SPDX solves this problem, says Dave McLoughlin, an open source auditor for OpenLogic. An SPDX file will travel with a software project as an included file in it. It uses a specific format to collect specific data about each project including version number and license. Eventually, tools will be created that will allow SPDX files to be transferred from other file formats as well. For instance, if a company's development team has been using a spreadsheet to track licensing information, such tools will allow that spreadsheet to be converted to an SPDX file.
The SPDX working group hopes that eventually all commercial software vendors will support SPDX. Now that the 1.0 of the specification is available, enterprises should ask their commercial open source software providers about SPDX support and how they have implemented it.
The project enjoyed participation and support by a wide range of industry heavyweights including Alcatel-Lucent, Antelink, Black Duck Software, Canonical, HP, Micro Focus, Motorola Mobility, nexB Inc., OpenLogic, Palamida, Protecode, Source Auditor, Texas Instruments and Wind River.
The specification is available on the Software Package Data Exchange website.
Julie Bort is the editor of Network World's Open Source community. She also writes the Source Seeker blog, the Odds and Ends blog for Cisco Subnet, and the Microsoft Update blog for Microsoft Subnet. Follow Bort on Twitter @Julie188.
Read more about software in Network World's Software section.