Owner

spdx

26 indexed repositories · View on GitHub

license-list-XML
Source XML and test text files for the SPDX License List

Makefile · 492 stars
spdx-spec
The System Package Data Exchange (SPDX) specification in Markdown and HTML formats.

Python · 385 stars
tools-golang
Collection of Go packages to work with SPDX files

Go · 170 stars
spdx-3-model
The model for the information captured in SPDX version 3 standard.

104 stars
tools-java
SPDX Command Line Tools using the Spdx-Java-Library

Java · 101 stars
ntia-conformance-checker
Validate SPDX 2 and 3 SBOM against NTIA, CISA, and other minimum element requirements.

Python · 91 stars
spdx-online-tools
Source for the website providing online SPDX tools

JavaScript · 74 stars
Spdx-Java-Library
Java library which implements the Java object model for SPDX and provides useful helper functions

Java · 71 stars
spdx-maven-plugin
Plugin for supporting SPDX in a Maven build.

Java · 66 stars
meetings
This repository stores meetings minutes for the SPDX project

44 stars
spdx-license-diff
Chrome/Firefox browser extension to compare text against spdx license list

JavaScript · 42 stars
spdx-license-matcher
A tool to match license text with SPDX license list using a an algorithm with finds close matches. It follows SPDX Matching guidelines to...

Python · 34 stars
LicenseListPublisher
Tool that generates license data found in the license-list-data repository from the license-list-XML source

Java · 23 stars
spdx-gradle-plugin

Java · 22 stars
spec-parser
automagically process the specification

Python · 11 stars
cryptographic-algorithm-list
List of cryptographic algorithms and their characteristics

8 stars
outreach
content for outreach activities

7 stars
spdx-java-jackson-store
JSON storage implementation for the SPDX tools

Java · 7 stars
spdx-python-model
Generated Python code for SPDX Spec version 3

Jupyter Notebook · 5 stars
spdx-java-spreadsheet-store
SPDX Java library spreadsheet storage

Java · 4 stars
6 more repositories live on View on GitHub

Beginner friendly Everything

Open All

[2.3.1] Replace Annex K.2 "Satisfying NTIA" with Annex K.4 "Satisfying 2026 CISA" Open

annex

Difficulty 2/5 1-3 hours Newbie friendliness 72/100

spdx/spdx-spec#1479 · 3 comments · Opened Sep 17, 2026
[2.3.1] Remove Annex A SPDX License List Open

annex

Difficulty 2/5 1-3 hours Newbie friendliness 74/100

spdx/spdx-spec#1478 · Opened Sep 17, 2026
Remove the license entry to each algorithm .yam file Open

bug

Difficulty 2/5 1-2 days Newbie friendliness 72/100

spdx/cryptographic-algorithm-list#92 · 1 comment · Opened Sep 9, 2026
Local (file:) repositories give an invalid download location, and fail the build since 0.12.0 Open

Difficulty 2/5 1-3 hours Newbie friendliness 75/100

spdx/spdx-gradle-plugin#192 · Opened Sep 1, 2026
Add QUDT to References Open

Difficulty 2/5 1-3 hours Newbie friendliness 72/100

spdx/spdx-spec#1470 · Opened Aug 25, 2026
Mark Python-2.0.1, PSF-2.0, CNRI-Python-GPL-Compatible and CNRI-Python as FSF Free/Libre Open

Difficulty 2/5 1-3 hours Newbie friendliness 65/100

spdx/license-list-XML#3073 · 4 comments · Opened Aug 20, 2026
Download URL pattern not compatible with corporate environment with long DNS TLDs Open

Difficulty 2/5 1-3 hours Newbie friendliness 68/100

spdx/spdx-java-model-2_X#79 · 2 comments · Opened Aug 11, 2026
MIT-Modern-Variant is marked as OSI-approved but probably isn't Open

Difficulty 1/5 Under an hour Newbie friendliness 88/100

spdx/license-list-XML#3060 · 1 comment · 3 reactions · Opened Aug 6, 2026
New license request: Qt-LGPL-exception-1.0 Open

new license/exception request

Difficulty 2/5 1-3 hours Newbie friendliness 68/100

spdx/license-list-XML#3057 · 1 reaction · Opened Aug 3, 2026
Correct the EPICS licence text and source reference Open

Difficulty 2/5 1-3 hours Newbie friendliness 85/100

spdx/license-list-XML#3054 · Opened Aug 3, 2026
Update tools-java to > 2.0.7 Open

dependencies

Difficulty 2/5 1-3 hours Newbie friendliness 67/100

spdx/spdx-online-tools#706 · 1 comment · Opened Jul 31, 2026
correct extension from [0..1] to [0..*] Open

