SPDX 3.0 Update
summary
SPDX 3.0 centralizes a new profiles concept that narrows what metadata a producer must carry (security, safety, AI data, build, licensing, software, core), moves relationships as first-class elements so updates add a relationship instead of recreating an element, replaces package checksums with a content identifier property and exposes package URL as a top‑level element; tooling must adapt to external reference and identity model changes and to expanded checksums and optional element inclusion.
AI-written summary · about
chapters (8)
- 0:00SPDX 3.0 update intro
- 1:26SPDX 2.2 to 3.0 evolution
- 3:12SPDX 3.0 structural changes
- 5:43External document references
- 6:47SPDX 3.0 relationship updates
- 8:14Other SPDX 3.0 changes
- 11:24SPDX profiles concept
- 13:14SPDX 3.0 profiles overview
related talks
07mTooling and Sharing Traceability Discussion
31mSoftware Bill of Materials (SBoM) for dummies
44mStructureDefinition 101
46mIntroduction to Profiling
16mranslate FOSS licenses into code
40mFHIR Profiling: Overview & Introduction
48mThe State of OpenAPI Specification: what's new in 3.1
23mCan Metadata Standards play nicely?