Glossary

SPDX

What Is SPDX?

SPDX (Software Package Data Exchange) is an open standard, maintained by the Linux Foundation, for communicating software bill of materials information — including component identifiers, versions, licenses, and supplier details — in a machine-readable format.

SPDX is one of the two dominant SBOM formats (the other being CycloneDX). It is referenced in U.S. federal guidance and widely adopted in enterprise software supply chain workflows. NetRise Turbine produces SPDX-formatted SBOMs from binary analysis and normalizes detected licenses to SPDX identifiers for consistency across tools and policies.

Related Terms

Software Bill of Materials · CycloneDX · NetRise License Intelligence · Open Source Software

Software Supply Chain ConceptsVulnerability Exploitability eXchange (VEX)VEX is a standardized format for communicating whether a vulnerability in a software component is actually exploitable in a given product — filtering noise from risk.Read definition
Software Supply Chain ConceptsSoftware MaintainerA software maintainer is the individual or group responsible for an open-source project's code, releases, and direction — its stewardship over time.Read definition
Software Supply Chain ConceptsDirect DependencyA direct dependency is a software component an application explicitly declares in its own manifest or source — chosen by the developer, not pulled in downstream.Read definition

SPDX

What Is SPDX?

Related Terms

Related Content