SPDX (Software Package Data Exchange)
SPDX (Software Package Data Exchange) とは何ですか?
SPDX (Software Package Data Exchange)A Linux Foundation-maintained, ISO/IEC 5962-standardized open format for software bills of materials, originally focused on license metadata and now broadly used for SBOMs.
SPDX (Software Package Data Exchange) is an open BOM standard maintained by the Linux Foundation and ratified as ISO/IEC 5962 in 2021. It originated in 2010 to express software license information unambiguously across the supply chain and has since expanded to a full SBOM format covering components, relationships, file-level hashes, build metadata, security references, and AI/ML models (SPDX 3.0). SPDX SBOMs are typically serialized in JSON, YAML, RDF, or the original tag-value form. Together with CycloneDX, SPDX is one of the two formats explicitly named in U.S. CISA SBOM guidance and is the lingua franca of license compliance tooling — `fossology`, `scancode`, and most enterprise SCA platforms read and write it. SPDX 3.0, released in 2024, modularized the spec into profiles (Core, Software, Licensing, Security, Build, AI, Dataset), making it more competitive with CycloneDX for purely security-focused workflows.
● 例
- 01
A Linux distribution publishes per-package SPDX documents containing SHA-256 file hashes and resolved SPDX license identifiers.
- 02
An OSS project's release pipeline emits both SPDX 3.0 and CycloneDX SBOMs so customers can ingest whichever their tooling supports.
● よくある質問
SPDX (Software Package Data Exchange) とは何ですか?
A Linux Foundation-maintained, ISO/IEC 5962-standardized open format for software bills of materials, originally focused on license metadata and now broadly used for SBOMs. サイバーセキュリティの アプリケーションセキュリティ カテゴリに属します。
SPDX (Software Package Data Exchange) とはどういう意味ですか?
A Linux Foundation-maintained, ISO/IEC 5962-standardized open format for software bills of materials, originally focused on license metadata and now broadly used for SBOMs.
SPDX (Software Package Data Exchange) はどのように機能しますか?
SPDX (Software Package Data Exchange) is an open BOM standard maintained by the Linux Foundation and ratified as ISO/IEC 5962 in 2021. It originated in 2010 to express software license information unambiguously across the supply chain and has since expanded to a full SBOM format covering components, relationships, file-level hashes, build metadata, security references, and AI/ML models (SPDX 3.0). SPDX SBOMs are typically serialized in JSON, YAML, RDF, or the original tag-value form. Together with CycloneDX, SPDX is one of the two formats explicitly named in U.S. CISA SBOM guidance and is the lingua franca of license compliance tooling — `fossology`, `scancode`, and most enterprise SCA platforms read and write it. SPDX 3.0, released in 2024, modularized the spec into profiles (Core, Software, Licensing, Security, Build, AI, Dataset), making it more competitive with CycloneDX for purely security-focused workflows.
SPDX (Software Package Data Exchange) からどのように防御しますか?
SPDX (Software Package Data Exchange) に対する防御は通常、上記の定義で述べたとおり、技術的統制と運用上の実践を組み合わせます。
SPDX (Software Package Data Exchange) の別名は何ですか?
一般的な別名: Software Package Data Exchange, ISO/IEC 5962。
● 関連用語
- appsec№ 1185
ソフトウェア部品表(SBOM)
ソフトウェアを構成するコンポーネント・ライブラリ・依存関係を、バージョンや関係とともに機械可読な形で正式に列挙したインベントリ。
- appsec№ 297
CycloneDX
An OWASP-curated open standard for software, SaaS, ML, and crypto bills of materials, designed from the start for security use cases and now widely used to ship SBOMs alongside releases.
- appsec№ 1328
VEX (Vulnerability Exploitability eXchange)
A machine-readable companion to the SBOM that tells consumers whether a listed CVE actually affects a given product — distinguishing 'present in the bill of materials' from 'reachable and exploitable'.
- appsec№ 1186
ソフトウェアサプライチェーンセキュリティ
ソースコード・依存関係・ビルド・署名・配布・デプロイに至るまで、ソフトウェア製造の各リンクを改ざん・悪意あるコード・完全性喪失から守る取り組み。
- ai-security№ 029
AI Bill of Materials(AIBOM)
データセット・ベースモデル・ファインチューニングデータ・ライブラリ・プロンプト・評価成果物など、AI システムを構成するすべての要素を機械可読でまとめた一覧。セキュリティ・コンプライアンス・説明責任に用いる。
- appsec№ 1082
SCA(ソフトウェアコンポジション解析)
アプリケーションが利用するオープンソース・サードパーティコンポーネントを自動解析し、既知の脆弱性、ライセンス問題、古い・危険な依存関係を洗い出す手法。