Definition

SPDX

The Linux Foundation's SBOM standard, published as ISO/IEC 5962, common in licence compliance and distribution workflows.

Software Package Data Exchange, an open standard for communicating SBOM information — components, licences, copyrights, security references and relationships — maintained by the Linux Foundation and published as ISO/IEC 5962:2021. Available as JSON, tag/value, YAML and RDF. GitHub's dependency graph exports SPDX JSON per repository. Vellaci ingests SPDX 2.2–2.3 in JSON and tag/value form.

Reference: ISO/IEC 5962:2021; SPDX specification · Regulation (EU) 2024/2847 on EUR-Lex

Updated 2026-09-12 · Paraphrase for orientation, not legal advice.