What is SPDX?

SPDX is a format for describing what is inside software and where it came from. The project's overview page says it covers provenance, license, security, and other related information about software components. It offers common formats that are both machine-readable and human-readable, and it focuses on collecting facts and providing a way to make assertions about them.

Part of the project is the SPDX License List, which the page describes as covering license identifiers, license exceptions, matching guidelines, and the syntax for license expressions. The page says SPDX makes no legal interpretation of licenses or compliance, so the data records facts and does not give legal conclusions.

The page states that SPDX is recognized as an international open standard under ISO/IEC 5962:2021. SPDX is an open source project hosted by the Linux Foundation. The page describes a grass-roots effort that includes representatives from software, systems and tool vendors, foundations and systems integrators, with work done by technical, legal and outreach sub-groups.