spdx
What is a .spdx file?
text/spdx
An .spdx file is an SPDX software bill of materials written in the specification's tag-value serialisation: plain-text `Tag: value` lines grouped into a document-creation block, one block per package, and optional file and relationship blocks. It records the document namespace and licence, package names, versions, suppliers, download locations, verification codes, declared and concluded licences, and the relationships that connect packages to each other.
How to use a .spdx file
Use an example .spdx file to test SBOM parsers, licence-compliance scanners, and converters to and from the SPDX JSON and CycloneDX serialisations, checking that relationships and licence expressions survive the round trip.
Download example .spdx files
- SPDX 2.3 Application SBOM (Tag-Value)The same SPDX 2.3 SBOM in the specification's plain-text tag-value form — the serialisation many licence-compliance tools still read first, and the exact twin of the JSON document in this family. Every package, version, hash and licence is fictional — the tree describes nothing real.
- SPDX 2.3 Minimal SBOM (Tag-Value)An SPDX 2.3 tag-value document with only the mandatory document header and a single fictional package — no relationships, no files — for testing that a parser accepts a document with every optional block absent. Every package, version, hash and licence is fictional — the tree describes nothing real.
- SPDX 2.3 SBOM With File-Level RecordsAn SPDX 2.3 tag-value SBOM that descends to file level: two fictional build outputs with SHA-1 and SHA-256 checksums, per-file licence findings, and CONTAINS relationships back to their package. Every package, version, hash and licence is fictional — the tree describes nothing real.
- SPDX 2.3 SBOM Relationship Graph (Tag-Value)An SPDX tag-value SBOM emphasising its relationship block: one DESCRIBES edge and ten DEPENDS_ON edges that form the same two diamonds as the CycloneDX graph fixture. Every package, version, hash and licence is fictional — the tree describes nothing real.
- SPDX 2.3 SBOM With LicenseRef and Compound ExpressionsAn SPDX tag-value SBOM that declares a non-standard LicenseRef with its extracted text and uses it inside compound expressions — the case that breaks compliance tools which assume every licence is an SPDX id. Every package, version, hash and licence is fictional — the tree describes nothing real.
- SPDX Tag-Value SBOM, Truncated — Intentionally CorruptAn intentionally corrupt SPDX tag-value document, cut off part-way through a tag name so the final line has no colon or value. Kept small on purpose. Every package, version, hash and licence is fictional — the tree describes nothing real.
- SPDX 2.2 Legacy SBOM (Tag-Value)The same fictional tree as an SPDX 2.2 tag-value document — the version still produced by older toolchains — for upgrade and compatibility tests against the 2.3 twin in this family. Every package, version, hash and licence is fictional — the tree describes nothing real.
- SPDX Container Image SBOM (Tag-Value)An SPDX tag-value SBOM whose document name is a fictional container image digest rather than an application version — the naming convention image scanners use, and the SPDX counterpart of the CycloneDX container fixture. Every package, version, hash and licence is fictional — the tree describes nothing real.