SPDX Wiki - User contributions [en]

General Meeting/Minutes/2012-10-18

2012-10-18T15:47:15Z

Knewcomer:

<p>Attendance: 7</p><p>Minutes of Oct 4 meeting approved.</p><p>Led by Kirsten Newcomer</p><p><strong>Technical Team Report - Gary<br /></strong></p><ul><li>Completed review of use cases.</li><li>Have started modeling phase<br /><ul><li>Will create model of v1.1 and review so that everyone has the same baseline to work from</li><li>Then will start building model for 2.0 and vet against use cases for 2.0</li></ul></li></ul><p><strong>Legal Team Report - Tom<br /></strong></p><ul><li>Last two meetings have been lightly attended. Only 4 folks this week.</li><li>Some issues have surfaced with the GPL exceptions on the SPDX license list <br /><ul><li>Legal team is looking for a volunteer to review for correctness</li></ul></li><li>Team discussed potential policy around licenses in different languages. Some initial thoughts from the team</li><ul><li>Official language of the license list site is English</li><li>A small number of licenses have been originally published in a different language; for those cases, may make sense to publish in the original language</li><li>Policy is still under discussion</li></ul></ul><p><strong>Business Team Report - Jack </strong></p><ul><li>No meeting last week. Current activities include</li><li>Recruitment<ul><li>Continuing to work on recruitment plan & roadmap</li><li>Team thinks this will be ready for review soon</li><li>Team is looking for a volunteer to write the On Boarding document</li><li>Pierre has downloaded the free version of KarmaCRM which might be useful for tracking recruitment efforts</li><ul><li>Free version is limited to two users. One option might be to create a shared email address for SPDX team use. Business team wil discuss at next meeting.</li></ul></ul></li></ul><p><strong>Cross Functional Issues – Team<br /></strong></p><ul><li>Web Site Update<br /><ul><li> It's time to get ready for Linux Foundation conversion<ul><li>Need two SPDX team members to work with webmasters from the Linux Foundation</li><li>Recommendation is that Martin Michlymeyer be one and that the other team member be someone who contributed to the previous web-site revamp for continuinty.</li></ul></li></ul></li><li>SPDX plugin for Fossology</li><ul><li>Matt Germonprez (U of Neb) is making good progress and hopes to be able to share more broadly in about a month.</li></ul></ul><p class="p1"><strong>Attendees</strong></p><ul><li>Kirsten Newcomer, Black Duck</li><li>Pierre Lapointe, nexB</li><li>Jack Manbeck, Texas Instruments</li><li>Kamyar Emami, Protecode</li><li>Tom Incorvia, Microfocus</li><li>Gary O'Neall, Source Auditor</li><li>Scott Lamons, HP</li></ul>

General Meeting/Minutes/2012-10-18

2012-10-18T15:45:35Z

Knewcomer:

General Meeting/Minutes/2012-10-18

2012-10-18T15:44:23Z

Knewcomer:

<p>Attendance: 7</p><p>Minutes of Oct 4 meeting approved.</p><p>Led by Kirsten Newcomer</p><p><strong>Technical Team Report - Gary<br /></strong></p><ul><li>Completed review of use cases. </li><li>Have started modeling phase<br /><ul><li>Will create model of v1.1 and review so that everyone has the same baseline to work from</li><li>Then will start building model for 2.0 and vet against use cases for 2.0</li></ul></li></ul><p><strong>Legal Team Report - Tom<br /></strong></p><ul><li>Last two meetings have been lightly attended. Only 4 folks this week. </li><li>Some issues have surfaced with the GPL exceptions on the SPDX license list <br /><ul><li>Legal team is looking for a volunteer to review for correctness</li></ul></li><li>Team discussed potential policy around licenses in different languages. Some initial thoughts from the team</li><ul><li>Official language of the license list site is English</li><li>A small number of licenses have been originally published in a different language; for those cases, may make sense to publish in the original language</li><li>Policy is still under discussion</li></ul></ul><p><strong>Business Team Report - Jack </strong></p><ul><li>No meeting last week. Current activities include</li><li>Recruitment<ul><li>Continuing to work on recruitment plan & roadmap</li><li>Team thinks this will be ready for review soon</li><li>Team is looking for a volunteer to write the On Boarding document</li><li>Pierre has downloaded the free version of KarmaCRM which might be useful for tracking recruitment efforts</li><ul><li>Free version is limited to two users. One option might be to create a shared email address for SPDX team use. Business team wil discuss at next meeting. </li></ul></ul></li></ul><p><strong>Cross Functional Issues – Team<br /></strong></p><ul><li>Web Site Update<br /><ul><li> It's time to get ready for Linux Foundation conversion<ul><li>Need two SPDX team members to work with webmasters from the Linux Foundation</li><li>Recommendation is that Martin Michlymeyer be one and that the other team member be someone who contributed to the previous web-site revamp for continuinty.</li></ul></li></ul></li><li>SPDX plugin for Fossology</li><ul><li>Matt Germonprez (U of Neb) is making good progress and hopes to be able to share more broadly in about a month. </li></ul></ul><p class="p1"><strong>Attendees</strong></p><ul><li>Kirsten Newcomer, Black Duck</li><li>Pierre Lapointe, nexB</li><li>Jack Manbeck, Texas Instruments</li><li>Kamyar Emami, Protecode</li><li>Tom Incorvia, Microfocus</li><li>Gary O'Neall, Source Auditor</li><li>Scott Lamons, HP</li></ul>

General Meeting/Planning for Face to Face meeting in September-October 2012

2012-08-13T20:43:02Z

Knewcomer:

<p><span style="text-decoration: underline;"><strong>Introduction:</strong></span></p><p>The purpose of this wiki page is to host the planning information for the SPDX f2f we are targeting to hold in the bay area in Sept/Oct 2012. Please see the bottom of this page to indicate which dates works best with you.</p><p>I have a number of agenda items that can easily consume a full day worth of discussion. I divide the agenda items in two categories: Core agenda items are the primary reason to hold this f2f meeting, and secondary agenda items will be discussed given time availability.</p><p><span style="text-decoration: underline;"><strong>Core agenda items:</strong></span></p><p>For all these core items, I will have a proposal to present that will drive the discussion. The goal of this f2f is really to have an agreement on how to proceed with these items. The agreement on these will enable the WG to be on a better and faster path of success and it is critical to get to that point. Otherwise, 1) recruiting other companies into this WG will be a mission impossible challenge (How many new companies have joined SPDX recently?), 2) Maintaing current participants will also be challenge if we don't have a resolution on these items, and not to forget the 3) fading possibility of achieving the goal of making compliance easier to achieve via SPDX standard data exchnage format (across supply chains). </p><ol><li>Project Governance: I will propose a governance model and drive this discussion</li><li>WG Structure: Goes with the above item as part of governance</li><li>Roadmap for 2012-2013-2014: I have a proposal on setting up a roadmap that will initiate this discussion</li><li>Charter: Mission / Goals / Vision: Continue this discussion and get to a closure on it.  </li><li>Recruitment: I have a proposal on this that covers companies to approach and how</li><li>SPDX web site  </li></ol><div><div><span style="text-decoration: underline;"><strong>Secondary agenda items:</strong></span></div></div><div> </div><div>These items are not the reasons we're calling for this meeting. However, since a lot of folks are expected to attend, then it would make sense to add 1 more day to the meeting to cover these items.</div><ol><li>Review current state of affairs for each sub-team</li><li>Current challenges, what are we doing about it, and how can we do better</li><li>Review of what needs to be done to get to SPDX 2.0 (technical, legal and business)</li><li>2.0 Use Cases</li></ol><div>This is a working session where people driving the effort are expected to drive the discussions. For each of the above items, it would be fantastic if Team Leads/Chairs can prepare a presentation that covers </div><div><ul><li>What was achieved in your team since Jan 2012?</li><li>What are the challenges your team is facing? Any proposal on how to resolve these challenges? How can other teams or the Linux Foundation help you with these?</li><li>What is on your plate for the rest of the year and well into 2013?</li><li>What areas you need help to get you unlocked?</li><li>etc.</li></ul></div><div>Anyone who participated in program reviews in their companies will find this familiar. The goal is to have a better alignment between the various team, understand where the challenges are and identify how we can resolve them, plan for getting 2.0 out of the door, etc. </div><div> </div><div>This F2F is really the opportunity for SPDX to regroup and proceed with a strong momentum. </div><div> </div><p><span style="text-decoration: underline;"><strong>Suggested F2F Dates:</strong></span></p><ul><li>September 10-11:</li><li>September 27-28:</li><ul><li>Kirsten Newcomer</li><li>Bill Schineller</li></ul><li>October 1-2:</li><ul><li>Kirsten Newcomer</li><li>Bill Schineller</li></ul><li>October 2-3:</li><ul><li>Kirsten Newcomer</li><li>Bill Schineller</li></ul></ul><p>Above are possible dates for the F2F. I chose these dates based on my availability as I have a significant amount of international travel for the rest of the year. Please sign your name next to the dates you can attend as a method to track who can attend which dates. I can attend all of these. </p><p><span style="text-decoration: underline;"><strong>Suggested Locations:</strong></span></p><p>Any SPDX participant companies in the bay area who can host? Please let us know.</p><p> </p><p><span style="text-decoration: underline;"><strong>Notes:</strong></span></p><ol><li>Presenters at the F2F meeting (me included): it would be very helpful to plan to make available your material a week before the meeting to allow enough time for SPDX prticipants to review and be ready for dicussions.</li><li>I will detail the agenda items further as we approach the meeting dates based on how I will structure my presentations (for my part) and on feedback from participants on what they want to discuss.</li></ol>

Technical Team/Use Cases/2.0/Intermediate packager subsetting upstream source that does not provide SPDX data

2012-08-07T19:09:32Z

Knewcomer:

