SPDX (Software Package Data Exchange).

A Linux Foundation-maintained, ISO/IEC 5962-standardized open format for software bills of materials, originally focused on license metadata and now broadly used for SBOMs. 它属于网络安全的 应用安全 分类。

A Linux Foundation-maintained, ISO/IEC 5962-standardized open format for software bills of materials, originally focused on license metadata and now broadly used for SBOMs.

SPDX (Software Package Data Exchange) is an open BOM standard maintained by the Linux Foundation and ratified as ISO/IEC 5962 in 2021. It originated in 2010 to express software license information unambiguously across the supply chain and has since expanded to a full SBOM format covering components, relationships, file-level hashes, build metadata, security references, and AI/ML models (SPDX 3.0). SPDX SBOMs are typically serialized in JSON, YAML, RDF, or the original tag-value form. Together with CycloneDX, SPDX is one of the two formats explicitly named in U.S. CISA SBOM guidance and is the lingua franca of license compliance tooling — `fossology`, `scancode`, and most enterprise SCA platforms read and write it. SPDX 3.0, released in 2024, modularized the spec into profiles (Core, Software, Licensing, Security, Build, AI, Dataset), making it more competitive with CycloneDX for purely security-focused workflows.

针对 SPDX (Software Package Data Exchange) 的防御通常结合技术控制与运营实践,详见上方完整定义。

常见的别称包括: Software Package Data Exchange, ISO/IEC 5962。