SPDXcompatible

SPDXcompatible refers to software, documents, or workflows that conform to the SPDX specification for Software Package Data Exchange. SPDX is a standard maintained by the SPDX Workgroup under the Linux Foundation. A document or data item is SPDXcompatible if it uses SPDX concepts such as SPDX license identifiers, license expressions, and a defined SPDX data model to express information about software components, their licenses, copyrights, file provenance, and relationships between components.

SPDX defines a formal data model and serializations (SPDX JSON, RDF/XML, and tag-value) to encode an SBOM (Software Bill of Materials). An SPDXcompatible SBOM enables automated license compliance, risk assessment, and provenance tracking across supply chains.

Key features include the use of SPDX license identifiers (e.g., MIT, Apache-2.0, GPL-3.0-or-later), license expressions combining licenses with AND, OR, WITH, and the ability to declare file-level metadata and relationships (e.g., dependency, contains).

To be SPDXcompatible, a document or tool should: adhere to the SPDX specification version; use valid SPDX license identifiers and expressions; structure data according to the chosen serialization; include required fields such as document name, namespace, creator, creation date, and creator's organization; and be able to validate against SPDX validators.

Applications of SPDXcompatible data include generating SBOMs, feeding license scanners, supporting due diligence in open source governance, and improving supply chain transparency. Tools such as SPDX tools, FOSSology, and the OSS Review Toolkit (ORT) can generate, convert, and validate SPDX data.