<ol style="color: #4d4d4d; font-family: Arial, Helvetica, sans-serif; font-size: 13px;"><li><strong>Title:</strong> Intermediate packager subsetting upstream source that does not provide SPDX data</li><li><strong>Primary Actor:</strong> Intermediate packager (someone building a rpm, deb, etc from upstream source)</li><li><strong>Goal in Context:</strong> To include in the package SPDX data describing the packages licensing information for the package that subsets the upstream when the upstream does not provide SPDX data.</li><li><strong>Stakeholders and Interests:</strong> <ol><li><strong>Upstream maintainers: </strong><ol><li>To communicate the licensing information for their copyrightable artifacts.  </li><li>To have their licenses respected</li></ol></li><li><strong>Intermediate Packager:</strong><br /><ol><li>To communicate the licensing information for their package</li><li>To communicate the licensing information for the additions (patches) to the upstream source that came from a 3rd party.</li><li>To communicate the licensing information provided by the upstream maintainer.</li><li>To respect the licenses of the upstream maintainer</li></ol></li><li><strong>Consumers of packages:</strong><ol><li>To receive accurate and clear information of licensing of packages</li><li>To receive accurate and clear information of the licensing of the additions (patches) to the upstream source that came from a 3rd party.</li><li>To be able to comply easily with licenses for packages</li><li>To be able to trust that the package SPDX data is in alignment with the upstream maintainers license assertions.</li><li>To be able to subset, extend, or aggregate artifacts and pass on clear authoritative verifiable license for the resulting new copyrightable artifacts.</li></ol></li></ol></li><li><strong>Preconditions:</strong> <ol><li>Upstream maintainer has provided SPDX data</li><li>Package maintainer knows the license for the 3rd party additions (patches) to the upstream source</li></ol></li><li><strong>Main Success Senario:</strong> Packager communicates accurate complete licensing information for their package in an SPDX data format via all of the applicable SPDX delivery mechanisms.</li><li><strong>Failed End Condition:</strong> Package maintainer communicates inaccurate incomplete licensing information for their package.</li><li><strong>Trigger:</strong><ol><li>Release of a new package</li></ol></li><li><strong>Notes:</strong>  </li></ol>

Technical Team/Use Cases/2.0/Intermediate packager subsetting upstream source that provides SPDX data

2012-08-07T19:08:18Z

Knewcomer:

<ol style="color: #4d4d4d; font-family: Arial, Helvetica, sans-serif; font-size: 13px;"><li><strong>Title:</strong> Intermediate packager subsetting upstream source that provides SPDX data</li><li><strong>Primary Actor:</strong> Intermediate packager (someone building a rpm, deb, etc from upstream source)</li><li><strong>Goal in Context:</strong> To include in the package SPDX data describing the packages licensing information for the package base upon the SPDX data provided by the upstream source in a way that allows the packager to verifiably reference the upstream packagers SPDX data and to make clear that only a subset of the copyrightable artifacts provided by upstream maintainer are included in the copyright artifacts provided in the package.  Examples would include -dev packages that only include headers, packages that do not package contrib/ subdirectories, or otherwise break up what upstream has provided into package shaped pieces.</li><li><strong>Stakeholders and Interests:</strong> <ol><li><strong>Upstream maintainers: </strong><ol><li>To communicate the licensing information for their copyrightable artifacts.  </li><li>To have their licenses respected</li></ol></li><li><strong>Intermediate Packager:</strong><br /><ol><li>To communicate the licensing information for their package</li><li>To communicate the licensing information provided by the upstream maintainer.</li><li>To indicate that they are only passing on copyrightable artifacts based on a subset of the copyrightable artifacts provided by the upstream maintainers.</li><li>To respect the licenses of the upstream maintainer</li></ol></li><li><strong>Consumers of packages:</strong><ol><li>To receive accurate and clear information of licensing of packages</li><li>To be able to comply easily with licenses for packages</li><li>To be able to trust that the package SPDX data is in alignment with the upstream maintainers license assertions.</li><li>To be able to subset, extend, or aggregate artifacts and pass on clear authoritative verifiable license for the resulting new copyrightable artifacts.</li></ol></li></ol></li><li><strong>Preconditions:</strong> <ol><li>Upstream maintainer has provided SPDX data</li><li>Packager understands how they are subsetting the upstream source</li></ol></li><li><strong>Main Success Senario:</strong> Packager communicates accurate complete licensing information for their package in an SPDX data format via all of the applicable SPDX delivery mechanisms in such a way that indicates they are only using parts of what is provided in the upstream source.</li><ol><li>NOTE: sub-setting the data from the upstream SPDX data may require modifications of the original data in the newly created sub-set. For example, eliminating the contrib files might mean that some licenses are no longer applicable.</li></ol><li><strong>Failed End Condition:</strong> Package maintainer communicates inaccurate incomplete licensing information for their package.</li><li><strong>Trigger:</strong><ol><li>Release of a new package</li></ol></li><li><strong>Notes:</strong>  Upstream may be the root provider of the code, a source package, or some other intermediate party.  At the end of the day it's who you got the code from.</li></ol>

Technical Team/Use Cases/2.0/Intermediate packager adds someone elses patches to upstream source that provides SPDX data

2012-08-07T19:04:52Z

Knewcomer:

<ol style="color: #4d4d4d; font-family: Arial, Helvetica, sans-serif; font-size: 13px;"><li><strong>Title:</strong> Intermediate packager adds someone else's patches to upstream source that provides SPDX data</li><li><strong>Primary Actor:</strong> Intermediate packager (someone building a rpm, deb, etc from upstream source)</li><li><strong>Goal in Context:</strong> To include in the package SPDX data describing the packages licensing information for the package base upon the SPDX data provided by the upstream source in a way that allows the packager to verifiably reference the upstream packagers SPDX data and also to include SPDX data describing the additions (patches) to the upstream source that came from a 3rd party.</li><li><strong>Stakeholders and Interests:</strong> <ol><li><strong>Upstream maintainers: </strong><ol><li>To communicate the licensing information for their copyrightable artifacts.  </li><li>To have their licenses respected</li></ol></li><li><strong>Intermediate Packager:</strong><br /><ol><li>To communicate the licensing information for their package</li><li>To communicate the licensing information for the additions (patches) to the upstream source that came from a 3rd party.</li><li>To communicate the licensing information provided by the upstream maintainer.</li><li>To respect the licenses of the upstream maintainer</li></ol></li><li><strong>Consumers of packages:</strong><ol><li>To receive accurate and clear information of licensing of packages</li><li>To receive accurate and clear information of the licensing of the additions (patches) to the upstream source that came from a 3rd party.</li><li>To be able to comply easily with licenses for packages</li><li>To be able to trust that the package SPDX data is in alignment with the upstream maintainers license assertions.</li><li>To be able to subset, extend, or aggregate artifacts and pass on clear authoritative verifiable license for the resulting new copyrightable artifacts.</li></ol></li></ol></li><li><strong>Preconditions:</strong> <ol><li>Upstream maintainer has provided SPDX data</li><li>Package maintainer knows the license for the 3rd party additions (patches) to the upstream source</li></ol></li><li><strong>Main Success Senario:</strong> Packager communicates accurate complete licensing information for their package in an SPDX data format via all of the applicable SPDX delivery mechanisms.</li><li><strong>Failed End Condition:</strong> Package maintainer communicates inaccurate incomplete licensing information for their package.</li><li><strong>Trigger:</strong><ol><li>Release of a new package</li></ol></li><li><strong>Notes:</strong>  </li></ol>

Technical Team/Use Cases/2.0/Intermediate packager adds patches to upstream source that does not provide SPDX data

2012-08-07T19:03:40Z

Knewcomer:

<ol style="color: #4d4d4d; font-family: Arial, Helvetica, sans-serif; font-size: 13px;"><li><strong>Title:</strong> Intermediate packager adds patches to upstream source that does not provide SPDX data</li><li><strong>Primary Actor:</strong> Intermediate packager (someone building a rpm, deb, etc from upstream source)</li><li><strong>Goal in Context:</strong> To include in the package SPDX data describing the packages licensing information for the package when the upstream source does not include SPDX data and also to include SPDX data describing the packagers additions (patches) to the project.</li><li><strong>Stakeholders and Interests:</strong> <ol><li><strong>Upstream maintainers: </strong><ol><li>To communicate the licensing information for their copyrightable artifacts.  </li><li>To have their licenses respected</li></ol></li><li><strong>Intermediate Packager:</strong><br /><ol><li>To communicate the licensing information for their package</li><li>To communicate the licensing information for the packagers additions (patches) to the upstream source.</li><li>To communicate the licensing information provided by the upstream maintainer.</li><li>To respect the licenses of the upstream maintainer</li></ol></li><li><strong>Consumers of packages:</strong><ol><li>To receive accurate and clear information of licensing of packages</li><li>To receive accurate and clear information of the licensing of the packagers additions (patches) to the upstream source.</li><li>To be able to comply easily with licenses for packages</li><li>To be able to trust that the package SPDX data is in alignment with the upstream maintainers license assertions.</li><li>To be able to subset, extend, or aggregate artifacts and pass on clear authoritative verifiable license for the resulting new copyrightable artifacts.</li></ol></li></ol></li><li><strong>Preconditions:</strong> <ol><li>Intermediate Packager understands the licensing information of the upstream project.</li><li>Package maintainer has selected a license for their additions (patches) to the upstream source</li></ol></li><li><strong>Main Success Senario:</strong> Packager communicates accurate complete licensing information for their package in an SPDX data format via all of the applicable SPDX delivery mechanisms.</li><li><strong>Failed End Condition:</strong> Package maintainer communicates inaccurate incomplete licensing information for their package.</li><li><strong>Trigger:</strong><ol><li>Release of a new package</li></ol></li><li><strong>Notes:</strong>  </li><li></li></ol>

Technical Team/Use Cases/2.0/Intermediate packager adds patches to upstream source that provides SPDX data

2012-08-07T19:02:53Z

Knewcomer:

