For all versions after 2.2.1, the SPDX Specification is provided under the Community Specification License 1.0.
Pre-existing portions of the SPDX Specification from contributors who have not subsequently contributed under the Community Specification License 1.0 (since its adoption as of 2nd Sept 2021) are provided under Creative Commons Attribution 3.0 Unported (CC-BY-3.0).
SPDX source code and software, where not otherwise specified, is provided under the Apache License, version 2.0 (Apache-2.0).