Tag
spdx
- Feb 24, 2026 Identity in SBOMs: PURLs, CPEs, and Why Names Do Not Join An SBOM is only as useful as its keys. Component identity schemes disagree about what a component is, and vulnerability matching fails where they disagree. security
- Nov 5, 2025 SPDX License Expressions and Machine-Readable Provenance How a single identifier grammar replaced prose license statements, what the operators and version suffixes encode, and why the declared license of a package and the licenses of its files routinely disagree. computing history