247:. 1229:. 1211:. 1193:. 1175:. 1145:. 1120:. 1099:. 1074:. 1049:. 1022:. 1001:. 980:. 955:. 931:. 906:. 885:. 858:. 834:. 810:. 789:. 771:. 747:. 726:. 696:. 668:. 525:( 517:( 504:) 500:( 151:( 91:) 74:) 34:. 20:)

Index

SPDX
SPDY

Linux Foundation
Software bill of materials
spdx.dev
open standard
bills of materials
licenses
metadata
Linux Foundation
Resource Description Framework
software build
ISO
CVEs
cryptographic hash function
software licenses
software vulnerabilities
NTIA's
International Organization for Standardization
Apache License
MIT license
BSD License
GNU General Public License version 2
Das U-Boot
FSFE
npm
RPM
Fedora Linux
License proliferation

Text is available under the Creative Commons Attribution-ShareAlike License. Additional terms may apply.

↑