Software Package Data Exchange (SPDX) is an international open standard (ISO/IEC 5962:2021), an open source project hosted by the Linux foundation. SPDX is an open standard for communicating software bill of material information, including provenance, license, security, and other related information.