Spdx

Recently Bob Martin and a colleague published the paper "Leveraging SBOMs Throughout the Enterprise SDLC" that examines how enterprises can leverage SBOMs throughout the full Software Development Lifecycle (SDLC) to support risk-informed decision-making,

The OSI has standardized license URLs using SPDX identifiers, while carefully preserving compatibility with the many links that already exist across the web and tools.

The first release candidate for SPDX specification version 3.1 is now available. The SPDX 3.1 model expands beyond software to include safety, service, hardware, supply chain, and operations. Please note that this release candidate is intended for testing

The Python Software Foundation has taken a significant step forward in software supply chain transparency by including SPDX-format Software Bills of Materials (SBOMs) with their official Python releases. Starting with 3.14 released earlier this week, all

The SPDX community is now creating a new list - similar to the SPDX License List - but focused on cryptographic algorithms. This post shares how this effort started, its current status, the next st…

About a month ago, CISA requested industry/community comment on a proposed new minimum set of SBOM elements to replace the original NTIA list. Few people on the planet have thought as much about what belongs in an SBOM than the SPDX tech team which took u

ReARM is a release governance platform: see what

CISA has requested comment on a new set of minimum elements for SBOMs (on top of the original NTiA set). This short announcement describes the process: https://www.cisa.gov/news-events/alerts/2025/08/22/cisa-requests-public-comment-updated-guidance-softwa

In collaboration with NSA and a number of foreign cybersecurity agencies, CISA just just published this easily consumable SBOM vision document. https://www.cisa.gov/sites/default/files/2025-09/joint-guidance-a-shared-vision-of-software-bill-of-materials-f

We just published a readme file at the top level of the repository that provides a great overview of the contents and where to find what. https://github.com/spdx