Linux Foundation Organization the new edition of the standard (Software Package Data Exchange), offering a set of specifications for the publication and exchange of information about licenses and intellectual property rights. The specification allows you to specify not only the overall license for the package but also to define the licensing specifics of individual files and fragments, indicate the owners of property rights to the code, and those involved in reviewing its licensing compliance.
SPDX provides a detailed map of the intellectual property used in a package, enabling quick assessment of potential risks, identifying possible incompatibilities, and familiarizing yourself with the terms of use imposed by the license. With SPDX, manufacturers of consumer devices can ensure full compliance with open licenses in their products and identify licensing discrepancies in firmware that uses a mix of both open-source and proprietary applications. The format is optimized for automated processing, but utilities are also provided to convert SPDX files into a human-readable representation.
In expanded the number of scenarios with SPDX application examples, offered new formats for SPDX documents (JSON, YAML, XML), added new types of dependency bindings, included fields to reflect the authorship of packages, files, and code snippets, introduced new PURL (Package URLs) and SWHIDs (Software Heritage Persistent Identifiers), presented a simplified SPDX Lite format, provided the ability to specify shortened license identifiers in files, and added support for multi-line expressions for defining licenses.
Source: opennet.ru
