Keeping track of all code used in one’s open-source project or open source-based product can be challenging. To help with the bill of material or software supply chain, SPDX, aka Software Package Data Exchange, helps developers track every line of open-source code that is being used. We sat down with Kate Stewart, VP, Dependable Embedded Systems at the Linux Foundation, to learn about the project and some of the recent developments.