A SPDX case study

Working for another large company that deals with OSS I recognize the problems faced.
Our company also has a large database that one uploads source code into for license review and that aids the process of verification and license obligation compliance.

For our team, using the tool at first generated a lot of work.
Currently we source 2 different Linux distributions and maintaining all of this information throughout regular package updates and other maintenance is quite a burden.
That is why we further automated the process for our team, going from 2-3 manweeks of work per release, down to 2-3 mandays of work per release. Further tuning can probably bring this down to 1-2 mandays.

For any large company dealing with OSS products, such automation is golden.

There are additional benefits to be found in maintaining such a database like providing teams with security alerts or merely forming an internal community around certain packages, promoting reuse and stimulating communication.