SPDX gave every software license one short ID — and became the ISO SBOM format

By 2010, every company shipping software had to track licenses and components, but each tool and team spelled them differently — 'Apache 2', 'ASL 2.0', 'Apache-2.0' — so compliance data could not move between organizations. The Linux Foundation's SPDX project fixed the problem at the identifier layer: a standard data format for a package's components and metadata, plus a canonical license list with one stable short ID per license.

Because the IDs were stable and machine-readable, scanners, auditors and suppliers could exchange software bills of materials without translation. SPDX became the de facto SBOM format and spent a decade in that role across global software supply chains.

On 24 August 2021 the specification was published as ISO/IEC 5962:2021 through ISO/IEC JTC 1. The Linux Foundation framed the milestone as a move 'from a de-facto industry standard to a formal ISO/IEC JTC 1 standard', positioning SPDX for international requirements on software security and integrity across the supply chain.

One canonical short ID per license, machine-readable

Ambiguous license spellings, not legal disputes, were what actually broke automated compliance.

Stable short IDs let any two tools agree on a license without human review.

A decade as the de facto SBOM format meant the ISO stamp ratified practice rather than inventing it.

Component-plus-metadata format served security and supply-chain uses beyond licensing, widening the constituency.

Compliance fails on ambiguity, not intent. Standardizing the identifier — not the legal text — lets tools agree automatically, which is what turns a checklist into an industry format.

ISO/IEC 5962:2021 made SPDX the internationally recognized open standard for software bills of materials, just as governments began demanding SBOMs for procurement. The specification continues to evolve as a freely available ISO standard under the Linux Foundation.