{"categories":[{"label":"Python Modules","url":"https://skillfed.io/packages/category/software-development-libraries-python-modules/4"},{"label":"Utilities","url":"https://skillfed.io/packages/category/utilities/2"},{"label":"Documentation","url":"https://skillfed.io/packages/category/software-development-documentation"}],"enrichment":{"capability":"Parse, validate, create, and convert SPDX software license documents in multiple formats (Tag/Value, RDF, JSON, YAML, XML) with full support for SPDX v2.2 and v2.3 specifications.","skillfed_tags":["compliance","sbom","license-management"],"use_cases":["Generate or validate software bill of materials (SBOM) documents for compliance and supply-chain auditing.","Convert SPDX documents between formats (e.g., JSON to RDF) for integration with different toolchains.","Programmatically create SPDX v2.2/v2.3 documents from your build system or package metadata.","Validate third-party SPDX files before ingesting them into a license compliance workflow.","Parse and extract license and component information from SPDX documents for reporting or analysis."],"what_it_does":"spdx-tools is a Python library that implements the full SPDX (Software Package Data Exchange) specification for documenting software licenses, components, and compliance metadata. It lets you read SPDX documents in five standard formats, validate them against the v2.2 or v2.3 specification, manipulate their structure programmatically via a typed dataclass model, and write them back out in any supported format. The library also provides a command-line tool for batch parsing, validation, and format conversion.\n\nThe package is built on a strict type-checked data model where each SPDX object is a dataclass with enforced property types, catching invalid documents early. It includes experimental support for the upcoming SPDX v3.0 specification (write-only, not yet production-ready), and optional graph visualization of document structure. Nine runtime dependencies handle parsing (ply, xmltodict, rdflib), validation (beartype, semantic_version), and license expression evaluation (license_expression).","worth_installing":"Yes. spdx-tools is the reference implementation of the SPDX specification in Python, actively maintained, production-stable, and has no known vulnerabilities. Install it if you need to work with SPDX documents\u2014parsing, validation, or creation. The only caveat is that SPDX 3.0 support is experimental and not recommended for production; stick to v2.2/v2.3 for stable use."},"id":"spdx-tools","links":{"html":"https://skillfed.io/packages/spdx-tools","md":"https://skillfed.io/packages/spdx-tools.md","pypi":"https://pypi.org/project/spdx-tools/"},"maintenance":{"status":"active"},"meta":{"latest_release":"2026-03-13","license_spdx":"Apache-2.0","license_treatment":"permissive","name":"spdx-tools","python_support":"supports_current","summary":"SPDX parser and tools."},"popularity":{"monthly_downloads":5435206,"position":2101,"tier":"top_5000"},"security":{"n_vulnerabilities":0},"version":"0.8.5"}