In SPDX 2.3, PackageSupplier names who actually distributed the package to the document's subject, while PackageOriginator names who originally created it, if that is someone different. Both are optional. Use NOASSERTION when you cannot determine the answer, rather than guessing or leaving it ambiguous.
The spec's own example
SPDX 2.3.1 explains the difference with a well known case. The document identifies the package as glibc and the supplier as Red Hat, but the Free Software Foundation is the originator. The supplier is the actual distribution source for what you have. The originator is where the code first came from.
That split matters when you repackage. A distribution that rebuilds a library, patches it and ships it is the supplier of that build, even though the original authors are elsewhere.
Format rules
Both fields take a single line of text. The value is NOASSERTION, or Person followed by a name and optional email, or Organization followed by a name and optional email.
PackageSupplier: Organization: Example Distribution (contact@example.com)
PackageOriginator: Organization: Original Project Team
The spec adds a useful rule for supplier. The name should be an organization or recognized author, not a web site. Its example is that a hosting site is not a supplier, the supplier for a project hosted there is the organization behind it.
When to use NOASSERTION
The spec defines three cases. You tried and could not reach a reasonable objective determination. You made no attempt. Or you intentionally provided no information, and no meaning should be implied by that.
Only the first is a statement of effort. Do not fill in a supplier by copying the registry name, which may just be the host.
Decision guide
| Situation | Supplier | Originator |
|---|---|---|
| You use a library straight from its project releases | The project | Leave out, or same as supplier |
| You use a distro rebuild of that library | The distribution | The original project |
| You use an internal fork | Your organization | The upstream project |
| You cannot tell | NOASSERTION | NOASSERTION |
Why a buyer cares
Supplier is the party you would contact about a defect, and whose update channel you depend on. NTIA's minimum elements list supplier name as a baseline field, defined as the entity that creates, defines and identifies components. A blank or placeholder value leaves the reader with no one to ask.
When you send an SBOM to a customer, sample ten components and check the supplier. If most say NOASSERTION, say so in your cover note instead of letting them find it.
Safeguard can generate SBOMs and run dependency scanning across your repositories, so the fields discussed here are checked on real projects instead of by hand. You can try the free scan at gold.safeguard.sh/scan.
Quick check
Do I need both supplier and originator?
No. Both are optional. Use originator when the package came from someone other than the party that distributed it to you.
Can a website be the supplier?
The spec says the supplier should be an organization or recognized author, not a web site.
Sources
- SPDX 2.3.1, Clause 7: Package information
- NTIA, The Minimum Elements for a Software Bill of Materials (2021)
Last reviewed: 19 October 2026.
