System Package Data Exchange (SPDX)

Main Website: https://spdx.dev/

This organization houses the primary development activity for SPDX. Use the categories below to find the repositories you are interested in.

Learning about SPDX SBoM and Examples

These repositories are useful if you are looking for more information about how to use SPDX and example SPDX files.

• using - This repository contains long-form text that explains how to use SPDX, or walks readers through various SPDX use cases.
• spdx-examples - This repository contains example SPDX files covering various versions and use cases

SPDX SBoM Tooling

These repository contain SPDX related tools and code bindings, which are useful if you want to produce or consumer SPDX documents.

Python

• tools-python - Python library for dealing with SPDX documents
• spdx-python-model - Low level Python library for reading and writing SPDX documents
• spdx-online-tools - Source for the tools.spdx.org web application

Go

• tools-golang - Go library for dealing with SPDX documents
• spdx-go-model - Low level Go library for reading and writing SPDX documents

Java

• tools-java - Java command line utility for managing and converting SPDX documents
• spdx-java-library - Java library supporting reading, writing, converting, and validating SPDX documents
• spdx-java-* - Support libraries used by the spdx-java-library. Descriptions of these repos can be found in the spdx-java-library API documentation

JavaScript

• tools-ts - TypeScript / JavaScript library for writing SPDX documents

SPDX Licenses

These repositories are related to the SPDX License List

• license-list-XML - The XML Source for the SPDX License List
• license-list-data - The generated content (e.g. Web site, JSON, etc) from the License List XML
• licenseListPublisher - Source for the tool that generates the license list data

SPDX 3 SBoM Model

These repositories define the SPDX 3 SBoM Standard

• spdx-3-model - This is the main SPDX 3 model files. If you would like to modify or extend the SPDX 3 specification, start here.
• spdx-spec - Source for the canonical SPDX specification at spdx.github.io/spdx-spec/. This contains static content like chapters and annexes. For the model files, see spdx-3-model.
• spec-parser - This is the tool that translates the SPDX 3 model files from Markdown to various outputs

Community

These repositories are related to the SPDX Community activities

• meetings - Information about SPDX meetings including schedule, links to join, minutes, etc.
• outreach - Outreach resources for SPDX (e.g. Conference talks, presentations, etc.)
• governance - Governance practices for the SPDX Working Group.