SPDXIdentifiers

SPDXIdentifiers refer to the standardized strings used to identify software licenses and license exceptions in SPDX documents and SBOMs (software bill of materials). They are part of the SPDX specification and are drawn from the SPDX License List maintained by the SPDX Working Group under the Linux Foundation. Each identifier uniquely corresponds to a license text or exception and is intended to be stable across documents and tools.

These identifiers appear in license expressions, which combine tokens with AND, OR, and WITH to express licensing requirements. Examples include MIT, Apache-2.0, GPL-3.0-or-later, and Classpath-exception-2.0. In practice, a document might include an expression like MIT OR Apache-2.0 or GPL-3.0-or-later WITH Classpath-exception-2.0.

The SPDX License List is a curated set of license identifiers and exceptions; each identifier has a canonical name and a reference URL to the license text. New identifiers are added through a governance process, with proposals discussed in SPDX working group forums and tracked in issue trackers and release notes. They are intended to remain stable to ensure reproducibility and interoperability across tools that parse SPDX documents.

Impact and use: In practice, SPDXIdentifiers support interoperability across tooling and processes. Many organizations annotate codebases and generate SBOMs with license tokens; tooling can validate license compliance, detect conflicts among components, and support license disclosure requirements.