SPDX 3.0 Overview  ## Metadata - Author: [[The Linux Foundation]] - Full Title: SPDX 3.0 Overview - Category: #articles - Document Note: --- tags: - #SPDX - #SBOM - #OpenSourceCompliance Author: Rose Judge, Kate Stewart, Adolfo Garcia, Brandon (Google), Karen Bennett, Jeff Shapiro, Denver Gingrich, et al. Source: SPDX 3.0 Overview Presentation & Transcript Reference: [YouTube Transcript: SPDX 3.0 Overview](https://www.youtube.com/watch?v=J_RzbPMYDMM) date created: 2025-08-22 20:12 --- # Title: SPDX 3.0 Overview – Expanding SBOM Use Cases Beyond Licensing ## Table of Contents: - [📝 Summary](#-summary) - [📖 Main Content](#-main-content) - [🗒️ Notes](#️-notes) - [📖 References](#-references) - [🗣️ Paraphrase](#️-paraphrase) - [📰 Newsletter](#-newsletter) - [✅ Action Items](#-action-items) - [🧪 Hypotheses](#-hypotheses) - [📊 Methodology](#-methodology) - [❓ Questions](#-questions) - [🔮 Future Research](#-future-research) - [💡 Implications](#-implications) - [🧠 Learning Styles Assessment](#-learning-styles-assessment) - [📊 Accessibility Assessment](#-accessibility-assessment) - [🌍 DEIB Assessment](#-deib-diversity-equity-inclusion-belonging-assessment) - [✅ Logical Validity](#-logical-validity) - [🔍 DARVO Analysis](#-darvo-analysis) - [🔍 SEO Evaluation](#-seo-evaluation) - [🎯 Conclusion](#-conclusion) --- ## 📝 Summary: The session provided an **overview of SPDX 3.0**, the latest iteration of the Software Package Data Exchange specification. While SPDX has traditionally been associated with open source license compliance, this new version expands into **security, AI/ML datasets, safety-critical systems, and SBOM lifecycle transparency**. Speakers highlighted: - The **need for coherence** across licensing, security, and data transparency. - **Integration with OMG CISC** to ensure SBOMs can be used across data lakes. - Simplification via SPDX Lite for minimal compliance needs. - A more modular design with **profiles** (licensing, security, AI/ML, build, usage). - Recognition of SPDX as an **international ISO standard**, with 3.0 to follow. - Clearer delineation of SBOM types: **design, source, build, deployed, runtime**. The goal: **trustworthy, interoperable SBOMs** that improve compliance, safety, and security across the software lifecycle. --- ## 📖 Main Content: SPDX 3.0 responds to industry needs beyond licensing, embracing **software transparency as a whole**. This version enables: - **Profiles for specific use cases**: security, licensing, AI, ML, build, deployment. - **SBOM lifecycle mapping**: design → source → build → deployed → runtime. - **Data lake compatibility** for querying and scaling SBOMs. - **Serialization and schemas** for tooling and automation. - **ISO trajectory** after field testing for maturity. The core theme: enabling interoperability and trust through **factual, structured recording of software components** at each lifecycle stage. --- ### 🗒️ Notes - [00:04](https://www.youtube.com/watch?v=J_RzbPMYDMM&t=4): Introductions from VMware, Google, IEEE, BBC, Linux Foundation, SFC, Oracle, Bloomberg, Air Force. Broad cross-sector involvement shows SPDX’s centrality. - [08:39](https://www.youtube.com/watch?v=J_RzbPMYDMM&t=519): Motivation for SPDX 3.0 – handle security, AI, datasets, safety-critical systems. - [10:53](https://www.youtube.com/watch?v=J_RzbPMYDMM&t=653): Collaboration with OMG CISC → no duplicate SBOM standards. Data lakes targeted. - [12:52](https://www.youtube.com/watch?v=J_RzbPMYDMM&t=772): Transition to multi-package docs and hierarchies. Release candidate now live. - [14:53](https://www.youtube.com/watch?v=J_RzbPMYDMM&t=893): Shift from text specs → model-first approach. JSON schemas, Python tooling. - [16:47](https://www.youtube.com/watch?v=J_RzbPMYDMM&t=1007): Industry consensus on SBOM types: **source, build, design, deployed, runtime**. - [18:53](https://www.youtube.com/watch?v=J_RzbPMYDMM&t=1133): Factual recording emphasized → avoid guesswork → stronger trust in SBOMs. - [20:37](https://www.youtube.com/watch?v=J_RzbPMYDMM&t=1237): Deployed SBOMs track live systems over time → key for **safety + compliance**. --- ## 📖 References: - SPDX Specification: [https://spdx.dev](https://spdx.dev) - OMG CISC collaboration notes - CSAF SBOM type definitions (source/build/deployed/runtime) - ISO/IEC 5962:2021 (SPDX v2.2.1 international standard) --- ## 🗣️ Paraphrase: **Original (Kate Stewart):** “We’ve heard for years: it’s too complicated, I just want the SBOM. SPDX 3.0 makes it simpler with Lite, while still enabling deep profiles for licensing, security, or AI.” **Paraphrase:** Many developers asked for streamlined SBOMs without heavy licensing overhead. SPDX 3.0 delivers SPDX Lite for minimal needs while offering profiles to scale for advanced scenarios like security or AI datasets. **Original:** “The more times we record facts instead of guesses, the more useful these documents will be.” **Paraphrase:** Trust in SBOMs comes from recording verifiable data at each lifecycle stage—SPDX 3.0 prioritizes fact-based documentation over assumptions. --- ## 📰 Newsletter: 📦 **SPDX 3.0: Beyond Licensing** SPDX just dropped a major update—**version 3.0**—and it’s more than a compliance tool. Think security, AI datasets, safety systems, and real-time deployment tracking. 🔑 Highlights: - New **profiles** for licensing, security, and AI. - SBOM lifecycle support: design → source → build → deploy → runtime. - Collaboration with OMG = **one SBOM standard, not many**. - SPDX Lite for when you just need the basics. This isn’t just paperwork—it’s **trustware**. Whether you’re shipping WordPress plugins, building AI, or working on defense systems, SPDX 3.0 is shaping how we prove what’s inside our code. 👉 Learn more: [spdx.dev](https://spdx.dev) --- ## ✅ Action Items: - Frame SPDX 3.0 in **WordPress + OSPO advocacy** as part of sustainable open source governance. - Highlight **SBOM lifecycle mapping** as analogous to **contributor lifecycle management**. - Advocate for **profiles in WordPress tooling** (security profile = plugin scanning, AI profile = dataset curation). - Position SPDX adoption as part of **future OSPO director leadership vision**. --- ## 🧪 Hypotheses: - H1: SPDX 3.0 adoption increases SBOM trust in regulated industries (defense, healthcare). - H2: SPDX Lite accelerates adoption in small dev shops. - H3: Profiles improve cross-sector collaboration between security, compliance, and AI teams. ### 📊 Methodology: - Comparative case studies (SPDX v2 vs v3 adoption). - Surveys in OSPOs and enterprises about SBOM usefulness. - SBOM validation experiments (fact vs guess recording). ### ❓ Questions: - Will SPDX 3.0 unify fragmented SBOM standards? - How can SPDX profiles be integrated into WordPress core/plugin ecosystem? - What incentives drive SBOM adoption outside compliance-heavy industries? ### 🔮 Future Research: - Study SBOM role in **AI dataset transparency**. - Explore SBOM use in **continuous deployment pipelines**. - Map SBOM adoption to **open source sustainability metrics**. ### 💡 Implications: - Broader use of SBOMs strengthens **software supply chain resilience**. - Open source communities adopting SPDX 3.0 can **demonstrate maturity** → attract funding/support. - WordPress ecosystem could benefit from SPDX Lite for plugin/theme compliance. --- ## 🧠 Learning Styles Assessment: - Visual: Diagrams of SBOM lifecycle mentioned, but not shown. Needs infographics. - Aural: Lacked podcast/audio recap → could improve. - Verbal: Rich examples; technical but readable. - Kinesthetic: Developers urged to test release candidate. - Logical: Strong lifecycle mappings; schemas. - Social: Collaborative intros and Q&A. - Solitary: Lite docs + GitHub issues available for private exploration. - Naturalistic: Absent; could use sustainability framing. Readability: College-level (12th+). --- ## 📊 Accessibility Assessment: - No alt text in transcript; slides may lack accessibility features. - No explicit screen reader guidance. - Markdown spec helps with machine readability. - Suggest: WCAG review for spdx.dev + schema docs. --- ## 🌍 DEIB (Diversity, Equity, Inclusion, Belonging) Assessme - Summary: The SPDX community is working on version 3.0 of their standard. The motivation behind this is an interest in using SPDX for non-licensing scenarios, such as security, and supporting AI and machine learning. They are trying to make it simpler to access and use by including the profiles that users care about, and they have added an arbitrary hierarchy and serialization of the model, with examples available for people to view. The release candidate model is out now and the group is looking to get feedback from the community as they continue to develop it. - URL: