Advancing Transparency and Security in Software: A Deep Dive Into SPDXv3
summary
SPDX v3 moves from a monolithic document to a graph-based RDF model with modular profiles (core, software, licensing, security, AI, build, data), and publishes a concrete toolchain that turns markdown spec files into RDF/SHACL, website, and generated Java/Python/Go libraries via CI. It ships roughly 270 entities and enforces type/cardinality checks on commit. The project renames the format to System Package Data Exchange, supports SBOM use for storage as well as exchange, and releases v3.0 (and a minor 3.0.1 update) this year.
AI-written summary · about
chapters (20)
- 0:00Introduction
- 1:52What is SBOM
- 4:23Regulation driving SBOM
- 6:30SPDX evolution principles
- 7:57SPDX governance
- 10:06SPDX history milestones
- 12:16SPDX v3 profiles and graphs
- 15:55From monolithic to modular
- 19:11SPDX v2 vs v3 differences
- 21:42SPDX v3 profiles overview
- 26:15SPDX 270 entities growth
- 28:06SPDX v3 infrastructure
- 31:56Tooling ecosystem
- 33:42SBOM lifecycle views
- 36:11SPDX teams
- 37:13SPDX governance decisions
- 39:01Security integration with VEX
- 40:56Tooling for specification creation and validation
- 44:07Automated CI checks
- 46:15Summary
related talks
16mSPDXv3: Advancing Transparency in Software
53mAdvancing Transparency and Security in Software: A Deep Dive into SBOM and SPDX
28mSPDX: Tackling System Risk in Modern Supply Chains
53mTooling Up for SPDX Software Package Data Exchange
26mSPDX Dashboard
23mCollaborative Project Updates: AGL, SPDX, FOSSology & OpenChain
37mSBOM Implementation Reality: From Crawl to Walk - SPDX Lite Pro...
30mImplementing an AI BOM With SPDX 3.0: Insights From a Real AI4S Project