standard
SPDX is an open standard for software bill of materials data, specifying formats for documenting components, licenses, and provenance across a codebase.
No evidence-backed relationships are recorded.
Protobuf's 7.36.0 wheel ships its BSD license text but omits the PEP 639 License-Expression field that SPDX-based compliance pipelines evaluate. The gap sits in the built artifact, so a correct LICENSE file in the source repo does not decide what the wheel declares to a scanner.
Reality
Four frozen license classes gate releases in a dev.to case study, and any license string outside the table fails the build with HTTP 422. The code is proposed, not production-tested, and its exact-match lookup also blocks case variants and SPDX expressions.
Reality
License Referee resolves each npm dependency to an SPDX id and looks up a ruling for the exact dependency-into-project direction. On its 22-question test set, all three configurations agreed on the verdict and one invented its source.
Reality
A dev.to survey walks seven AI supply chain entry points and the named incidents behind each. The two dataset-poisoning numbers in it are the ones that should change how a model review is scoped.
Reality
Swift Build became the default in Swift Package Manager with the September 15 release, so the engine under every package changed even for teams adopting none of 6.4's interop work. Everything else in the release waits for a source edit.
Reality
Reading soit-ai/soit v1.0.0 out of ghcr.io by hand shows how far a container signature reaches. It covers one digest, and the release tag survives as a string in the build predicate that nothing compares for you.
Reality
"Use .h5 or .keras instead of pickle" is not a mitigation. Scanning pipelines built on the pickle-only model of executable artifacts have a hole in them.
Reality