https://www.youtube.com/watch?v=J_RzbPMYDMM&ab_channel=TheLinuxFoundation I think we're going to do a quick roundof introductions just so we're aware ofwho's in the room my name is Rose judgeI work at VMware I'm on the spdxsteering committee and I've been workingon the spdx security profilemy name is Adolfo Garcia I am a softwareengineer with Junior and I'm contributorto spdx but also maintaining a bunch ofother S1 toolsawesome hi I'm Brandon I'm a software engineer at Google I helped maintain thegolang tools SPX Library as well as helpwith the build profile and also a songalong with Adolfo also helping buildsome tools around s-bombs and ecosystemhi I'm Karen Bennett I representing IEEEbut I also work in building AI models for the last six years for autoself-driving carssoftware engineer at the BBC on smart TVappsum here to learn about sbdxhey there um David Buckhurst also fromthe BBCum so I guess me and Tom are the closestto an ospo that that we have so uh soyeah um but we're yeah looking to sortofgive that more uh more emphasis so yeah really interested in thismorning I'm Steve colbain I'm not at theBBCum I work for Analog Devices I'm mainlyinvolved in opengain and I'm here justto learn much more about spdxr sbx3 ingeneral okayhi my name is Jordium uh and I'm the spdx marketing managerwho are happy to elevate everyone'svoice from the ecosystem that iscontributing or just wanting to learnmore about spdx hi my name is soin Kim I'm ospo in AIGelectronics and I have many interestedin spdxhello I'm Jeff Shapiro I'm with Linuxfoundation and I do lots and lots oflicense scanningoops let's throw back this wayhi my name is Aaron refit I'm atCarnegie Mellon University um I primarily work with federalgovernment and I'm just interested wellthey're rolling out as bomb swag crazyright now so I'm learning about thetoolingo system to help them do theirjobs betterhi I'm Denver Gingrich director ofcompliance at software Freedomconservancy and I'm curious to see howspdx can help with compliance andespecially to see how we can make surethat some of the other parts of thecopyleft licenses can be upheld through some of the work spdx is doing socollaboration there thanksgood morning I'm a material solo I'mpart of the reproducible built Communityespecially working in producers inDebian I'm here to learn more about spdxand how it's evolving andif we can do something together maybepossiblyhello my name is Mark easy I'm with WindRiver systems I'm head of the opensource program office and I've been using spdx since 2012.we've been delivering I guess bombs toour customers since then and I'm alwaysinterested in seeing how it's evolvinghello I'm to Medford from Bloomberg andapparently been nominated by a bunch ofpeople can raise their hands who alsofrom Bloombergwe are part of a group that help withour software supply chain effortsinternally looking to how we canleverage spdx more and also contributebackforeignhello I'm Kevin Connor I was with red hat I'm now unfortunately an employee soI'm here as an independent I've done afair bit of work with Cyclone DX ands-bombs they're now here to learn aboutspdx and strengthen my knowledge of thatso thanks very much I'm also from herein Vancouver I just live on the NorthShore so I enjoy the scenery every dayyeah that'll be greatum hi everybody I'm Vinita gear umI'm Samchandanhi I'm AkshayLisaI also work at Bloomberghi I'm Nisha I work for Oracle I havebeen a contributor to spdx for a whilenow and also a maintainer with rose and Adolfo and Brandonso Imiss you oh thank youuh nice to meet you uh I'm noriel fromuh I am a hospital staff in Sony grouppopulation and I'm participating uh openchange Japan working group andcontributed to uh spdx light or next sorry I forgot use usage profile usageprofile to your spdx version 3.0 nice tomeet youopen source program office and I'm alsoworking with the spdx sp6 right from theopen chain Japan work groups so I'mreally happy to join this discussionthank you hi hi my name is from Japan I am workingfor a company named Solutions and I'mworking for open source management thankyouand thank youhi everyone my name is ayomi WatanabeI'm working for heated Solutions Japanand I am a ID Consultant and who is uhhelping Japanese companies to use andunderstand the open open sourcecompliance and the openopen source management and especiallyfor spdx so thank you very much