Difficulty 1/5 Under an hour Newbie friendliness 90/100

spdx/spdx-spec#1456 · Opened Jul 30, 2026
Delete setup.py at root Open

question

Difficulty 2/5 1-3 hours Newbie friendliness 62/100

spdx/spdx-spec#1443 · Opened Jul 21, 2026
Add PMBOK ref to References chapter Open

definitions profile: operations

Difficulty 1/5 Under an hour Newbie friendliness 68/100

spdx/spdx-spec#1433 · Opened Jul 16, 2026
[3.1-RC1] Editorial cleanup: Model Operations/FunctionalSafety/Hardware (7.4) Open

typo

Difficulty 2/5 Half a day Newbie friendliness 78/100

spdx/spdx-3-model#1401 · 2 comments · Opened Jul 14, 2026
[3.1-RC1] Give the Security profile a fuller, distinct description Open

Profile:Security

Difficulty 1/5 Under an hour Newbie friendliness 78/100

spdx/spdx-3-model#1396 · Opened Jul 14, 2026
[3.1-RC1] Rewrite VerificationType.md for clarity and consistency Open

Profile:FuSa vocabulary

Difficulty 1/5 1-3 hours Newbie friendliness 82/100

spdx/spdx-3-model#1394 · Opened Jul 14, 2026
[3.1-RC1] Give the Service profile a fuller, distinct description Open

profile:Service

Difficulty 1/5 1-3 hours Newbie friendliness 75/100

spdx/spdx-3-model#1387 · 1 comment · Opened Jul 14, 2026
[3.1-RC1] Update the introduction to 3.1 and segment the contributor list Open

doc improvement

Difficulty 2/5 1-3 hours Newbie friendliness 75/100

spdx/spdx-spec#1432 · 3 comments · Opened Jul 14, 2026
[3.1-RC1] Add a 3.1 CHANGELOG entry and fix the site canonical_version Open

documentation

Difficulty 2/5 1-3 hours Newbie friendliness 82/100

spdx/spdx-3-model#1378 · 2 comments · Opened Jul 14, 2026
[3.1-RC1] Unify (or document) the mismatched timestamps in the full example Open

examples

Difficulty 2/5 1-3 hours Newbie friendliness 68/100

spdx/spdx-spec#1422 · 2 comments · Opened Jul 14, 2026
[3.1-RC1] Add RepairAction and ReturnAction to the SupplyChain namespace Open

Profile:SupplyChain

Difficulty 2/5 1-3 hours Newbie friendliness 68/100

spdx/spdx-3-model#1371 · Opened Jul 14, 2026
[3.1-RC1] Add an 'attestation' value to EvidenceType Open

Profile:FuSa vocabulary

Difficulty 1/5 Under an hour Newbie friendliness 88/100

spdx/spdx-3-model#1364 · Opened Jul 14, 2026
[3.1-RC1] Add 'See also' back-links to namespace descriptor pages Open

documentation

Difficulty 2/5 1-3 hours Newbie friendliness 76/100

spdx/spdx-3-model#1363 · Opened Jul 14, 2026
[3.1-RC1] Declare the governing MUST/SHOULD/MAY keyword convention (RFC vs ISO) Open

annex doc improvement style

Difficulty 2/5 1-3 hours Newbie friendliness 68/100

spdx/spdx-spec#1425 · 2 comments · Opened Jul 14, 2026
[3.1-RC1] Fix unclear conformance phrasing Open

serialization

Difficulty 1/5 Under an hour Newbie friendliness 90/100

spdx/spdx-spec#1429 · Opened Jul 14, 2026
[3.1-RC1] Document the 3.0.1 -> 3.1 conformance and backward-compatibility relationship Open

doc improvement URL

Difficulty 1/5 1-3 hours Newbie friendliness 76/100

spdx/spdx-spec#1430 · Opened Jul 14, 2026
[3.1-RC1] Specify programmatic profile-conformance checking via SHACL shapes Open

RDF/OWL/SHACL

Difficulty 1/5 1-3 hours Newbie friendliness 78/100

spdx/spdx-3-model#1348 · 3 comments · Opened Jul 14, 2026
[3.1-RC1] energyQuantity allows negatives Open

Profile:AI

Difficulty 2/5 1-3 hours Newbie friendliness 68/100

spdx/spdx-3-model#1346 · 1 reaction · Opened Jul 14, 2026
[3.1-RC1] cdxProperty 'map' is misleading Open

Profile:Extension

Difficulty 1/5 Under an hour Newbie friendliness 88/100

spdx/spdx-3-model#1345 · Opened Jul 14, 2026
[3.1-RC1] CvssV4 vector string inconsistent with score Open

