SPDX Dashboard
summary
SPDX tooling set centers on command-line Java utilities that convert between formats, validate documents, and produce human-readable output: SPDX tag-value ↔ RDF translators, an HTML/text viewer, and a two-way spreadsheet importer/exporter that roundtrips edits back into RDF/tag formats. A comparison tool produces color-coded spreadsheets and implements license comparison/tokenized matching against SPDX license guidelines. Libraries expose an SpdxDocument model, offline license caching, and verification routines; commercial adopters include Black Duck, Source Auditor and Protecode. The tag-value parser needs a maintainer and the ecosystem survey shows many production scanners adding consumption/import features.
AI-written summary · about
chapters (14)
- 0:00Intro
- 0:31SPDX Tools
- 7:07Contributors
- 7:56Validation
- 9:20Comparison
- 11:52Value Translator
- 13:45License Libraries
- 16:11SPDX Document
- 17:23Whats next
- 18:58Git repository
- 19:44Tools
- 20:45Summary
- 23:04Pathology Tools
- 23:18Integration Tools
related talks
10mSPDX for Better License Statements
16mSPDXv3: Advancing Transparency in Software
46mSPDX Generation via Yocto and the New LID code License Scanner
46mAdvancing Transparency and Security in Software: A Deep Dive Into SPDXv3
28mSPDX: Tackling System Risk in Modern Supply Chains
53mAdvancing Transparency and Security in Software: A Deep Dive into SBOM and SPDX
41mThe SPDX License List: What, Why and How
29mAuto Generate SBOMs for Your Open Source Project Written in Any Language Running on Any Platform