SPDX becomes internationally recognized standard

3 years ago 409

In usage for a decennary arsenic the de facto modular for communicating bundle bills of materials, SPDX formally becomes the internationally recognized ISO/IEC JTC 1 standard.

The Linux Foundation announced Thursday the Software Package Data Exchange (SPDX) specification has been published arsenic ISO/IEC 5962:2021 and recognized arsenic the unfastened modular for security, licence compliance and different bundle proviso concatenation artifacts.

Software bills of materials are utilized to pass accusation successful policies oregon tools to guarantee compliant, unafraid improvement crossed planetary bundle proviso chains.

"SPDX plays an important relation successful gathering much spot and transparency successful however bundle is created, distributed and consumed passim proviso chains," said Jim Zemlin, enforcement director, the Linux Foundation, successful a property release. "The modulation from a de-facto manufacture modular to a ceremonial ISO/IEC JTC 1 modular positions SPDX for dramatically accrued adoption successful the planetary arena. SPDX is present perfectly positioned to enactment planetary requirements for bundle information and integrity crossed the proviso chain."

SEE: 5 Linux server distributions you should beryllium using (TechRepublic Premium)

ISO/IEC JTC 1 is an independent, non-governmental planetary enactment based successful Geneva, Switzerland.

Because astir applications contiguous are assembled utilizing unfastened root software, a SBOM accounts for the bundle components contained successful an exertion and details their provenance, licence and information attributes. This accounting helps organizations way and hint components crossed the bundle proviso concatenation truthful they tin place issues, risks and found starting points for their remediation if necessary.

The transparency provided by an SBOM is peculiarly adjuvant successful thwarting cyberattacks, said Kate Stewart, vice president of Dependable Embedded Systems astatine the Linux Foundation.

"An SBOM makes it easier to summarize the bundle that is really moving connected a system," she said. "Improving the transparency of the bundle moving connected a system, enables automatic detection if determination is simply a vulnerability and transverse references to vulnerability databases connected an arsenic needed basis."

SPDX evolved organically implicit the past 10 years done the collaboration of hundreds of companies, making it the astir mature and adopted SBOM standard, the Linux Foundation said.

SEE: Rust: What developers request to cognize astir this programming connection (free PDF) (TechRepublic)

The caller modular volition marque proviso concatenation licensing compliance easier, arsenic well, due to the fact that unfastened root tools similar FOSSology, ORT, scancode and sw360 already enactment SPDX, said Oliver Fendt, elder manager, unfastened root astatine Siemens, successful a statement.

"SPDX is the indispensable communal thread among tools nether the automating compliance tooling (ACT) Umbrella. SPDX enables tools written successful antithetic languages and for antithetic bundle targets to execute coherence and interoperability astir SBOM accumulation and consumption. SPDX is not conscionable for compliance, either; the well-defined and ever-evolving spec is besides capable to correspond information and proviso concatenation implications. This is incredibly important for the increasing assemblage of SBOM tools arsenic they purpose to thoroughly correspond the intricacies of modern software," said Rose Judge, ACT TAC seat and unfastened root technologist astatine VMware, successful a statement.

Information connected however to enactment successful and payment from SPDX tin beryllium recovered astatine https://spdx.dev. More accusation connected however companies and unfastened root projects are utilizing SPDX, tin beryllium recovered astatine https://events.linuxfoundation.org/supply-chain-town-hall/.