nice to meetyou everyonehi my name is Dan I'm an open sourcemaintainer and developer in a number ofdifferent projects and we've justrecently implemented the spdx sourcecode tags on one of our projects andwith some outside prompting so I'm hereto learn a little bit more about what wecan do to help Downstream usershi my name is Alex Wright I'm with theUnited States Air Force and I'm here to learn about the next upcoming standardof spdx andfurthering our spam effortsthank you very much I'm Kate Stewart andI've been pretty much with spdx sincethe start of itum and so we're here to sort of talkabout what's coming down the pipe andget your input and hopefully help getthe tools so with that I'll move it overto Rose and okay so just a quick agenda so you allknow what to expect Kate's going to giveus an spdx 3.0 overview and then Steveand Jeff are going to give us anoverview of the license compliance usecases with spdx 3.0 Adolfo and I aregoing to go over security use cases forspdx 3.0 and then Karen and Gopi ormaybe just Karen I'm not sure are goingto go over how to utilize spdx for AI use casesum Brandon maybe Nisha two okay aregoing to cover the build profile for usand then Gary who is arriving shortly isgoing to wrap it all up by kind ofsummarizing the differences between 2.xand 3.0at 10 30 we're going to have a groupphotoand then we'll let discussion followafter that so possible discussion topicsare the transition paths for tools and um if you have any questions concernscomments please bring those up and we'dlove to discuss those so I'm going toturn it over to Kateyep thanks and if people have aoopsthanks and if people have topics thatthey want to see you know please writethem down also we're trying to collectso those who are watching this remotely we have a getter roomand if you want to basically put yourquestions in the get a room someone inhere will be keeping an eye probably mewe'll be keeping an eye on it and thenI'll raise them on your behalf so thatwe can have a little bit ofinteractivity not a lot but at least alittle bit and so like I say there isthe app getterm and then the lobbyhopefully you can catch that we'll bringit back up again lateryeah so with that talking about 3-0 andwhere we're going with itso why are we doing 3-0 well there's been a lot of interest inusing spdx for non-licensing scenariosthat being said we want to make sure weare coherent and stay you know true tobeing able to support all the licensingscenarios so but getting the securityand some of the needs for safetycritical systemsum I'll be able to be represented wasone of the motivators also we're seeinga tremendous surge in AI in fact westarted working on this over a year agoif not longer and on data sets and how we can get the transparency for thosebecause the similarly as you compile andbuild an application you're creatingyour trained models and the informationthere could have vulnerabilities couldhave licensing issues all of thesethings at spdx is good at representingso we want to be able to extend them onfor thatand there was efforts going on for doingwork on s-bombs at the OMG cisc effortsand so I guess about two years ago wecombined forces with them to make sure what we were coming up with was going towork for both communities so not yetanother s-bomb we actually tried to veryadjust on the spdx side as well as onthe OMG side so we had something thatwould work for both groups the OMG ciscefforts were very much focused on dataLakesand moving so that they could representthe information in a data like and queryitum and so this is part of the mainDirectionwe've been going forand then you know there's a lot of theother piece of critique we've heard um through the years isum oh it's too complicated how do Icarry the licensing information I justwant the straight s bomb stuff I justwant a component and I think well youcould do that today however making itvery simple to see was part of it somaking that the minimum easy to justbasically access and use was a motivatorhere on what we've been working on andthen being able to include the profilesyou care about like licensinglike security like the AI and ml the assets build usage these are scenariosthat people have brought to us use casespeople have brought to us that we'retrying to basically make sure we cansupportso just to give you guys a bit of ahistory we've been around