SPDX FAQ

 

FAQ Sections

General - Kim

-- about the spec and org

Using the SPDX Spec - Mark Gisi

-how to get started, how to use license fields, handling binaries and archives, creator/reviewer fields, license of spec and data in SPDX, using the TM

Licenses - Jilayne

-what is standardlicense list, why does it exist, why aren't certain licenses there, how to handle license variations, dealing with non-standard licenses, how to request adding a license to standard list,

Tools - Kirsten with help from Gary

-what the tools are, how to use, license they are under, contributing to, reporting bugs, steal info from the doc

Technical Details - Kate

-Using Tag value vs RDF, Resources for learning more

 

General

• What is the SPDX Specification?
  • The SPDX Specification enables suppliers and consumers of software that contains open source code to provide a "bill of materials" that describes the open source licenses and components that are included.  The specification defines a common file format to communicate this information.

• Who do you expect to use the SPDX Specification?
  • The specification is designed for use by participants in the software supply chain.  Some potential use cases for the spec:
    • Developers of open source projects could provide an SPDX file to users of that project
    • Linux distros could require upstream projects that are included in the distro to provide an SPDX file
    • Developers of software that includes a Linux distro or open source project could provide an SPDX file to their users or customers
    • In the mobile industry, chipset providers, mobile providers and carriers could exchange SPDX files as software moves through the supply chain

• Am I required to use the SPDX specification?
  • The SPDX organization does not and can not make it a requirement for anyone to use the SPDX specification.  However, we do encourage the use of SPDX as a way to streamline the processes needed to analyze software for open source licenses.  However, there may be companies or organizations that DO require use of the SPDX specification and the creation of SPDX files as part of contracts with their supply chain partners.  For example, a mobile handset vendor might require, as part of a contract, that it's supplier provide an SPDX file along with any software.

• Who created the SPDX spec?
  • The specification is being created by a working group of the Linux Foundation.  Its members represent a wide spectrum of open source creators and consumers, including open source communities, Linux distros, mobile supply chain companies, software companies, makers of open source scanning tools and service providers.  The process is an open process, run much like an open source community, and the group is open for anyone that wants to participate.  Membership in the Linux Foundation is not required to participate.
   

Using the SPDX Spec

• Is an SPDX file associated with a particular version of software?
  • Yes.  An SPDX file is associated with a specific version of software.  When any changes are made to the software, the SPDX file will need to be changed to reflect any changes to the licenses of the respective files.  So, for example, when a new version of a piece of software is released, the SPDX file associated with it would need to be updated to reflect any changes or additions to licensing.
• What information is included in an SPDX file?
  • We refer you to the SPDX specification for complete details, but at a high level, the SPDX file contains license information about each file that is included in a particular piece of software.  For example, the information in the SPDX file indicates what license (if any) is associated with each file.  It may also include information about what open source project or component that file originated from. 
• How do I know if the information included in the SPDX file is accurate?
  • There are several ways to assess the level of trust in an SPDX file.
    • Each SPDX file includes a history of who created and reviewed the information -- similar to what you would see for authors of open source code.  By reviewing that information, you can make your own assessment of the level of trust you place in the creators. 
    • In cases where you receive the SPDX file from a supply chain partner, you may also have separate contractual arrangements whereby a supplier vouches for or guarantees the accuracy of the SPDX file. 
    • You may choose to use software tools that can scan software and validate the accuracy of the SPDX file.
    • You may choose to use software tools that can scan software and validate the accuracy of the SPDX file.
• How does one handle non open source licenses or licenses not found in the SPDX approved license list?
  • When a license is identified in the software package that is not in the list of approved licenses one can add the text to the SPDX file and define a new license label. That license label is defined only for that specific SPDX file.
• How does SPDX work with binaries?
  • License information can be associated with each file regardless of its file type (e.g., binary, source, script and so forth).
• How does one represent a file or package that is dual licensed (i.e., a license choice)?
  • SPDX license information can be represented using conjunctive or disjunctive regular expressions.  For example a file that is dual licensed under either the GPL-2.0 or MIT would be represented using the following disjunctive expression: GPL-2.0 OR MIT. 
• How does one represent a file that is licensed under two or more licenses?
  • SPDX license information can be represented using conjunctive or disjunctive regular expressions.  For example a file that is subject to the Apache-2.0, MIT and GPL-2.0 would be represented using the following conjunctive expression: Apache-2.0 AND MIT AND GPL-2.0.
• The Creator field is mandatory. If my organization does not permit me or my organization to be listed in the Creator field is the SPDX file non-compliant?
  • Although including a value for this field is mandatory one can always chose the value: ANONYMOUS as describe in section 3 of the specification. Use of the ANONYMOUS value would be compliant with the SPDX specification.
• What license is the SPDX specification document available under?
  • The SPDX specification document is available under the Creative Commons Attribution License 3.0. A copy of the license can be found in the appendix of the specification.
• What license is the SPDX file data under?
  • The first version of the specification requires the SPDX file data to be placed under the Open Data Commons Public Domain Dedication and License 1.0 (“PDDL-1.0”).  There are plans to revisit this requirement in future revisions of the specification. See section 2 of the specification for more details.
• Can I share a collection of SPDX files I created with another party under confidential terms?
  • The specification states that although it requires the SPDX data to be available under the Open Data Commons Public Domain Dedication and License 1.0 (“PDDL-1.0”), it does not prohibit one from entering into a confidentially agreement with   another party  where the agreement restricts sharing of the SPDX data. See section 2 of the specification for more details.
• Can I use the SPDX trademark?
  • The SPDX trademark can be used in conjunction with an SPDX file if all the mandatory licenses field requirements have been satisfied.
• This list is a work in progress. To suggest additional questions or provide feedback on existing content please send your requests via email to Mark.Gisi@WindRiver.com with the following Subject: SPDX Usage FAQ feedback.

Licenses (i.e. the SPDX License List)

• What is the SPDX License List?
  • The SPDX License List is a list of well known, commonly-used, and Open Source Initiative (OSI) approved open source software licenses.  The list includes the following fields for each license:
    • The full name of the license
    • A short identifier for use in an SPDX file
    • A url for where the original license can be found
    • Any relevant notes about the license, (such as if its been since deprecated or its relationship to other license)
    • The license text itself
• Why does it exist?
  • The purpose of the SPDX License List is to provide short identifiers for popular and common licenses.  The full license text associated with each license on the SPDX License list will have a unique, permanent URL on the SPDX.org website. Being able to refer to licenses via the short form identifier lessens the SPDX file size and allows for unambiguous license identification.
• How do I identify licenses not on the SPDX License List?
  • The SPDX specification includes a way to identify and include open source licenses that are not on the SPDX License List.  In this case, a short form identifier for the license is created and the full text of the license included in the SPDX file.
• Why are some licenses I've heard of included on the list and some not?
  • The primary purpose of the list is to provide a short form identifier for common or popular open source software licenses.  To create this list, the SPDX legal work group included all the OSI approved licenses and any other license members of the work group had experience with "in the wild."  All versions (even if since deprecated) of these licenses were also included.  It was always contemplated that the list would grow over time, so the initial goal was to provide a sensible starting point such that the most commonly found licenses would have a short identifier.
• How to request adding a license to SPDX License List?
• What if I find a license or license variation that is not on the SPDX License List - how do I identify that license?

 

Tools

• Are there tools available that can help me create, validate or read an SPDX file?

• The SPDX organization is working to create tools that help create, validate or read SPDX files.  In addition, we expect that both open source and proprietary tools will be created to help with these tasks.  See the Tools page for more information.