# spdx

SPDX is an open standard for communicating software bill of materials and related provenance, license, and security information.

This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles.

## Super SBOMs: See exactly what's inside

DevFeed: [Super SBOMs: See exactly what's inside](<https://devfeed.tech/articles/super-sboms-see-exactly-what-s-inside-13245.md>)

Original publisher: [Read original article](<https://www.chainguard.dev/unchained/super-sboms-see-exactly-whats-inside>)

Published: 2026-01-29T00:00:00Z

Content type: release

Language: en

Sources: [Chainguard: Unchained](<https://devfeed.tech/sources/chainguard-unchained.md>)

Topics: [chainguard containers](<https://devfeed.tech/topics/chainguard-containers.md>), [Containers](<https://devfeed.tech/topics/containers.md>), [chainguard](<https://devfeed.tech/topics/chainguard.md>), [Security](<https://devfeed.tech/topics/security.md>), [spdx](<https://devfeed.tech/topics/spdx.md>)

Tags: [chainguard-containers](<https://devfeed.tech/tags/chainguard-containers.md>), [chainguard-sboms](<https://devfeed.tech/tags/chainguard-sboms.md>), [containers](<https://devfeed.tech/tags/containers.md>), [cyclonedx](<https://devfeed.tech/tags/cyclonedx.md>), [fedramp](<https://devfeed.tech/tags/fedramp.md>), [sbom](<https://devfeed.tech/tags/sbom.md>), [sboms](<https://devfeed.tech/tags/sboms.md>), [security](<https://devfeed.tech/tags/security.md>), [software-bill-of-materials](<https://devfeed.tech/tags/software-bill-of-materials.md>), [software-supply-chain-security](<https://devfeed.tech/tags/software-supply-chain-security.md>), [spdx](<https://devfeed.tech/tags/spdx.md>), [vulnerability](<https://devfeed.tech/tags/vulnerability.md>)

### AI overview

Chainguard Containers now provide richer SBOMs with binary-level details about embedded libraries and dependencies, along with CycloneDX support in addition to SPDX. The added visibility helps teams trace vulnerabilities and assess license compliance.

### Source excerpt

Chainguard Containers ship richer SBOMs with binary-level library details plus new CycloneDX support, making CVE impact and compliance tracing fast and clear.

## Gradle dependency license validation

DevFeed: [Gradle dependency license validation](<https://devfeed.tech/articles/gradle-dependency-license-validation-20887.md>)

Original publisher: [Read original article](<https://code.cash.app/gradle-dependency-license-validation>)

Author: Jake Wharton

Published: 2021-06-08T00:00:00Z

Content type: tutorial

Language: en

Sources: [Jake Wharton](<https://devfeed.tech/sources/jake-wharton.md>)

Topics: [Gradle](<https://devfeed.tech/topics/gradle.md>), [spdx](<https://devfeed.tech/topics/spdx.md>), [Android](<https://devfeed.tech/topics/android.md>), [Open Source](<https://devfeed.tech/topics/open-source.md>)

Tags: [dependencies](<https://devfeed.tech/tags/dependencies.md>), [gradle](<https://devfeed.tech/tags/gradle.md>), [gradle-plugin](<https://devfeed.tech/tags/gradle-plugin.md>), [open-source](<https://devfeed.tech/tags/open-source.md>), [software-license](<https://devfeed.tech/tags/software-license.md>), [spdx](<https://devfeed.tech/tags/spdx.md>), [validation](<https://devfeed.tech/tags/validation.md>)

### AI overview

This post explains how Cash App automated dependency license discovery and validation for its Android app using a new Gradle plugin called Licensee. The plugin normalizes license data to SPDX identifiers, supports allow-list validation that can fail builds for disallowed licenses, and serializes the results as JSON for use in the app's UI. It is intended to work with any Gradle-based project.

### Source excerpt

This post was published externally on Cash App Code Blog. Read it at https://code.cash.app/gradle-dependency-license-validation.