SPDXv3: Advancing Transparency in Software
summary
SPDXv3 defines a graph-based data model and splits the spec into a minimal core plus subject-specific profiles (license, security, build, AI, safety, operations, SaaS, hardware), formalizes multiple SBOM types (source vs deployed), and ships libraries for reading/writing the format rather than end-user apps. SPDXv3 reached release before summer and is moving through ISO update stages, with adopted pieces like SPDX Lite in automotive supply chains and an authoritative license list and planned cryptographic identifier registry.
AI-written summary · about
chapters (12)
- 0:00Introduction and welcome
- 1:02What is an SBOM
- 2:51Regulatory need for SBOMs
- 3:34SPDX background and history
- 5:21SPDX evolution to v3
- 6:31SPDX v3 restructuring
- 7:33Core and profiles in SPDX v3
- 8:16Graph-based data in SPDX v3
- 9:21SPDX profiles overview
- 10:26Static vs dynamic SBOMs
- 11:30Call for participation
- 12:35Q&A on SPDX tools and licenses
related talks
46mAdvancing Transparency and Security in Software: A Deep Dive Into SPDXv3
53mAdvancing Transparency and Security in Software: A Deep Dive into SBOM and SPDX
28mSPDX: Tackling System Risk in Modern Supply Chains
26mSPDX Dashboard
37mSBOM Implementation Reality: From Crawl to Walk - SPDX Lite Pro...
10mSPDX for Better License Statements
53mTooling Up for SPDX Software Package Data Exchange
46mSPDX Generation via Yocto and the New LID code License Scanner