spdx-storage

Store, query, import, and export SPDX data across a range of graph database systems.

spdx-storage is a Python library for persisting SPDX (Software Package Data Exchange) data in graph databases. SPDX data is inherently a graph of software components, relationships, licenses, and provenance, which makes graph databases a natural fit for storing, linking, and querying it.

The library offers a single, backend-agnostic interface so you can import SPDX documents into a graph store, work with the data, and export it back out to standard SPDX serializations, without tying your code to any one database system.

Project status: Early development. The package is under active construction and the public API illustrated below is subject to change before the first stable release.

Features

• Graph-native storage for SPDX data, built on top of triplestore.
• Pluggable backends — target several graph database systems through one consistent API.
• Import SPDX documents from standard serializations into a graph store.
• Export stored data back out to standard SPDX serializations.
• Backend-agnostic code — switch databases without rewriting your application.
• Typed — ships with type hints (py.typed) for a great editor and type-checker experience.

Installation

spdx-storage requires a recent version of Python. Development is happening on Python 3.14+.

pip install spdx-storage

Or, using uv:

uv add spdx-storage

Command-line interface

The different command-line interface options are documented in the description document.

Supported backends

spdx-storage is designed around a pluggable backend architecture, so the same code can target different graph database systems by changing only the connection string. Planned and candidate backends will be listed here.

About SPDX

SPDX is an open international standard, for communicating software bill of materials (SBOM) information, including components, licenses, copyrights, and security references. Learn more:

• SPDX website
• SPDX specification

Development

This project uses uv for environment and dependency management and ruff for linting and formatting.

# Clone the repository
git clone https://github.com/spdx/spdx-storage.git
cd spdx-storage

# Create the environment and install dependencies
uv sync

# Lint and format (must be done before committing)
uv run ruff check .
uv run ruff format .

Roadmap

• Command-line interface
• Core SPDX graph model and storage interface
• Import from standard SPDX serializations
• Export to standard SPDX serializations
• Documentation and usage guides

License

This project is licensed under the Apache License 2.0. See the LICENSE file for the full text.

Note that this repository may include content developed with support from one or more generative artificial intelligence solutions.