for quite awhile as you can seeumone of the big transitions was between1.2 and 2.0 so we've gone through abreaking change before as a communityand there we basically went to enable anarbitrary hierarchyand the documents and so forth and so that was one of those shifts so some ofthe things that we've learned from thatlesson we're trying to make sure weapply this time around as we're goinginto 3-0we basically added the spdx Lite againthinking that people just wanted to havethe minimum set at one point in timethat got added in and then we took thatto ISOso spdx is an international standardand has been recognized as such and hasgone through the extralevel of scrutiny to make sure we couldactually do thatwe will be taking the 3-0 work after it matures a bit in the field back to ISOas well okay but we have to basicallybecause there's so much um so many newuse cases so much thing we want a littlebit of experience to make sure we've gotit right so it'll either be 3-0 or threeone we taketo it but we want to do a little bit ofbaconin practice with the tools andeverything else before we go however wewill be releasing the three ofum spec Etc this year the 3-0 modelrelease candidate is out now as of lastweekend so if you want to get a feel for what'shappening with spdx now that you canlook at that modeland understand the classes theproperties the vocabularies how this isall fitting togetherand so just to sort of talk a bit aboutitumliterally we went from a 1.2 where itwas just one package perum document effectivelyso allowing multiple packages perdocument and having an arbitraryhierarchy that was a significant change for us at the timeum you know other systems that are outthere right now for s-bombs are sort oftalking in this type of modeum and the terms of like one package perthing it's only one thing in this justthe dependenciesand so we learned from our communitiesthat we need to be able to have multiplescenarioswe also initially had it in a Google aGoogle Docs effectively and word docswas how we wrote Our spec initially andthen we would generate a modelunderneath from thatwe moved out over to being in markdown up on GitHub so we had much more closertracking of it and so that happened inthe 2.1 to 2.2 release I think actuallyum and then from that is what we went toISO withwith the two two one oops let me go backand now and now we're here in this realwith that release candidate modeland we are working towards the next stepright now is we're going to beserializing itand getting serializations out from the modelso that people can sort of see the filesand so forth there's a lot of examplesright nowalready in play and there'll be moreshowing upum and then the specification will beavailable so before we used to do thespecification then put the model we'vechanged the order right now we're havingthe model out there and then thespecification will be generated in amore readable fashionso this at this point in time it's verymuch oriented towards tools and peopleworking on tools because these schemaswill be there and you should be able tobuild from that and then eventually we'll try to go forISO submission after we get that butthat's a flow we're aiming towards rightnowsoum the specification as you say is beingtransformed it used to be straight textit's now being in markdown and we'realso having the classes properties andenumerations or vocabulariesthe metadata is there for each elementand will be basically automaticallygenerating schemas now so there's apreliminary Json schema sitting there and we've been working on the pythontools as we've been sort of finalizingthis stuff so there will be a pythonLibraryout there for people to play with in thenext week or twoum at least to start playing with anyhowand then we'll be adding more of theformats generation after thatand it's these profiles the way to workwith them is if you care about them youindicate you want to use it and thereare certain things that are mandatoryand things that are optional and thoseproperties are available to you all theproperties that are in spdx are available to you but there's certainones that the schemas wouldautomatically checkif you've indicated you want to befollowing a profileand so there's a link to the modeland that's what we to want to focuspeople at and focus people at makingthings more interesting at issues andpull requests right