<p> </p><ol style="color: #4d4d4d; font-family: Arial, Helvetica, sans-serif; font-size: 13px;"><li><strong>Title:</strong> Intermediate packager adds patches to upstream source that provides SPDX data</li><li><strong>Primary Actor:</strong> Intermediate packager (someone building a rpm, deb, etc from upstream source)</li><li><strong>Goal in Context:</strong> To include in the package SPDX data describing the packages licensing information for the package base upon the SPDX data provided by the upstream source in a way that allows the packager to verifiably reference the upstream packagers SPDX data and also to include SPDX data describing the packagers additions (patches) to the project.</li><li><strong>Stakeholders and Interests:</strong> <ol><li><strong>Upstream maintainers: </strong><ol><li>To communicate the licensing information for their copyrightable artifacts.  </li><li>To have their licenses respected</li></ol></li><li><strong>Intermediate Packager:</strong><br /><ol><li>To communicate the licensing information for their package</li><li>To communicate the licensing information for the packagers additions (patches) to the upstream source.</li><li>To communicate the licensing information provided by the upstream maintainer.</li><li>To respect the licenses of the upstream maintainer</li></ol></li><li><strong>Consumers of packages:</strong><ol><li>To receive accurate and clear information of licensing of packages</li><li>To receive accurate and clear information of the licensing of the packagers additions (patches) to the upstream source.</li><li>To be able to comply easily with licenses for packages</li><li>To be able to trust that the package SPDX data is in alignment with the upstream maintainers license assertions.</li><li>To be able to subset, extend, or aggregate artifacts and pass on clear authoritative verifiable license for the resulting new copyrightable artifacts.</li></ol></li></ol></li><li><strong>Preconditions:</strong> <ol><li>Upstream maintainer has provided SPDX data</li><li>Package maintainer has selected a license for their additions (patches) to the upstream source</li></ol></li><li><strong>Main Success Senario:</strong> Packager communicates accurate complete licensing information for their package in an SPDX data format via all of the applicable SPDX delivery mechanisms.</li><li><strong>Failed End Condition:</strong> Package maintainer communicates inaccurate incomplete licensing information for their package.</li><li><strong>Trigger:</strong><ol><li>Release of a new package</li></ol></li><li><strong>Notes:</strong>  </li></ol><p> </p>

Technical Team/Use Cases/2.0/Intermediate packager builds binary package from upstream source that does not provides SPDX data

2012-08-07T19:02:02Z

Knewcomer:

<ol style="color: #4d4d4d; font-family: Arial, Helvetica, sans-serif; font-size: 13px;"><li><strong>Title:</strong> Intermediate packager builds binary package from upstream source that does not provides SPDX data</li><li><strong>Primary Actor:</strong> Intermediate packager (someone building a binary rpm, deb, etc from upstream source)</li><li><strong>Goal in Context:</strong> To include in the package SPDX data describing the packages licensing information for the binary package when the upstream has not provided SPDX data.</li><li><strong>Stakeholders and Interests:</strong> <ol><li><strong>Upstream maintainers: </strong><ol><li>To communicate the licensing information for their copyrightable artifacts.  </li><li>To have their licenses respected</li></ol></li><li><strong>Intermediate Packager:</strong><br /><ol><li>To communicate the licensing information for their package</li><li>To communicate the licensing information provided by the upstream maintainer.</li><li>To respect the licenses of the upstream maintainer</li></ol></li><li><strong>Consumers of packages:</strong><ol><li>To receive accurate and clear information of licensing of packages</li><li>To be able to comply easily with licenses for packages</li><li>To be able to trust that the package SPDX data is in alignment with the upstream maintainers license assertions.</li><li>To be able to subset, extend, or aggregate artifacts and pass on clear authoritative verifiable license for the resulting new copyrightable artifacts.</li></ol></li></ol></li><li><strong>Preconditions:</strong> <ol><li>Packager has some understanding of the licensing of the upstream project.</li></ol></li><li><strong>Main Success Senario:</strong> Packager communicates accurate complete licensing information for their package in an SPDX data format via all of the applicable SPDX delivery mechanisms.</li><li><strong>Failed End Condition:</strong> Package maintainer communicates inaccurate incomplete licensing information for their package.</li><li><strong>Trigger:</strong><ol><li>Release of a new package</li></ol></li><li><strong>Notes:</strong>   Upstream may be the root provider of the code, a source package, or some other intermediate party.  At the end of the day it's who you got the code from.</li></ol>

Technical Team/Use Cases/2.0/Intermediate packager builds binary package from upstream source that provides SPDX data

2012-08-07T19:01:26Z

Knewcomer:

<ol style="color: #4d4d4d; font-family: Arial, Helvetica, sans-serif; font-size: 13px;"><li><strong>Title:</strong> Intermediate packager builds binary package from upstream source that provides SPDX data</li><li><strong>Primary Actor:</strong> Intermediate packager (someone building a binary rpm, deb, etc from upstream source)</li><li><strong>Goal in Context:</strong> To include in the package SPDX data describing the packages licensing information for the binary package base upon the SPDX data provided by the upstream source in a way that allows the packager to verifiably reference the upstream packagers SPDX data.</li><li><strong>Stakeholders and Interests:</strong> <ol><li><strong>Upstream maintainers: </strong><ol><li>To communicate the licensing information for their copyrightable artifacts.  </li><li>To have their licenses respected</li></ol></li><li><strong>Intermediate Packager:</strong><br /><ol><li>To communicate the licensing information for their package</li><li>To communicate the licensing information provided by the upstream maintainer.</li><li>To respect the licenses of the upstream maintainer</li></ol></li><li><strong>Consumers of packages:</strong><ol><li>To receive accurate and clear information of licensing of packages</li><li>To be able to comply easily with licenses for packages</li><li>To be able to trust that the package SPDX data is in alignment with the upstream maintainers license assertions.</li><li>To be able to subset, extend, or aggregate artifacts and pass on clear authoritative verifiable license for the resulting new copyrightable artifacts.</li></ol></li></ol></li><li><strong>Preconditions:</strong> <ol><li>Upstream maintainer has provided SPDX data</li></ol></li><li><strong>Main Success Senario:</strong> Packager communicates accurate complete licensing information for their package in an SPDX data format via all of the applicable SPDX delivery mechanisms.</li><li><strong>Failed End Condition:</strong> Package maintainer communicates inaccurate incomplete licensing information for their package.</li><li><strong>Trigger:</strong><ol><li>Release of a new package</li></ol></li><li><strong>Notes:</strong>   Upstream may be the root provider of the code, a source package, or some other intermediate party.  At the end of the day it's who you got the code from.</li></ol>

Technical Team/Use Cases/2.0/Intermediate packager builds source package from upstream source that does not provide SPDX data

2012-08-07T19:00:46Z

Knewcomer:

<ol style="color: #4d4d4d; font-family: Arial, Helvetica, sans-serif; font-size: 13px;"><li><strong>Title:</strong> Intermediate packager builds source package from upstream source that does not provide SPDX data</li><li><strong>Primary Actor:</strong> Intermediate packager (someone building a rpm, deb, etc from upstream source)</li><li><strong>Goal in Context:</strong> To include in the package SPDX data describing the packages licensing information for the package base even though the upstream project is not providing SPDX data.</li><li><strong>Stakeholders and Interests:</strong> <ol><li><strong>Upstream maintainers: </strong><ol><li>To communicate the licensing information for their copyrightable artifacts.  </li><li>To have their licenses respected</li></ol></li><li><strong>Intermediate Packager:</strong><br /><ol><li>To communicate the licensing information for their package</li><li>To communicate the licensing information provided by the upstream maintainer.</li><li>To respect the licenses of the upstream maintainer</li></ol></li><li><strong>Consumers of packages:</strong><ol><li>To receive accurate and clear information of licensing of packages</li><li>To be able to comply easily with licenses for packages</li><li>To be able to trust that the package SPDX data is in alignment with the upstream maintainers license assertions.</li><li>To be able to subset, extend, or aggregate artifacts and pass on clear authoritative verifiable license for the resulting new copyrightable artifacts.</li></ol></li></ol></li><li><strong>Preconditions:</strong> <ol><li>Packager has some means to understand the licensing information from the upstream source.</li></ol></li><li><strong>Main Success Senario:</strong> Packager communicates accurate complete licensing information for their package in an SPDX data format via all of the applicable SPDX delivery mechanisms.</li><li><strong>Failed End Condition:</strong> Package maintainer communicates inaccurate incomplete licensing information for their package.</li><li><strong>Trigger:</strong><ol><li>Release of a new package</li></ol></li><li><strong>Notes:</strong>  This is a base case, it is well understood that packagers both add to the upstream source, but also subset it.</li></ol>

Technical Team/Use Cases/2.0/Intermediate packager builds source package from upstream source that provides SPDX data

2012-08-07T18:59:25Z

Knewcomer:

<ol><li style="color: #4d4d4d; font-family: Arial, Helvetica, sans-serif; font-size: 13px;"><strong>Title:</strong> Intermediate packager builds source package from upstream source that provides SPDX data</li><li style="color: #4d4d4d; font-family: Arial, Helvetica, sans-serif; font-size: 13px;"><strong>Primary Actor:</strong> Intermediate packager (someone building a rpm, deb, etc from upstream source)</li><li style="color: #4d4d4d; font-family: Arial, Helvetica, sans-serif; font-size: 13px;"><strong>Goal in Context:</strong> To include in the package SPDX data describing the packages licensing information for the package base upon the SPDX data provided by the upstream source in a way that allows the packager to verifiably reference the upstream packagers SPDX data.</li><li><strong style="color: #4d4d4d; font-family: Arial, Helvetica, sans-serif; font-size: 13px;">Stakeholders and Interests:</strong><span style="color: #4d4d4d; font-family: Arial, Helvetica, sans-serif; font-size: small;"> </span><ol><li><strong style="color: #4d4d4d; font-family: Arial, Helvetica, sans-serif; font-size: 13px;">Upstream maintainers: </strong><ol style="color: #4d4d4d; font-family: Arial, Helvetica, sans-serif; font-size: 13px;"><li>To communicate the licensing information for their copyrightable artifacts.  </li><li>To have their licenses respected</li></ol></li><li><span style="color: #4d4d4d; font-family: Arial, Helvetica, sans-serif; font-size: small;"><strong>Intermediate Packager:</strong><br /></span></li><ol><li><span style="color: #4d4d4d; font-family: Arial, Helvetica, sans-serif; font-size: small;">To communicate the licensing information for their package</span></li><li><span style="color: #4d4d4d; font-family: Arial, Helvetica, sans-serif; font-size: small;">To communicate the licensing information provided by the upstream maintainer.</span></li><li><span style="color: #4d4d4d; font-family: Arial, Helvetica, sans-serif; font-size: small;">To respect the licenses of the upstream maintainer</span></li></ol><li style="color: #4d4d4d; font-family: Arial, Helvetica, sans-serif; font-size: 13px;"><strong>Consumers of packages:</strong><ol><li>To receive accurate and clear information of licensing of packages</li><li>To be able to comply easily with licenses for packages</li><li>To be able to trust that the package SPDX data is in alignment with the upstream maintainers license assertions.</li><li>To be able to subset, extend, or aggregate artifacts and pass on clear authoritative verifiable license for the resulting new copyrightable artifacts.</li></ol></li></ol></li><li style="color: #4d4d4d; font-family: Arial, Helvetica, sans-serif; font-size: 13px;"><strong>Preconditions:</strong> <ol><li>Upstream maintainer has provided SPDX data</li></ol></li><li style="color: #4d4d4d; font-family: Arial, Helvetica, sans-serif; font-size: 13px;"><strong>Main Success Senario:</strong> Packager communicates accurate complete licensing information for their package in an SPDX data format via all of the applicable SPDX delivery mechanisms.</li><li style="color: #4d4d4d; font-family: Arial, Helvetica, sans-serif; font-size: 13px;"><strong>Failed End Condition:</strong> Package maintainer communicates inaccurate incomplete licensing information for their package.</li><li style="color: #4d4d4d; font-family: Arial, Helvetica, sans-serif; font-size: 13px;"><strong>Trigger:</strong><ol><li>Release of a new package</li></ol></li><li style="color: #4d4d4d; font-family: Arial, Helvetica, sans-serif; font-size: 13px;"><strong>Notes:</strong>  This is a base case, it is well understood that packagers both add to the upstream source, but also subset it.</li></ol>

Technical Team/Use Cases/2.0

2012-08-07T18:55:09Z

Knewcomer:

<p>We have several sources to begin pulling for SPDX Use Cases:</p><ol><li>The Pad from earlier conversations collected at <a href="http://spdx.org/wiki/use-cases-collected-20-discussion">Use Cases For SPDX 2.0 Discussion</a></li><li>The old <a href="http://spdx.org/wiki/spdx-use-case-1">SPDX 1.0 Use Cases</a> as well as the <a href="http://spdx.org/system/files/ecosystem.jpg">SDPX 1.0 Use Case Picture</a>.</li></ol><div> </div><div>I'd like to propose that we flesh out use cases here by having a brief summary listed here as a link to a more detailed child page.   Note, these use cases should be *<strong>doable</strong>* but in general not *<strong>required</strong>*.  Any item listed here that is not a link, should have a child page created for it.</div><div> </div><div><ol><li>Code commits (original work intended for the project)</li><ol><li><a href="http://spdx.org/wiki/committers-provides-spdx-data-code-being-committed">Committer provides SPDX data</a> [OK]</li><li><a href="http://spdx.org/wiki/contributor-makes-commit-subject-existing-spdx-data-project">Contributor makes commit  subject to existing SPDX data of project</a> [OK]</li></ol><li><a href="http://spdx.org/wiki/committer-annotates-source-files-spdx-data">Committer annotates source files with SPDX data</a> [OK]</li><li>Patches (original work intended for the project)</li><ol><li><a href="http://spdx.org/wiki/patch-provider-provides-spdx-data-patch">Patch provider provides SPDX data for the patch</a> [OK]</li><li><a href="http://spdx.org/wiki/patch-provider-provides-spdx-data-patch-indicating-it-licensed-however-hell-its-applied">Patch provider provides SPDX data for the patch indicating it is licensed however the hell its applied</a> [OK]</li><li><a href="http://spdx.org/wiki/patch-provider-provides-patch-subject-existing-spdx-data-project">Patch provider provides patch subject to existing SPDX data of project</a> [OK]</li></ol><li>Patch provider provides a patch that modifies existing SPDX data of project</li><ol><li><a href="http://spdx.org/wiki/downstream-consumers-contributing-patches-provide-spdx-data-upstream-doesnt-have-it">Downstream consumers contributing patches to provide SPDX data to an upstream that doesn't have it.</a>[OK]</li><li><a href="http://spdx.org/wiki/downstream-consumers-contributing-patches-provide-corrections-spdx-data-upstream-does-have-it">Downstream consumers contributing patches to provide corrections to SPDX data for an upstream that does have it.</a> [OK]</li></ol><li><a href="http://spdx.org/wiki/spdx-20-usecase-upstream-maintainer-providing-spdx-data">Upstream maintainer providing SPDX data</a></li><ol><li><a href="http://spdx.org/wiki/upstream-maintainer-providing-spdx-data-source-archive">Upstream maintainer providing SPDX data in source archive</a>[OK]</li><li><a href="http://spdx.org/wiki/upstream-maintainer-providing-spdx-data-scm">Upstream maintainer providing SPDX data in SCM</a> [OK]</li><li><a href="http://spdx.org/wiki/upstream-maintainer-providing-spdx-data-url">Upstream maintainer providing SPDX data at a URL</a> [OK]</li><li><a href="http://spdx.org/wiki/upstream-maintainer-preparing-release-artifacts-including-spdx-data">Upstream maintainer preparing release artifacts (including SPDX data).</a> [OK]</li></ol><li>Project maintainer incorporates another project</li><ol><li><a href="http://spdx.org/wiki/project-maintainer-incorporates-another-project-including-source">Project maintainer incorporates another project by including source</a> [OK]</li><li><a href="http://spdx.org/wiki/project-maintainer-incorporates-another-project-including-binary">Project maintainer incorporates another project by including binary</a> [OK]</li><li><a href="http://spdx.org/wiki/project-maintainer-pulling-individual-files-out-another-project-subsetting">Project maintainer pulling individual files out of another project (subsetting)</a> [OK]</li></ol><li>SPDX-Lite:</li><ol><li><a href="http://spdx.org/wiki/low-cost-spdx-file">Allow a low investment SPDX producer to produce valid SPDX data</a> [OK-fathomed but not Approved for Implementation]</li><li><a href="http://spdx.org/wiki/producing-valid-spdx-files-face-missing-data">Produce a valid SPDX dataset even if some data is missing</a> [OK]</li></ol><li>Intermediate packager (rpm, deb, etc) passing on and adding to SPDX Data</li><ol><li>Intermediate packager builds source package from upstream source</li><ol><li><a href="http://spdx.org/wiki/intermediate-packager-builds-source-package-upstream-source-provides-spdx-data">Intermediate packager builds source package from upstream source that provides SPDX data</a> [OK]</li><li><a href="http://spdx.org/wiki/intermediate-packager-builds-source-package-upstream-source-does-not-provide-spdx-data">Intermediate packager builds source package from upstream source that does not provide SPDX data</a> [OK]</li></ol><li>Intermediate packager builds binary package from upstream source</li><ol><li><a href="http://spdx.org/wiki/intermediate-packager-builds-binary-package-upstream-source-provides-spdx-data">Intermediate packager builds binary package from upstream source that provides SPDX data</a> [OK]</li><li><a href="http://spdx.org/wiki/intermediate-packager-builds-binary-package-upstream-source-does-not-provides-spdx-data">Intermediate packager builds binary package from upstream source that does not provides SPDX data [OK]</a></li></ol><li>Intermediate packager adds patches to upstream source </li><ol><li><a href="http://spdx.org/wiki/intermediate-packager-adds-patches-upstream-source-provides-spdx-data">Intermediate packager adds patches to upstream source that provides SPDX data</a> [OK]</li><li><a href="http://spdx.org/wiki/intermediate-packager-adds-patches-upstream-source-does-not-provide-spdx-data">Intermediate packager adds patches to upstream source that does not provide SPDX data [OK]</a></li></ol><li>Intermediate packager adds someone else's patches to upstream source</li><ol><li><a href="http://spdx.org/wiki/intermediate-packager-adds-someone-elses-patches-upstream-source-provides-spdx-data">Intermediate packager adds someone else's patches to upstream source that provides SPDX data</a> [OK]</li><li><a href="http://spdx.org/wiki/intermediate-packager-adds-someone-elses-patches-upstream-source-does-not-provide-spdx-data">Intermediate packager adds someone else's patches to upstream source that does not provide SPDX data</a> [OK]</li></ol><li>Intermediate packager subsetting upstream source</li><ol><li><a href="http://spdx.org/wiki/intermediate-packager-subsetting-upstream-source-provides-spdx-data">Intermediate packager subsetting upstream source that provides SPDX data</a> [OK]</li><li><a href="http://spdx.org/wiki/intermediate-packager-subsetting-upstream-source-does-not-provide-spdx-data">Intermediate packager subsetting upstream source that does not provide SPDX data [OK]</a></li></ol></ol><li>Build systems (build systems want to pass on SPDX data for the thing they are building)</li><ol><li><a href="http://www.spdx.org/wiki/spdx-use-case-build-systems-yocto">Yocto</a></li><li>Linking</li><ol><li><a href="http://spdx.org/wiki/debian-has-interest-only-building-things-are-linking-license-compatible">Debian has an interest in only building things that are linking license compatible</a></li></ol><li>I just made a binary out of some source</li><ol><li><a href="http://spdx.org/wiki/spdx-data-indicating-subset-source-made-it-particular-binary-or-binary-package">SPDX data indicating subset of the source that made it into a particular binary or binary package</a></li></ol></ol><li>Aggregator aggregating many 'copyrightable items' for redistribution</li><ol><li><a title="Linux Distro" href="https://spdx.org/wiki/linux-distro">Linux Distros</a></li><li><a href="http://spdx.org/wiki/embedded-images-eg-router-images-switch-images">Embedded Images (e.g. router images, switch images)</a></li><li><a href="http://spdx.org/wiki/spdx-20-usecase-reference-implementations">Reference implementations </a>[Jack Manbeck]</li><li><a href="http://spdx.org/wiki/spdx-20-usecase-application-which-ships-documentation-media-software">Application which ships with documentation +  media + software</a> [Jack Manbeck]</li><li><a title="Use case details" href="http://spdx.org/wiki/application-which-ships-contrib-libraries">Application which ships with a contrib libraries</a></li><li><a title="Use case details" href="http://spdx.org/wiki/application-which-ships-development-tools">Application which ships with development tools</a></li><li><a href="http://spdx.org/wiki/subsetting-out-only-shippable-bits-stuff-coming-sdk">Subsetting out only the shippable bits of stuff coming from an SDK</a></li><li><a href="http://spdx.org/wiki/aggregators-aggregating-other-aggregations-redistribution">Aggregators aggregating other aggregations for redistribution</a></li></ol><li>Consumers receiving SPDX data</li><ol><li><a href="http://spdx.org/wiki/provide-sufficient-data-allow-consumer-comply-licenses-redistribution">Provide sufficient data to allow consumer to comply with licenses on redistribution</a></li></ol><li><a href="http://spdx.org/wiki/consuming-code-snippets">Consuming code snippets </a>(God help us all) (subfile pieces of code not originally intended for the project)</li><li>Signoff/multiple signoff on SPDX data</li><ol><li><a target="_blank" title="Contracts with multiple parties requiring signoff by all" href="https://spdx.org/wiki/multi-party-contracts">Contracts with multiple parties requiring signoff by al</a>l [Kate Stewart]</li></ol><li>Third party does licensing analysis</li><ol><li><a href="http://spdx.org/wiki/third-party-produces-bill-materials-software-package">Third party generates license analysis</a></li><li><a href="http://spdx.org/wiki/collecting-enough-information-allow-auditor-make-recommendations-remove-or-not-component">Collecting enough information to allow auditor to make recommendations to remove or not a component</a></li></ol><li>Auditor Analyzing/Sanity-checking/correcting Bill of Material he's handed</li><ol><li><a href="http://spdx.org/wiki/use-case-backtrack-binary-source-files">Backtrack from compiled/binary file to constituent files</a> </li><li>outbound: validate that SPDX goes hand in hand with what's being shipped [Kirsten Newcomer]</li><ol><li><a href="http://spdx.org/wiki/check-see-if-spdx-data-provided-matches-files-provided">Check to see if the SPDX data provided matches the files provided</a></li></ol></ol><li>Extensions:</li><ol><li><a href="http://spdx.org/wiki/communicate-data-beyond-what-described-spec">Communicate data beyond what is described in spec between consenting parties w/o breaking consumers that are not in the know</a></li><li><a href="http://spdx.org/wiki/license-list-extension">License list extensions, how do you handle folks who have more licenses than SPDX</a></li><li><a href="http://spdx.org/wiki/decorating-already-produces-and-signed-spdx-dataset-extension-data">Decorating an already produces and signed SPDX dataset with extension data</a> [Bill Schineller]</li></ol><li>Other arising during vetting...</li><ol><li>Given 2 SPDX files about the same codebase from the same source, be able to tell which is the later rev / more current and correct one.</li></ol></ol><div> Cross-cutting concerns:</div><div><div><ol><li>Provenance (the need to optionally use signing to validate who said what)</li><li>Trust</li><li>Handling staleness of data</li><li>Composite licensing</li><li>Ease of sharing information</li><ol><li>Collecting tribal knowledge along the way </li></ol><li>Guarding against file bloat</li><li>Simple simple simple</li><li>SPDX-Lite:</li><li>Clarity</li><li>Automation/toolifiability</li><li>Regionality</li></ol></div></div></div><div><h2>Themes:</h2></div><div> </div><div>Looking at these Use Cases, there are some underlying themes:</div><div><ol><li>Root of data (closer to upstream the better)</li><li>Subsetting of copyrightable things (and their SPDX data) (<strong>Note</strong>: Subsets of copyrightable things are usually also copyrightable things)</li><li>Aggregation of copyrightable things (and their SPDX data) (<strong>Note</strong>: Aggregations of copyrightable things are usually also copyrightable things).</li></ol></div><div> </div><div> </div><p> </p>

