SPDX

SPDX (Software Package Data Exchange) is an open standard for describing the contents of software: its components, their origin and licenses, and related security information. It's hosted by the Linux Foundation and published as the international standard ISO/IEC 5962:2021 (SPDX overview).

What it is

The project has three parts:

• The specification, used to write SBOMs. SPDX 3.0 was released in 2024.
• The SPDX License List: standard short identifiers for licenses and exceptions, such as MIT or Apache-2.0, plus an expression syntax for combinations like MIT OR Apache-2.0.
• Tools and libraries that read, write and check SPDX documents.

SPDX and CycloneDX are the two common SBOM formats. Many tools can write either.

Why it matters

The license identifiers are used far beyond SBOMs: package manifests, source file headers and license scanners all use them. A shared name for each license is what lets a policy say "no GPL-3.0" and have tools enforce it.

In AI CodeOps

AI CodeOps doesn't generate SBOMs. You record the SBOM your build produces against a project, in CycloneDX or SPDX format, with a license summary. A license policy in the release gate lists license IDs you don't allow; they're matched exactly, ignoring case, against the licenses in the project's latest SBOM. Compound expressions aren't parsed, so list each identifier you want to block.