Skip to main content
SourceTrustSign in

Help center

Guides for SourceTrust: Importing dependencies, reviewing licenses, external obligations, publishing attestation pages, billing, plain-language license explainers, and procurement-oriented explainers for common open-source licenses.

Download and export formats

← All articles

After publish, download markdown, NOTICE, HTML, PDF, JSON, CSV, PLIST, CycloneDX, and SPDX. Pick the spec version and serialization buyers or tools expect.

Read about SourceTrust export formats

After at least one publish, open Export on the project page. Every file is generated from the published attestation snapshot, so procurement exports match exactly what buyers see on the license disclosure at that revision number.

Human-readable disclosure

  • Markdown (.md): Full license disclosure for installers, download pages, or legal folders. Each component with attribution and full license text where available.
  • Plain text NOTICE: Compact attribution file (Apache NOTICE style). One block per package with license and copyright, without full license bodies.
  • HTML: Self-contained web page with full license text. Suitable for in-app WebViews or internal hosting without extra styling.
  • PDF: Printable version of the markdown disclosure. For RFP attachments, legal folders, or reviewers who want one file to print.

Structured and platform-specific

  • JSON: SourceTrust's structured export (third-party-licenses.json). Same components and licenses as the public page. For spreadsheets, compliance tools, or automation.
  • CSV: One row per component (name, version, license, SPDX id, copyright, source). Opens in Excel, Google Sheets, or audit workflows.
  • PLIST: iOS Acknowledgements.plist for Xcode or CocoaPods. Each dependency becomes a row with license text in the footer.

CycloneDX SBOM

A separate SBOM standard from SPDX. In the download dialog, pick spec version and file format. Default is 1.7 JSON (newest released spec). This export lists disclosed libraries and licenses from your attestation snapshot. It is not a full version-exact dependency graph from lockfiles.

  • Spec versions: 1.7 (default), 1.6, or 1.5.
  • Serializations: JSON (*.cdx.json) or XML (*.cdx.xml).

Separately reviewed variants remain separate export entries even when their names and versions match. Each CycloneDX reference (bom-ref) identifies an entry within that document, while the package URL (purl) identifies the package and can be shared by several entries.

SPDX SBOM

SPDX 2.3 and 3.0.1 are different document models, not two serializations of the same file. Pick the version your tooling expects.

  • SPDX 2.3 (default): The version most SBOM tools ingest today. JSON (*.spdx.json) or tag:value (*.spdx plain text).
  • SPDX 3.0.1: Newest released SPDX spec. JSON-LD only (*.spdx3.json). SPDX 3.1 is not offered (release candidate only).
Filenames include your project slug and revision number (for example my-app-sbom-rev3.cdx.json). SBOM exports contain the legal/compliance subset you published, not every transitive dependency from a lockfile.

Building a mobile app and need Settings → Legal / Licenses? See Help center → Mobile apps and in-app licenses (Mobile apps and in-app licenses).