spdx-tools

What it is and what it does

spdx-tools is a Python library that implements the full SPDX (Software Package Data Exchange) specification for documenting software licenses, components, and compliance metadata. It lets you read SPDX documents in five standard formats, validate them against the v2.2 or v2.3 specification, manipulate their structure programmatically via a typed dataclass model, and write them back out in any supported format. The library also provides a command-line tool for batch parsing, validation, and format conversion.

The package is built on a strict type-checked data model where each SPDX object is a dataclass with enforced property types, catching invalid documents early. It includes experimental support for the upcoming SPDX v3.0 specification (write-only, not yet production-ready), and optional graph visualization of document structure. Nine runtime dependencies handle parsing (ply, xmltodict, rdflib), validation (beartype, semantic_version), and license expression evaluation (license_expression).

Use it for:

• Generate or validate software bill of materials (SBOM) documents for compliance and supply-chain auditing.
• Convert SPDX documents between formats (e.g., JSON to RDF) for integration with different toolchains.
• Programmatically create SPDX v2.2/v2.3 documents from your build system or package metadata.
• Validate third-party SPDX files before ingesting them into a license compliance workflow.
• Parse and extract license and component information from SPDX documents for reporting or analysis.

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

Parse, validate, create, and convert SPDX software license documents in multiple formats (Tag/Value, RDF, JSON, YAML, XML) with full support for SPDX v2.2 and v2.3 specifications.

Yes. spdx-tools is the reference implementation of the SPDX specification in Python, actively maintained, production-stable, and has no known vulnerabilities. Install it if you need to work with SPDX documents—parsing, validation, or creation. The only caveat is that SPDX 3.0 support is experimental and not recommended for production; stick to v2.2/v2.3 for stable use.

Install

spdx-tools on PyPI

pip install spdx-tools

uv add spdx-tools

poetry add spdx-tools

Installing spdx-tools

Before you install

Low friction install with a wheel distribution. Active maintenance (last commit 2026-03-13) and production-stable status. Nine runtime dependencies are all established libraries (beartype, click, pyyaml, rdflib, etc.), suggesting a well-integrated ecosystem with no exotic requirements.

License in practice

Apache-2.0 permissive license allows use in most commercial and open-source projects without significant restrictions, though you must include the license text and notice of modifications.

Quickstart

pip install spdx-tools

from spdx_tools.spdx.parser.parse_anything import parse_file
from spdx_tools.spdx.writer.write_anything import write_file

document = parse_file('input.spdx.json')
write_file(document, 'output.spdx.tag')

Requires Python 3.10 or later.

Verify before relying

• Whether SPDX 3.0 experimental support is suitable for production use despite the documentation's caution against it.
• Performance characteristics when parsing or validating very large SPDX documents.
• Whether optional graph generation dependencies (networkx, pygraphviz) are easy to install on all platforms.

Package facts

Evidence: spdx_tools-0.8.5-py3-none-any.whl

Tags

More Python Modules packages