SPDX and CycloneDX — the two formats, the trade-offs, the tooling

SPDX and CycloneDX are the two SBOM formats with production-grade tooling. They are not interchangeable: they model components differently, optimise for different consumers, and produce different artifacts. The choice between them is a downstream decision — the question is “what consumes the SBOM?” — and the default is to pick one, generate it at build time, and treat the conversion to the other as an exception rather than a routine.

SPDX and CycloneDX

SPDX began at the Linux Foundation as a license-focused format whose primary unit is the package. Strengths: SPDX identifiers are the standard for license expression; SPDX is named in U.S. federal SBOM framing and the EU Cyber Resilience Act discussion; SPDX documents attach cleanly to the in-toto attestation envelope. Weaknesses: heavier than CycloneDX; permissive schema.

CycloneDX began at OWASP as a component-graph format whose primary unit is the component organised into a dependency graph with explicit dependsOn edges. Strengths: first-class dependency edges; native VEX, services, and properties fields; Dependency-Track, Mend, Snyk, trivy, and grype ingest CycloneDX natively. Weaknesses: license expression tooling is less mature.

flowchart LR
    A["Build artifact"] --> B["Generator"]
    B --> C["SPDX"]
    B --> D["CycloneDX"]
    C --> E["License / gov tooling"]
    D --> F["Vuln management tooling"]
    C -. "convert (lossy)" .-> D
    D -. "convert (lossy)" .-> C

The conversion trap

A SBOM in SPDX and a SBOM in CycloneDX for the same artifact will not match field-for-field: SPDX’s license-concluded field has no CycloneDX analogue; CycloneDX’s dependsOn graph has no SPDX field of the same name. A conversion tool can map the common fields (name, version, hash, supplier) but the rest is lost.

Production discipline

1. Pick the format the downstream consumer ingests natively: SPDX for license and gov tooling; CycloneDX for vuln management.
2. Generate with the format-native tool (syft with the matching output flag, or cyclonedx-bom for CycloneDX) and validate against the official JSON Schema.
3. Do not convert between formats at consumer time as a default. Run two generators if two consumers need two formats.

Cross-course references

• Git, CI/CD & GitOps — Part LXVIII-05 (Vulnerability Matching) is the downstream consumer that motivates CycloneDX’s component-graph model.

Quiz