In SPDX, package supplier names the organization or person who distributes the package. Download location says where the package could be fetched when the document was made. Supplier is optional, download location is required, and neither is a website name or a place for credentials.
Package supplier
The 2.3.1 specification describes the supplier as the party that actually distributes the package, which may differ from the original source. Allowed values are NOASSERTION, the word Person followed by a name, or the word Organization followed by a name, with an optional email.
The spec is firm that the supplier must be an organization or a recognized author, not a website. Its example: a code hosting site is not the supplier, the project's organization is.
Two practical outcomes:
- For an open source package, the supplier is usually the project or the maintainers' organization, not the registry.
- If you are not sure who distributes it, use NOASSERTION rather than guessing.
Download location
Download location is required. It holds a URL, a version control location, NONE, or NOASSERTION. It describes where the package was available at the time the document was created.
For version control locations, the spec uses a prefix such as git, hg, svn or bzr followed by a plus sign, then the transport, host, optional path, and an optional revision and sub path. It recommends fully qualified references such as a tag reference over a bare name, since names can move.
Never put credentials here
The spec states that usernames and passwords in the host part are not supported. Handle credentials outside the SPDX document. This matters because SBOMs get shared. A token in a URL turns a bill of materials into a leak.
Choosing between NONE and NOASSERTION
For download location, NONE means no location exists at all. NOASSERTION means you did not determine it. A private internal package that is not distributed anywhere might legitimately use NONE. A package you simply did not trace should use NOASSERTION.
A short checklist
- Supplier: organization or person, or NOASSERTION. Never a website.
- Download location: a pinned reference such as a tag or commit where possible.
- No credentials in any URL.
- Use NONE only if you can defend that no location exists.
- Compare against the 2026 producer field if you map data between formats. The 2026 elements rename supplier name as component producer.
For how this relates to component identity more broadly, see what a package URL is.
Quick check
Can the supplier be the registry I downloaded from?
Not if the registry is only a hosting site. The spec says the supplier must be an organization or a recognized author, not a website.
Is download location optional?
No. It is a required field, but its value may be NONE or NOASSERTION.
Sources
Last reviewed: 19 October 2026.
