IT lexicon › Programming › SPDX

SPDX

Programming På svenska → Updated: 2026-11-01

A Linux Foundation standard for describing software packages and their licenses in machine-readable form, best known for its short license identifiers.

Software Package Data Exchange started in 2010 so companies could stop emailing each other license inventories in spreadsheets. Its most widespread part is the identifier list: MIT, Apache-2.0, GPL-2.0-or-later. These combine into expressions like MIT OR Apache-2.0, which is exactly what the license field in npm's package.json expects.

A single SPDX-License-Identifier: line at the top of a source file replaces the whole license header; the Linux kernel started cleaning up thousands of files that way in 2017. The format is also one of the two big ones for SBOMs, standardised as ISO/IEC 5962 in 2021, and read by tools like Syft.

← Back to the lexicon