Technical Team/Use Cases/2.0/Intermediate packager subsetting upstream source that provides SPDX data

2012-08-07T18:51:02Z

Knewcomer:

<ol style="color: #4d4d4d; font-family: Arial, Helvetica, sans-serif; font-size: 13px;"><li><strong>Title:</strong> Intermediate packager subsetting upstream source that provides SPDX data</li><li><strong>Primary Actor:</strong> Intermediate packager (someone building a rpm, deb, etc from upstream source)</li><li><strong>Goal in Context:</strong> To include in the package SPDX data describing the packages licensing information for the package base upon the SPDX data provided by the upstream source in a way that allows the packager to verifiably reference the upstream packagers SPDX data and to make clear that only a subset of the copyrightable artifacts provided by upstream maintainer are included in the copyright artifacts provided in the package.  Examples would include -dev packages that only include headers, packages that do not package contrib/ subdirectories, or otherwise break up what upstream has provided into package shaped pieces.</li><li><strong>Stakeholders and Interests:</strong> <ol><li><strong>Upstream maintainers: </strong><ol><li>To communicate the licensing information for their copyrightable artifacts.  </li><li>To have their licenses respected</li></ol></li><li><strong>Intermediate Packager:</strong><br /><ol><li>To communicate the licensing information for their package</li><li>To communicate the licensing information provided by the upstream maintainer.</li><li>To indicate that they are only passing on copyrightable artifacts based on a subset of the copyrightable artifacts provided by the upstream maintainers.</li><li>To respect the licenses of the upstream maintainer</li></ol></li><li><strong>Consumers of packages:</strong><ol><li>To receive accurate and clear information of licensing of packages</li><li>To be able to comply easily with licenses for packages</li><li>To be able to trust that the package SPDX data is in alignment with the upstream maintainers license assertions.</li><li>To be able to subset, extend, or aggregate artifacts and pass on clear authoritative verifiable license for the resulting new copyrightable artifacts.</li></ol></li></ol></li><li><strong>Preconditions:</strong> <ol><li>Upstream maintainer has provided SPDX data</li><li>Packager understands how they are subsetting the upstream source</li></ol></li><li><strong>Main Success Senario:</strong> Packager communicates accurate complete licensing information for their package in an SPDX data format in the package archive in such a way that indicates they are only using parts of what is provided in the upstream source.</li><ol><li>NOTE: sub-setting the data from the upstream SPDX data may require modifications of the original data in the newly created sub-set. For example, eliminating the contrib files might mean that some licenses are no longer applicable.</li></ol><li><strong>Failed End Condition:</strong> Package maintainer communicates inaccurate incomplete licensing information for their package.</li><li><strong>Trigger:</strong><ol><li>Release of a new package</li></ol></li><li><strong>Notes:</strong>  Upstream may be the root provider of the code, a source package, or some other intermediate party.  At the end of the day it's who you got the code from.</li></ol>

Technical Team/Use Cases/2.0

2012-08-07T18:37:27Z

Knewcomer:

