---
name: "spdxtool"
section: "1"
platform: "linux"
package: "pkgconf"
version: "3.0.10-1"
release: "Arch Linux 2026-11-01"
platforms: ["linux", "freebsd"]
url: "https://new.carta.tech/spdxtool"
---

# spdxtool(1)

a tool for generating SPDX Lite 3.0.1 profile software bills of material document

## NAME

**spdxtool** – a tool for generating SPDX Lite 3.0.1 profile software bills of material document

## SYNOPSIS

**spdxtool** \[*options*\] *module* *...*

## DESCRIPTION

**spdxtool** is a program which generates a JSON-LD formatted SPDX Lite 3.0.1 software bill of materials (SBOM) for a given set of pkg-config modules. The output of this tool can then be translated into other SBOM formats as necessary.

More documentation about SDPX 3.0.1 can be found from: **https://spdx.github.io/spdx-spec/v3.0.1/**

The *options* are as follows:

- **--about**

  Print the version number, the Copyright notice, and the license of the **spdxtool** program to standard output and exit. Most other options and all command line arguments are ignored.

- **--version**

  Print the version number of the **spdxtool** program to standard output and exit. Most other options and all command line arguments are ignored.

- **--agent-name**

  Set agent name-property in /Core/Agent-class. Default is 'Default'

- **--creation-time**

  Set create-property time in /Core/CreationInfo-class. SPDX documentation recommends using ISO 8601-formatted time which is: YYYY-MM-DDThh:mm:ssZ. Default is document creation time. This takes precedence over the SOURCE\_DATE\_EPOCH environment variable.

- **--creation-id**

  Set creation ID in /Core/CreationInfoc-class. As ID in creation info mainly have special format and it's default is '\_:creationinfo\_1'.

- **--define-variable**=*varname*=*value*

  Define *varname* as *value*. Variables are used in query output, and some modules' results may change based on the presence of a variable definition.

## ENVIRONMENT

- PKG\_CONFIG\_DEBUG\_SPEW

  If set, print debugging messages to stderr.

- PKG\_CONFIG\_IGNORE\_CONFLICTS

  If set, ignore **Conflicts** rules in modules. Has the same effect as the **--ignore-conflicts** option in [pkgconf(1)](/pkgconf/1.md)

- PKG\_CONFIG\_LIBDIR

  A colon-separated list of low-priority directories where [pc(5)](/pc/5.md) files are looked up. The module search path is constructed by appending this list to PKG\_CONFIG\_PATH, which enjoys higher priority. If PKG\_CONFIG\_LIBDIR is not defined, the default list compiled into the **spdxtool** program from the PKG\_DEFAULT\_PATH preprocessor macro is appended instead. If PKG\_CONFIG\_LIBDIR is defined but empty, nothing is appended.

- PKG\_CONFIG\_MAXIMUM\_TRAVERSE\_DEPTH

  Impose a limit on the allowed depth in the dependency graph.

- PKG\_CONFIG\_PATH

  A colon-separated list of high-priority directories where [pc(5)](/pc/5.md) files are looked up.

- PKG\_CONFIG\_PRELOADED\_FILES

  Colon-separated list of [pc(5)](/pc/5.md) files which are loaded before any other pkg-config files. These packages are given highest priority over any other [pc(5)](/pc/5.md) files that would otherwise provide a given package.

- SOURCE\_DATE\_EPOCH

  If set, and the **--creation-time** option is not given, the creation time in /Core/CreationInfo-class is derived from this UNIX timestamp instead of the current time, allowing for reproducible SBOM generation.

## EXIT STATUS

The **spdxtool** utility exits 0 on success, and \>0 if an error occurs.

## EXAMPLES

Generating an SBOM for the package named foo:

```
$ spdxtool foo
```

```
{
```

```
@context: https://spdx.org/rdf/3.0.1/spdx-context.jsonld,
```

```
@graph: [
```

```
{
```

```
type: Agent,
```

```
creationInfo: _:creationinfo_1,
```

```
spdxId: https://github.com/pkgconf/pkgconf/Agent/default,
```

```
name: Default
```

```
},
```

```
{
```

```
type: CreationInfo,
```

```
@id: _:creationinfo_1,
```

```
[...]
```

## SEE ALSO

[pc(5)](/pc/5.md), [pkgconf(1)](/pkgconf/1.md)