Put the copyright notice you actually found, even if incomplete. Use NONE only when the package contains no copyright information whatsoever, and NOASSERTION when you made no attempt to determine it or deliberately gave no information. A missing field in SPDX means the same as NOASSERTION.
SPDX rules
The SPDX 2.3.1 copyright text field is optional, one per package. The spec says it identifies the copyright holders and any dates, as free form text extracted from package information files. The allowed values are any text related to a copyright notice, even if not complete, or NONE, or NOASSERTION.
PackageCopyrightText: <text>Copyright 2008-2010 John Smith</text>
PackageCopyrightText: NOASSERTION
If the field is absent, the spec says it implies the same meaning as NOASSERTION.
CycloneDX rules
In CycloneDX 1.6 a component has a copyright string, described as a copyright notice informing users of the underlying claims to copyright ownership in a published work. The spec example is a company name. The reference describes it as a plain string with no NONE keyword, so leave the field out when you have nothing to say.
How to choose
| Situation | SPDX value | CycloneDX |
|---|---|---|
| You extracted a notice from the package | The notice text | The notice text |
| You looked and found no notice at all | NONE | Omit |
| You did not look | NOASSERTION | Omit |
| You looked, but the notice is ambiguous | The text you found, plus a comment | The text you found |
The risk is treating the three states as one. NONE is a positive claim that a search turned up nothing. If your tool never searched, writing NONE misleads a reviewer into thinking the package was checked.
Why this matters to buyers
Copyright notices are part of how many open source licenses expect attribution. An acquirer or compliance team reading your SBOM will want to know which components have notices to carry into a notice file. This is operational information, not legal advice. If your use of a package turns on what its notice says, ask your counsel.
How to improve the fill rate
Pull the notice from the package's license or notice file at build time. Many generators already scan for license files, so check whether copyright extraction is a setting you have not enabled. Capture only the notice text, and do not paste large license bodies into this field.
Keep the original wording. Do not tidy or merge notices from different files into a single invented line.
Check yourself
Take ten random packages from a lockfile. Open each package's files and compare to the SBOM field. If more than a few differ from what you find, the generator needs attention.
Safeguard can generate SBOMs and run dependency scanning across your repositories, so the fields discussed here are checked on real projects instead of by hand. You can try the free scan at gold.safeguard.sh/scan.
Quick check
Does a missing copyright field mean there is no copyright?
No. In SPDX an absent field implies NOASSERTION, which means no statement was made.
Should I paste the whole license text in the copyright field?
No. The field is for the notice with holders and dates. License text belongs in license fields.
Sources
Last reviewed: 19 October 2026.
