SPDXTOOL(1) General Commands Manual SPDXTOOL(1)

# [NAME](#NAME)

`spdxtool` — a tool for generating SPDX Lite 3.0.1 profile software bills of material document

# [SYNOPSIS](#SYNOPSIS)

`spdxtool` \[`options`] `module ...`

# [DESCRIPTION](#DESCRIPTION)

`spdxtool` is a program which generates a JSON-LD formatted SPDX Lite 3.0.1 software bill of materials (SBOM) for a given set of pkg-config modules. The output of this tool can then be translated into other SBOM formats as necessary.

More documentation about SDPX 3.0.1 can be found from: [https://spdx.github.io/spdx-spec/v3.0.1/](https://spdx.github.io/spdx-spec/v3.0.1/)

The `options` are as follows:

[`--about`](#about)

Print the version number, the Copyright notice, and the license of the `spdxtool` program to standard output and exit. Most other options and all command line arguments are ignored.

[`--version`](#version)

Print the version number of the `spdxtool` program to standard output and exit. Most other options and all command line arguments are ignored.

[`--agent-name`](#agent-name)

Set agent name-property in /Core/Agent-class. Default is 'Default'

[`--creation-time`](#creation-time)

Set create-property time in /Core/CreationInfo-class. SPDX documentation recommends using ISO 8601-formatted time which is: YYYY-MM-DDThh:mm:ssZ. Default is document creation time. This takes precedence over the `SOURCE_DATE_EPOCH` environment variable.

[`--creation-id`](#creation-id)

Set creation ID in /Core/CreationInfoc-class. As ID in creation info mainly have special format and it's default is '\_:creationinfo\_1'.

[`--define-variable`](#define-variable)=`varname`=`value`

Define `varname` as `value`. Variables are used in query output, and some modules' results may change based on the presence of a variable definition.

# [ENVIRONMENT](#ENVIRONMENT)

[`PKG_CONFIG_DEBUG_SPEW`](#PKG_CONFIG_DEBUG_SPEW)

If set, print debugging messages to stderr.

[`PKG_CONFIG_IGNORE_CONFLICTS`](#PKG_CONFIG_IGNORE_CONFLICTS)

If set, ignore `Conflicts` rules in modules. Has the same effect as the `--ignore-conflicts` option in [pkgconf(1)](/man/os/pkgconf/pkgconf.1)

[`PKG_CONFIG_LIBDIR`](#PKG_CONFIG_LIBDIR)

A colon-separated list of low-priority directories where [pc(5)](/man/os/pkgconf/pc.5) files are looked up. The module search path is constructed by appending this list to `PKG_CONFIG_PATH`, which enjoys higher priority. If `PKG_CONFIG_LIBDIR` is not defined, the default list compiled into the `spdxtool` program from the `PKG_DEFAULT_PATH` preprocessor macro is appended instead. If `PKG_CONFIG_LIBDIR` is defined but empty, nothing is appended.

[`PKG_CONFIG_MAXIMUM_TRAVERSE_DEPTH`](#PKG_CONFIG_MAXIMUM_TRAVERSE_DEPTH)

Impose a limit on the allowed depth in the dependency graph.

[`PKG_CONFIG_PATH`](#PKG_CONFIG_PATH)

A colon-separated list of high-priority directories where [pc(5)](/man/os/pkgconf/pc.5) files are looked up.

[`PKG_CONFIG_PRELOADED_FILES`](#PKG_CONFIG_PRELOADED_FILES)

Colon-separated list of [pc(5)](/man/os/pkgconf/pc.5) files which are loaded before any other pkg-config files. These packages are given highest priority over any other [pc(5)](/man/os/pkgconf/pc.5) files that would otherwise provide a given package.

[`SOURCE_DATE_EPOCH`](#SOURCE_DATE_EPOCH)

If set, and the `--creation-time` option is not given, the creation time in /Core/CreationInfo-class is derived from this UNIX timestamp instead of the current time, allowing for reproducible SBOM generation.

# [EXIT STATUS](#EXIT_STATUS)

The `spdxtool` utility exits 0 on success, and >0 if an error occurs.

# [EXAMPLES](#EXAMPLES)

Generating an SBOM for the package named foo:

`$ spdxtool foo`

`{`

`@context: https://spdx.org/rdf/3.0.1/spdx-context.jsonld`

,

`@graph: [`

`{`

`type: Agent`

,

`creationInfo: _:creationinfo_1`

,

`spdxId: https://github.com/pkgconf/pkgconf/Agent/default`

,

`name: Default`

`},`

`{`

`type: CreationInfo`

,

`@id: _:creationinfo_1`

,

`[...]`

# [SEE ALSO](#SEE_ALSO)

[pc(5)](/man/os/pkgconf/pc.5), [pkgconf(1)](/man/os/pkgconf/pkgconf.1)

January 22, 2026 Linux 4.19.0-gvisor

---

Document: spdxtool(1) from pkgconf 3.0.10-r1 (Chainguard OS)
Source: https://github.com/pkgconf/pkgconf