now are very muchwelcomeas we try to get this hardenedso just to Source you knowwhat we sort of did is we found with to the 2x we found the full normal modelreally helped us enable the transitionbetween formats we're using the samething that's why we're doing the modelapproachand with Riowe're basically looking at having thesame sort of thing between the formatsbut we're adding in support for dataLakesan addition s-bomb documents and formatsso there's different types of s-bombsthat they're included hereso some of you may have seen that csappublished at CIS out of the US publishedthis um set of types of s-bombswhich is where the type of informationis availablethe licensing people have historicallyhave focused mostly on the sources-bombssorrysecurity people have focused on thesorry about that just getting over a coldsecurity people have focused mostly onthe build as bombsso if you have a security people talkingabout a sponsor usually thinking buildif you have licensing people an osbosdks bombs they're mostly talking sourceand so we needed a way of basically sitseparating these use cases outand so there was an industry group thatgot togetherconvenusand we word Smith for six months onthese definitions um and so we've got some degree ofconsensus and all the people who havesigned off on these definitions are apretty wide swath of the industryso you can go to that link at the bottomin the slidesand or just go into CSA s bombum site and then you'll find thereference to this it came out on the21st of last monthalong with a Vex document too which I'msure Adolfo will reference at some pointum but build and Source are really what's outthere todaydesign is going to be really usefulfor safety and requirements requirementscatching things like thatthere's work going on there deployed isonce you've actually configuredsomething and putting on a systemrecording itand understanding what you've put on asystem and recording it as it's inprogress now each of these types ofs-bombs can refer backto others in thereokay I think that's important to understand an s-bomb isn't just one ineverything we learned that lesson beforeand we've got very clean mechanisms forlinking from one type of s-bomb toanother type of s-bomb to refer to theinformation so you can generate theinformation where it is locallyum and these most are around life cyclehowever historically someone may take aI've got this binary I want to try tounderstand what's in it you may need ananalyzed onebut we see this merging pretty muchthrough the ecosystem so I just want youto be aware of this because you'll start to see people talking about itand it sort of maps pretty well to asoftware life cyclein thatYour Design is happening when you'redoing your planningyour Source s-bombs usually arehappening on procurement and developmentyour build s bombs or your build testand release that's when they'regenerated because that's where theinformation is at the heart of it that'swhere you actually have facts as opposedto guessesand the more times in this ecosystem wecan record facts rather than guesses the more we're gonna be able to trustthese documents to be useful in thesystemand then okay hey you've got yourrelease you've got your release oh I'myou've given it to a customer heythey're going to deploy itum well the courthouse they were goingto deploy it that's effectively adeployed s-bomb we don't see a lot ofthat todayI think we're going to see more and moreof that and certainly from the safetyside we're going to need it and then ohhey I've got this system it's beenchanging out from underneath me overtime I want to look and see what'sactually showing up so this guy may be called an instrumentit as bomb or something like that butit's a way of summarizing what isactually running on a systemand being able to compare it to what youthink it should be running on the systemwith the deployedso a deployed s-bomb could referactually a runtime is function refer toa couple deployed the deploy that couldrefer to a build the bill could refer tothe sourceand the design could sort of basicallybe pointing at all of them so there'sgoing to be some interesting new usecases being shown up by this but this isa pretty powerful mechanism and that it will let us represent these safety usecases we're trying to aim for, SPDX 3.0 Overview, The Linux Foundation, 01h2xa3nxrbvwcqyzf6gmjwrf0.