Is SPDX actually useful as an SBoM specification? I tried to add support into uSWID a few months ago and it was totally underspecified compared to SWID. Richard.

On http://spdx.org/spdx-license-list the link is marked as http://spdx.org/exceptions-index.html ... Right, I wasn't sure if LicenseRef-proprietary was correct as proprietary isn't really a licence to

Hi all, I've been using SPDX for years in the AppStream specification to describe applications that can be installed in software centers. I'm using the AND, OR extensions, and am soon to include the W

So, for AppStream the idea is to explain the licenses in the user-facing software center, e.g. gnome-software or apper for KDE. This would mean you could click on a link that says "GPLv3+" and get sen

Hi all, I hope I'm asking in the right place, if not please disregard this message. When writing AppStream metadata I'm required to convert the existing Fedora license tag to an SPDX-compatible string