<p>We have several sources to begin pulling for SPDX Use Cases:</p><ol><li>The Pad from earlier conversations collected at <a href="http://spdx.org/wiki/use-cases-collected-20-discussion">Use Cases For SPDX 2.0 Discussion</a></li><li>The old <a href="http://spdx.org/wiki/spdx-use-case-1">SPDX 1.0 Use Cases</a> as well as the <a href="http://spdx.org/system/files/ecosystem.jpg">SDPX 1.0 Use Case Picture</a>.</li></ol><div> </div><div>I'd like to propose that we flesh out use cases here by having a brief summary listed here as a link to a more detailed child page.   Note, these use cases should be *<strong>doable</strong>* but in general not *<strong>required</strong>*.  Any item listed here that is not a link, should have a child page created for it.</div><div> </div><div><ol><li>Code commits (original work intended for the project)</li><ol><li><a href="http://spdx.org/wiki/committers-provides-spdx-data-code-being-committed">Committer provides SPDX data</a> [OK]</li><li><a href="http://spdx.org/wiki/contributor-makes-commit-subject-existing-spdx-data-project">Contributor makes commit  subject to existing SPDX data of project</a> [OK]</li></ol><li><a href="http://spdx.org/wiki/committer-annotates-source-files-spdx-data">Committer annotates source files with SPDX data</a> [OK]</li><li>Patches (original work intended for the project)</li><ol><li><a href="http://spdx.org/wiki/patch-provider-provides-spdx-data-patch">Patch provider provides SPDX data for the patch</a> [OK]</li><li><a href="http://spdx.org/wiki/patch-provider-provides-spdx-data-patch-indicating-it-licensed-however-hell-its-applied">Patch provider provides SPDX data for the patch indicating it is licensed however the hell its applied</a> [OK]</li><li><a href="http://spdx.org/wiki/patch-provider-provides-patch-subject-existing-spdx-data-project">Patch provider provides patch subject to existing SPDX data of project</a> [OK]</li></ol><li>Patch provider provides a patch that modifies existing SPDX data of project</li><ol><li><a href="http://spdx.org/wiki/downstream-consumers-contributing-patches-provide-spdx-data-upstream-doesnt-have-it">Downstream consumers contributing patches to provide SPDX data to an upstream that doesn't have it.</a>[OK]</li><li><a href="http://spdx.org/wiki/downstream-consumers-contributing-patches-provide-corrections-spdx-data-upstream-does-have-it">Downstream consumers contributing patches to provide corrections to SPDX data for an upstream that does have it.</a> [OK]</li></ol><li><a href="http://spdx.org/wiki/spdx-20-usecase-upstream-maintainer-providing-spdx-data">Upstream maintainer providing SPDX data</a></li><ol><li><a href="http://spdx.org/wiki/upstream-maintainer-providing-spdx-data-source-archive">Upstream maintainer providing SPDX data in source archive</a>[OK]</li><li><a href="http://spdx.org/wiki/upstream-maintainer-providing-spdx-data-scm">Upstream maintainer providing SPDX data in SCM</a> [OK]</li><li><a href="http://spdx.org/wiki/upstream-maintainer-providing-spdx-data-url">Upstream maintainer providing SPDX data at a URL</a> [OK]</li><li><a href="http://spdx.org/wiki/upstream-maintainer-preparing-release-artifacts-including-spdx-data">Upstream maintainer preparing release artifacts (including SPDX data).</a> [OK]</li></ol><li>Project maintainer incorporates another project</li><ol><li><a href="http://spdx.org/wiki/project-maintainer-incorporates-another-project-including-source">Project maintainer incorporates another project by including source</a> [OK]</li><li><a href="http://spdx.org/wiki/project-maintainer-incorporates-another-project-including-binary">Project maintainer incorporates another project by including binary</a> [OK]</li><li><a href="http://spdx.org/wiki/project-maintainer-pulling-individual-files-out-another-project-subsetting">Project maintainer pulling individual files out of another project (subsetting)</a> [OK]</li></ol><li>SPDX-Lite:</li><ol><li><a href="http://spdx.org/wiki/low-cost-spdx-file">Allow a low investment SPDX producer to produce valid SPDX data</a> [OK-fathomed but not Approved for Implementation]</li><li><a href="http://spdx.org/wiki/producing-valid-spdx-files-face-missing-data">Produce a valid SPDX dataset even if some data is missing</a> [OK]</li></ol><li>Intermediate packager (rpm, deb, etc) passing on and adding to SPDX Data</li><ol><li>Intermediate packager builds source package from upstream source</li><ol><li><a href="http://spdx.org/wiki/intermediate-packager-builds-source-package-upstream-source-provides-spdx-data">Intermediate packager builds source package from upstream source that provides SPDX data</a> [OK]</li><li><a href="http://spdx.org/wiki/intermediate-packager-builds-source-package-upstream-source-does-not-provide-spdx-data">Intermediate packager builds source package from upstream source that does not provide SPDX data</a> [OK]</li></ol><li>Intermediate packager builds binary package from upstream source</li><ol><li><a href="http://spdx.org/wiki/intermediate-packager-builds-binary-package-upstream-source-provides-spdx-data">Intermediate packager builds binary package from upstream source that provides SPDX data</a> [OK]</li><li><a href="http://spdx.org/wiki/intermediate-packager-builds-binary-package-upstream-source-does-not-provides-spdx-data">Intermediate packager builds binary package from upstream source that does not provides SPDX data [OK]</a></li></ol><li>Intermediate packager adds patches to upstream source </li><ol><li><a href="http://spdx.org/wiki/intermediate-packager-adds-patches-upstream-source-provides-spdx-data">Intermediate packager adds patches to upstream source that provides SPDX data</a> [OK]</li><li><a href="http://spdx.org/wiki/intermediate-packager-adds-patches-upstream-source-does-not-provide-spdx-data">Intermediate packager adds patches to upstream source that does not provide SPDX data [OK]</a></li></ol><li>Intermediate packager adds someone else's patches to upstream source</li><ol><li><a href="http://spdx.org/wiki/intermediate-packager-adds-someone-elses-patches-upstream-source-provides-spdx-data">Intermediate packager adds someone else's patches to upstream source that provides SPDX data</a></li><li><a href="http://spdx.org/wiki/intermediate-packager-adds-someone-elses-patches-upstream-source-does-not-provide-spdx-data">Intermediate packager adds someone else's patches to upstream source that does not provide SPDX data</a></li></ol><li>Intermediate packager subsetting upstream source</li><ol><li><a href="http://spdx.org/wiki/intermediate-packager-subsetting-upstream-source-provides-spdx-data">Intermediate packager subsetting upstream source that provides SPDX data</a></li><li><a href="http://spdx.org/wiki/intermediate-packager-subsetting-upstream-source-does-not-provide-spdx-data">Intermediate packager subsetting upstream source that does not provide SPDX data</a></li></ol></ol><li>Build systems (build systems want to pass on SPDX data for the thing they are building)</li><ol><li><a href="http://www.spdx.org/wiki/spdx-use-case-build-systems-yocto">Yocto</a></li><li>Linking</li><ol><li><a href="http://spdx.org/wiki/debian-has-interest-only-building-things-are-linking-license-compatible">Debian has an interest in only building things that are linking license compatible</a></li></ol><li>I just made a binary out of some source</li><ol><li><a href="http://spdx.org/wiki/spdx-data-indicating-subset-source-made-it-particular-binary-or-binary-package">SPDX data indicating subset of the source that made it into a particular binary or binary package</a></li></ol></ol><li>Aggregator aggregating many 'copyrightable items' for redistribution</li><ol><li><a title="Linux Distro" href="https://spdx.org/wiki/linux-distro">Linux Distros</a></li><li><a href="http://spdx.org/wiki/embedded-images-eg-router-images-switch-images">Embedded Images (e.g. router images, switch images)</a></li><li><a href="http://spdx.org/wiki/spdx-20-usecase-reference-implementations">Reference implementations </a>[Jack Manbeck]</li><li><a href="http://spdx.org/wiki/spdx-20-usecase-application-which-ships-documentation-media-software">Application which ships with documentation +  media + software</a> [Jack Manbeck]</li><li><a title="Use case details" href="http://spdx.org/wiki/application-which-ships-contrib-libraries">Application which ships with a contrib libraries</a></li><li><a title="Use case details" href="http://spdx.org/wiki/application-which-ships-development-tools">Application which ships with development tools</a></li><li><a href="http://spdx.org/wiki/subsetting-out-only-shippable-bits-stuff-coming-sdk">Subsetting out only the shippable bits of stuff coming from an SDK</a></li><li><a href="http://spdx.org/wiki/aggregators-aggregating-other-aggregations-redistribution">Aggregators aggregating other aggregations for redistribution</a></li></ol><li>Consumers receiving SPDX data</li><ol><li><a href="http://spdx.org/wiki/provide-sufficient-data-allow-consumer-comply-licenses-redistribution">Provide sufficient data to allow consumer to comply with licenses on redistribution</a></li></ol><li><a href="http://spdx.org/wiki/consuming-code-snippets">Consuming code snippets </a>(God help us all) (subfile pieces of code not originally intended for the project)</li><li>Signoff/multiple signoff on SPDX data</li><ol><li><a target="_blank" title="Contracts with multiple parties requiring signoff by all" href="https://spdx.org/wiki/multi-party-contracts">Contracts with multiple parties requiring signoff by al</a>l [Kate Stewart]</li></ol><li>Third party does licensing analysis</li><ol><li><a href="http://spdx.org/wiki/third-party-produces-bill-materials-software-package">Third party generates license analysis</a></li><li><a href="http://spdx.org/wiki/collecting-enough-information-allow-auditor-make-recommendations-remove-or-not-component">Collecting enough information to allow auditor to make recommendations to remove or not a component</a></li></ol><li>Auditor Analyzing/Sanity-checking/correcting Bill of Material he's handed</li><ol><li><a href="http://spdx.org/wiki/use-case-backtrack-binary-source-files">Backtrack from compiled/binary file to constituent files</a> </li><li>outbound: validate that SPDX goes hand in hand with what's being shipped [Kirsten Newcomer]</li><ol><li><a href="http://spdx.org/wiki/check-see-if-spdx-data-provided-matches-files-provided">Check to see if the SPDX data provided matches the files provided</a></li></ol></ol><li>Extensions:</li><ol><li><a href="http://spdx.org/wiki/communicate-data-beyond-what-described-spec">Communicate data beyond what is described in spec between consenting parties w/o breaking consumers that are not in the know</a></li><li><a href="http://spdx.org/wiki/license-list-extension">License list extensions, how do you handle folks who have more licenses than SPDX</a></li><li><a href="http://spdx.org/wiki/decorating-already-produces-and-signed-spdx-dataset-extension-data">Decorating an already produces and signed SPDX dataset with extension data</a> [Bill Schineller]</li></ol><li>Other arising during vetting...</li><ol><li>Given 2 SPDX files about the same codebase from the same source, be able to tell which is the later rev / more current and correct one.</li></ol></ol><div> Cross-cutting concerns:</div><div><div><ol><li>Provenance (the need to optionally use signing to validate who said what)</li><li>Trust</li><li>Handling staleness of data</li><li>Composite licensing</li><li>Ease of sharing information</li><ol><li>Collecting tribal knowledge along the way </li></ol><li>Guarding against file bloat</li><li>Simple simple simple</li><li>SPDX-Lite:</li><li>Clarity</li><li>Automation/toolifiability</li><li>Regionality</li></ol></div></div></div><div><h2>Themes:</h2></div><div> </div><div>Looking at these Use Cases, there are some underlying themes:</div><div><ol><li>Root of data (closer to upstream the better)</li><li>Subsetting of copyrightable things (and their SPDX data) (<strong>Note</strong>: Subsets of copyrightable things are usually also copyrightable things)</li><li>Aggregation of copyrightable things (and their SPDX data) (<strong>Note</strong>: Aggregations of copyrightable things are usually also copyrightable things).</li></ol></div><div> </div><div> </div><p> </p>