Profile:Security

Difficulty 1/5 Under an hour Newbie friendliness 88/100

spdx/spdx-3-model#1343 · Opened Jul 14, 2026
[3.1-RC1] VEX self-references to non-existent class names Open

Profile:Security

Difficulty 1/5 Under an hour Newbie friendliness 88/100

spdx/spdx-3-model#1342 · Opened Jul 14, 2026
[3.1-RC1] CreateAction naming error Open

naming Profile:SupplyChain

Difficulty 1/5 Under an hour Newbie friendliness 88/100

spdx/spdx-3-model#1341 · 1 comment · Opened Jul 14, 2026
[3.1-RC1] RequirementVerification.verificationMethod should be mandatory Open

Profile:FuSa

Difficulty 1/5 Under an hour Newbie friendliness 88/100

spdx/spdx-3-model#1339 · Opened Jul 14, 2026
[3.1-RC1] Project.projectContract wrongly mandatory Open

Profile:Operations

Difficulty 1/5 Under an hour Newbie friendliness 88/100

spdx/spdx-3-model#1338 · Opened Jul 14, 2026
[3.1-RC1] TestProcess references a non-existent class Open

Profile:SupplyChain

Difficulty 1/5 1-3 hours Newbie friendliness 78/100

spdx/spdx-3-model#1332 · Opened Jul 14, 2026
[3.1-RC1] Specification summary too narrow Open

Profile:Core

Difficulty 1/5 Under an hour Newbie friendliness 88/100

spdx/spdx-3-model#1329 · Opened Jul 14, 2026
[3.1-RC1] Location vs CountryCodeAlpha3 inconsistency Open

documentation Profile:Core

Difficulty 2/5 1-3 hours Newbie friendliness 68/100

spdx/spdx-3-model#1326 · 1 comment · Opened Jul 14, 2026
[3.1-RC1] PhysicalLocation allows empty instances Open

Profile:Core RDF/OWL/SHACL

Difficulty 2/5 1-3 hours Newbie friendliness 68/100

spdx/spdx-3-model#1325 · Opened Jul 14, 2026
[3.1-RC1] affects relationship broadened Open

Profile:Core Profile:Security relationship

Difficulty 1/5 Under an hour Newbie friendliness 75/100

spdx/spdx-3-model#1321 · Opened Jul 14, 2026
[3.1-RC1] implementedBy direction reversed Open

Profile:Core relationship

Difficulty 1/5 Under an hour Newbie friendliness 72/100

spdx/spdx-3-model#1320 · 1 comment · Opened Jul 14, 2026
[3.1-RC1] Hash-strength guidance Open

Profile:Core vocabulary

Difficulty 1/5 Under an hour Newbie friendliness 84/100

spdx/spdx-3-model#1314 · Opened Jul 14, 2026
[3.1-RC1] Single, authoritative ABNF for license expressions Open

annex license expression

Difficulty 2/5 1-3 hours Newbie friendliness 78/100

spdx/spdx-spec#1435 · 4 comments · 1 reaction · Opened Jul 14, 2026
README: Add notes on C++ version Open

documentation

Difficulty 1/5 Under an hour Newbie friendliness 72/100

spdx/spdx-cpp-model#2 · Opened Jul 8, 2026
Rename model artifacts on github.io to match ones on canonical URLs Open

URL

Difficulty 2/5 1-3 hours Newbie friendliness 75/100

spdx/spdx-spec#1413 · Opened Jul 1, 2026
Update GitHub setting to reject commits without sign-off/DCO Open

documentation

Difficulty 2/5 1-3 hours Newbie friendliness 65/100

spdx/ntia-conformance-checker#404 · 1 reaction · Opened Jun 25, 2026
error in Core diagram Open

diagram ISO conformance

Difficulty 1/5 Under an hour Newbie friendliness 68/100

spdx/spdx-3-model#1290 · 1 reaction · Opened Jun 20, 2026
Conformance points miss profiles Open

ISO publication

Difficulty 2/5 1-3 hours Newbie friendliness 74/100

spdx/spdx-spec#1400 · 1 comment · Opened Jun 20, 2026
Update `rootElement` description to accomodate non-BOM use cases Open

Profile:Core

Difficulty 1/5 Under an hour Newbie friendliness 88/100

spdx/spdx-3-model#1278 · 5 comments · Opened May 27, 2026
Add Tech Asia meeting time/link Open

Difficulty 1/5 Under an hour Newbie friendliness 85/100

spdx/meetings#1106 · Opened May 18, 2026

spdx

Get new issues in your inbox