Technical Team/Use Cases/2.0/Intermediate packager adds patches to upstream source that does not provide SPDX data

2012-08-07T18:34:07Z

Knewcomer:

<ol style="color: #4d4d4d; font-family: Arial, Helvetica, sans-serif; font-size: 13px;"><li><strong>Title:</strong> Intermediate packager adds patches to upstream source that does not provide SPDX data</li><li><strong>Primary Actor:</strong> Intermediate packager (someone building a rpm, deb, etc from upstream source)</li><li><strong>Goal in Context:</strong> To include in the package SPDX data describing the packages licensing information for the package when the upstream source does not include SPDX data and also to include SPDX data describing the packagers additions (patches) to the project.</li><li><strong>Stakeholders and Interests:</strong> <ol><li><strong>Upstream maintainers: </strong><ol><li>To communicate the licensing information for their copyrightable artifacts.  </li><li>To have their licenses respected</li></ol></li><li><strong>Intermediate Packager:</strong><br /><ol><li>To communicate the licensing information for their package</li><li>To communicate the licensing information for the packagers additions (patches) to the upstream source.</li><li>To communicate the licensing information provided by the upstream maintainer.</li><li>To respect the licenses of the upstream maintainer</li></ol></li><li><strong>Consumers of packages:</strong><ol><li>To receive accurate and clear information of licensing of packages</li><li>To receive accurate and clear information of the licensing of the packagers additions (patches) to the upstream source.</li><li>To be able to comply easily with licenses for packages</li><li>To be able to trust that the package SPDX data is in alignment with the upstream maintainers license assertions.</li><li>To be able to subset, extend, or aggregate artifacts and pass on clear authoritative verifiable license for the resulting new copyrightable artifacts.</li></ol></li></ol></li><li><strong>Preconditions:</strong> <ol><li>Intermediate Packager understands the licensing information of the upstream project.</li><li>Package maintainer has selected a license for their additions (patches) to the upstream source</li></ol></li><li><strong>Main Success Senario:</strong> Packager communicates accurate complete licensing information for their package in an SPDX data format </li><ol><li>in the package archive.</li><li>or in a sidecar (URL)</li><li>or in the SCM </li></ol><li><strong>Failed End Condition:</strong> Package maintainer communicates inaccurate incomplete licensing information for their package.</li><li><strong>Trigger:</strong><ol><li>Release of a new package</li></ol></li><li><strong>Notes:</strong>  </li><li></li></ol>

Technical Team/Use Cases/2.0

2012-08-07T18:24:43Z

Knewcomer:

<p>We have several sources to begin pulling for SPDX Use Cases:</p><ol><li>The Pad from earlier conversations collected at <a href="http://spdx.org/wiki/use-cases-collected-20-discussion">Use Cases For SPDX 2.0 Discussion</a></li><li>The old <a href="http://spdx.org/wiki/spdx-use-case-1">SPDX 1.0 Use Cases</a> as well as the <a href="http://spdx.org/system/files/ecosystem.jpg">SDPX 1.0 Use Case Picture</a>.</li></ol><div> </div><div>I'd like to propose that we flesh out use cases here by having a brief summary listed here as a link to a more detailed child page.   Note, these use cases should be *<strong>doable</strong>* but in general not *<strong>required</strong>*.  Any item listed here that is not a link, should have a child page created for it.</div><div> </div><div><ol><li>Code commits (original work intended for the project)</li><ol><li><a href="http://spdx.org/wiki/committers-provides-spdx-data-code-being-committed">Committer provides SPDX data</a> [OK]</li><li><a href="http://spdx.org/wiki/contributor-makes-commit-subject-existing-spdx-data-project">Contributor makes commit  subject to existing SPDX data of project</a> [OK]</li></ol><li><a href="http://spdx.org/wiki/committer-annotates-source-files-spdx-data">Committer annotates source files with SPDX data</a> [OK]</li><li>Patches (original work intended for the project)</li><ol><li><a href="http://spdx.org/wiki/patch-provider-provides-spdx-data-patch">Patch provider provides SPDX data for the patch</a> [OK]</li><li><a href="http://spdx.org/wiki/patch-provider-provides-spdx-data-patch-indicating-it-licensed-however-hell-its-applied">Patch provider provides SPDX data for the patch indicating it is licensed however the hell its applied</a> [OK]</li><li><a href="http://spdx.org/wiki/patch-provider-provides-patch-subject-existing-spdx-data-project">Patch provider provides patch subject to existing SPDX data of project</a> [OK]</li></ol><li>Patch provider provides a patch that modifies existing SPDX data of project</li><ol><li><a href="http://spdx.org/wiki/downstream-consumers-contributing-patches-provide-spdx-data-upstream-doesnt-have-it">Downstream consumers contributing patches to provide SPDX data to an upstream that doesn't have it.</a>[OK]</li><li><a href="http://spdx.org/wiki/downstream-consumers-contributing-patches-provide-corrections-spdx-data-upstream-does-have-it">Downstream consumers contributing patches to provide corrections to SPDX data for an upstream that does have it.</a> [OK]</li></ol><li><a href="http://spdx.org/wiki/spdx-20-usecase-upstream-maintainer-providing-spdx-data">Upstream maintainer providing SPDX data</a></li><ol><li><a href="http://spdx.org/wiki/upstream-maintainer-providing-spdx-data-source-archive">Upstream maintainer providing SPDX data in source archive</a>[OK]</li><li><a href="http://spdx.org/wiki/upstream-maintainer-providing-spdx-data-scm">Upstream maintainer providing SPDX data in SCM</a> [OK]</li><li><a href="http://spdx.org/wiki/upstream-maintainer-providing-spdx-data-url">Upstream maintainer providing SPDX data at a URL</a> [OK]</li><li><a href="http://spdx.org/wiki/upstream-maintainer-preparing-release-artifacts-including-spdx-data">Upstream maintainer preparing release artifacts (including SPDX data).</a> [OK]</li></ol><li>Project maintainer incorporates another project</li><ol><li><a href="http://spdx.org/wiki/project-maintainer-incorporates-another-project-including-source">Project maintainer incorporates another project by including source</a> [OK]</li><li><a href="http://spdx.org/wiki/project-maintainer-incorporates-another-project-including-binary">Project maintainer incorporates another project by including binary</a> [OK]</li><li><a href="http://spdx.org/wiki/project-maintainer-pulling-individual-files-out-another-project-subsetting">Project maintainer pulling individual files out of another project (subsetting)</a> [OK]</li></ol><li>SPDX-Lite:</li><ol><li><a href="http://spdx.org/wiki/low-cost-spdx-file">Allow a low investment SPDX producer to produce valid SPDX data</a> [OK-fathomed but not Approved for Implementation]</li><li><a href="http://spdx.org/wiki/producing-valid-spdx-files-face-missing-data">Produce a valid SPDX dataset even if some data is missing</a> [OK]</li></ol><li>Intermediate packager (rpm, deb, etc) passing on and adding to SPDX Data</li><ol><li>Intermediate packager builds source package from upstream source</li><ol><li><a href="http://spdx.org/wiki/intermediate-packager-builds-source-package-upstream-source-provides-spdx-data">Intermediate packager builds source package from upstream source that provides SPDX data</a> [OK]</li><li><a href="http://spdx.org/wiki/intermediate-packager-builds-source-package-upstream-source-does-not-provide-spdx-data">Intermediate packager builds source package from upstream source that does not provide SPDX data</a> [OK]</li></ol><li>Intermediate packager builds binary package from upstream source</li><ol><li><a href="http://spdx.org/wiki/intermediate-packager-builds-binary-package-upstream-source-provides-spdx-data">Intermediate packager builds binary package from upstream source that provides SPDX data</a></li><li><a href="http://spdx.org/wiki/intermediate-packager-builds-binary-package-upstream-source-does-not-provides-spdx-data">Intermediate packager builds binary package from upstream source that does not provides SPDX data</a></li></ol><li>Intermediate packager adds patches to upstream source </li><ol><li><a href="http://spdx.org/wiki/intermediate-packager-adds-patches-upstream-source-provides-spdx-data">Intermediate packager adds patches to upstream source that provides SPDX data</a></li><li><a href="http://spdx.org/wiki/intermediate-packager-adds-patches-upstream-source-does-not-provide-spdx-data">Intermediate packager adds patches to upstream source that does not provide SPDX data</a></li></ol><li>Intermediate packager adds someone else's patches to upstream source</li><ol><li><a href="http://spdx.org/wiki/intermediate-packager-adds-someone-elses-patches-upstream-source-provides-spdx-data">Intermediate packager adds someone else's patches to upstream source that provides SPDX data</a></li><li><a href="http://spdx.org/wiki/intermediate-packager-adds-someone-elses-patches-upstream-source-does-not-provide-spdx-data">Intermediate packager adds someone else's patches to upstream source that does not provide SPDX data</a></li></ol><li>Intermediate packager subsetting upstream source</li><ol><li><a href="http://spdx.org/wiki/intermediate-packager-subsetting-upstream-source-provides-spdx-data">Intermediate packager subsetting upstream source that provides SPDX data</a></li><li><a href="http://spdx.org/wiki/intermediate-packager-subsetting-upstream-source-does-not-provide-spdx-data">Intermediate packager subsetting upstream source that does not provide SPDX data</a></li></ol></ol><li>Build systems (build systems want to pass on SPDX data for the thing they are building)</li><ol><li><a href="http://www.spdx.org/wiki/spdx-use-case-build-systems-yocto">Yocto</a></li><li>Linking</li><ol><li><a href="http://spdx.org/wiki/debian-has-interest-only-building-things-are-linking-license-compatible">Debian has an interest in only building things that are linking license compatible</a></li></ol><li>I just made a binary out of some source</li><ol><li><a href="http://spdx.org/wiki/spdx-data-indicating-subset-source-made-it-particular-binary-or-binary-package">SPDX data indicating subset of the source that made it into a particular binary or binary package</a></li></ol></ol><li>Aggregator aggregating many 'copyrightable items' for redistribution</li><ol><li><a title="Linux Distro" href="https://spdx.org/wiki/linux-distro">Linux Distros</a></li><li><a href="http://spdx.org/wiki/embedded-images-eg-router-images-switch-images">Embedded Images (e.g. router images, switch images)</a></li><li><a href="http://spdx.org/wiki/spdx-20-usecase-reference-implementations">Reference implementations </a>[Jack Manbeck]</li><li><a href="http://spdx.org/wiki/spdx-20-usecase-application-which-ships-documentation-media-software">Application which ships with documentation +  media + software</a> [Jack Manbeck]</li><li><a title="Use case details" href="http://spdx.org/wiki/application-which-ships-contrib-libraries">Application which ships with a contrib libraries</a></li><li><a title="Use case details" href="http://spdx.org/wiki/application-which-ships-development-tools">Application which ships with development tools</a></li><li><a href="http://spdx.org/wiki/subsetting-out-only-shippable-bits-stuff-coming-sdk">Subsetting out only the shippable bits of stuff coming from an SDK</a></li><li><a href="http://spdx.org/wiki/aggregators-aggregating-other-aggregations-redistribution">Aggregators aggregating other aggregations for redistribution</a></li></ol><li>Consumers receiving SPDX data</li><ol><li><a href="http://spdx.org/wiki/provide-sufficient-data-allow-consumer-comply-licenses-redistribution">Provide sufficient data to allow consumer to comply with licenses on redistribution</a></li></ol><li><a href="http://spdx.org/wiki/consuming-code-snippets">Consuming code snippets </a>(God help us all) (subfile pieces of code not originally intended for the project)</li><li>Signoff/multiple signoff on SPDX data</li><ol><li><a target="_blank" title="Contracts with multiple parties requiring signoff by all" href="https://spdx.org/wiki/multi-party-contracts">Contracts with multiple parties requiring signoff by al</a>l [Kate Stewart]</li></ol><li>Third party does licensing analysis</li><ol><li><a href="http://spdx.org/wiki/third-party-produces-bill-materials-software-package">Third party generates license analysis</a></li><li><a href="http://spdx.org/wiki/collecting-enough-information-allow-auditor-make-recommendations-remove-or-not-component">Collecting enough information to allow auditor to make recommendations to remove or not a component</a></li></ol><li>Auditor Analyzing/Sanity-checking/correcting Bill of Material he's handed</li><ol><li><a href="http://spdx.org/wiki/use-case-backtrack-binary-source-files">Backtrack from compiled/binary file to constituent files</a> </li><li>outbound: validate that SPDX goes hand in hand with what's being shipped [Kirsten Newcomer]</li><ol><li><a href="http://spdx.org/wiki/check-see-if-spdx-data-provided-matches-files-provided">Check to see if the SPDX data provided matches the files provided</a></li></ol></ol><li>Extensions:</li><ol><li><a href="http://spdx.org/wiki/communicate-data-beyond-what-described-spec">Communicate data beyond what is described in spec between consenting parties w/o breaking consumers that are not in the know</a></li><li><a href="http://spdx.org/wiki/license-list-extension">License list extensions, how do you handle folks who have more licenses than SPDX</a></li><li><a href="http://spdx.org/wiki/decorating-already-produces-and-signed-spdx-dataset-extension-data">Decorating an already produces and signed SPDX dataset with extension data</a> [Bill Schineller]</li></ol><li>Other arising during vetting...</li><ol><li>Given 2 SPDX files about the same codebase from the same source, be able to tell which is the later rev / more current and correct one.</li></ol></ol><div> Cross-cutting concerns:</div><div><div><ol><li>Provenance (the need to optionally use signing to validate who said what)</li><li>Trust</li><li>Handling staleness of data</li><li>Composite licensing</li><li>Ease of sharing information</li><ol><li>Collecting tribal knowledge along the way </li></ol><li>Guarding against file bloat</li><li>Simple simple simple</li><li>SPDX-Lite:</li><li>Clarity</li><li>Automation/toolifiability</li><li>Regionality</li></ol></div></div></div><div><h2>Themes:</h2></div><div> </div><div>Looking at these Use Cases, there are some underlying themes:</div><div><ol><li>Root of data (closer to upstream the better)</li><li>Subsetting of copyrightable things (and their SPDX data) (<strong>Note</strong>: Subsets of copyrightable things are usually also copyrightable things)</li><li>Aggregation of copyrightable things (and their SPDX data) (<strong>Note</strong>: Aggregations of copyrightable things are usually also copyrightable things).</li></ol></div><div> </div><div> </div><p> </p>

Technical Team/Use Cases/2.0/Intermediate packager builds source package from upstream source that does not provide SPDX data

2012-08-07T18:24:06Z

Knewcomer:

<ol style="color: #4d4d4d; font-family: Arial, Helvetica, sans-serif; font-size: 13px;"><li><strong>Title:</strong> Intermediate packager builds source package from upstream source that does not provide SPDX data</li><li><strong>Primary Actor:</strong> Intermediate packager (someone building a rpm, deb, etc from upstream source)</li><li><strong>Goal in Context:</strong> To include in the package SPDX data describing the packages licensing information for the package base even though the upstream project is not providing SPDX data.</li><li><strong>Stakeholders and Interests:</strong> <ol><li><strong>Upstream maintainers: </strong><ol><li>To communicate the licensing information for their copyrightable artifacts.  </li><li>To have their licenses respected</li></ol></li><li><strong>Intermediate Packager:</strong><br /><ol><li>To communicate the licensing information for their package</li><li>To communicate the licensing information provided by the upstream maintainer.</li><li>To respect the licenses of the upstream maintainer</li></ol></li><li><strong>Consumers of packages:</strong><ol><li>To receive accurate and clear information of licensing of packages</li><li>To be able to comply easily with licenses for packages</li><li>To be able to trust that the package SPDX data is in alignment with the upstream maintainers license assertions.</li><li>To be able to subset, extend, or aggregate artifacts and pass on clear authoritative verifiable license for the resulting new copyrightable artifacts.</li></ol></li></ol></li><li><strong>Preconditions:</strong> <ol><li>Packager has some means to understand the licensing information from the upstream source.</li></ol></li><li><strong>Main Success Senario:</strong> Packager communicates accurate complete licensing information for their package in an SPDX data format in </li><ol><li>the package archive</li><li>or as a sidecar (URL)</li><li>or in the SCM</li></ol><li><strong>Failed End Condition:</strong> Package maintainer communicates inaccurate incomplete licensing information for their package.</li><li><strong>Trigger:</strong><ol><li>Release of a new package</li></ol></li><li><strong>Notes:</strong>  This is a base case, it is well understood that packagers both add to the upstream source, but also subset it.</li></ol>

Technical Team/Use Cases/2.0

2012-08-07T18:22:28Z

Knewcomer:

<p>We have several sources to begin pulling for SPDX Use Cases:</p><ol><li>The Pad from earlier conversations collected at <a href="http://spdx.org/wiki/use-cases-collected-20-discussion">Use Cases For SPDX 2.0 Discussion</a></li><li>The old <a href="http://spdx.org/wiki/spdx-use-case-1">SPDX 1.0 Use Cases</a> as well as the <a href="http://spdx.org/system/files/ecosystem.jpg">SDPX 1.0 Use Case Picture</a>.</li></ol><div> </div><div>I'd like to propose that we flesh out use cases here by having a brief summary listed here as a link to a more detailed child page.   Note, these use cases should be *<strong>doable</strong>* but in general not *<strong>required</strong>*.  Any item listed here that is not a link, should have a child page created for it.</div><div> </div><div><ol><li>Code commits (original work intended for the project)</li><ol><li><a href="http://spdx.org/wiki/committers-provides-spdx-data-code-being-committed">Committer provides SPDX data</a> [OK]</li><li><a href="http://spdx.org/wiki/contributor-makes-commit-subject-existing-spdx-data-project">Contributor makes commit  subject to existing SPDX data of project</a> [OK]</li></ol><li><a href="http://spdx.org/wiki/committer-annotates-source-files-spdx-data">Committer annotates source files with SPDX data</a> [OK]</li><li>Patches (original work intended for the project)</li><ol><li><a href="http://spdx.org/wiki/patch-provider-provides-spdx-data-patch">Patch provider provides SPDX data for the patch</a> [OK]</li><li><a href="http://spdx.org/wiki/patch-provider-provides-spdx-data-patch-indicating-it-licensed-however-hell-its-applied">Patch provider provides SPDX data for the patch indicating it is licensed however the hell its applied</a> [OK]</li><li><a href="http://spdx.org/wiki/patch-provider-provides-patch-subject-existing-spdx-data-project">Patch provider provides patch subject to existing SPDX data of project</a> [OK]</li></ol><li>Patch provider provides a patch that modifies existing SPDX data of project</li><ol><li><a href="http://spdx.org/wiki/downstream-consumers-contributing-patches-provide-spdx-data-upstream-doesnt-have-it">Downstream consumers contributing patches to provide SPDX data to an upstream that doesn't have it.</a>[OK]</li><li><a href="http://spdx.org/wiki/downstream-consumers-contributing-patches-provide-corrections-spdx-data-upstream-does-have-it">Downstream consumers contributing patches to provide corrections to SPDX data for an upstream that does have it.</a> [OK]</li></ol><li><a href="http://spdx.org/wiki/spdx-20-usecase-upstream-maintainer-providing-spdx-data">Upstream maintainer providing SPDX data</a></li><ol><li><a href="http://spdx.org/wiki/upstream-maintainer-providing-spdx-data-source-archive">Upstream maintainer providing SPDX data in source archive</a>[OK]</li><li><a href="http://spdx.org/wiki/upstream-maintainer-providing-spdx-data-scm">Upstream maintainer providing SPDX data in SCM</a> [OK]</li><li><a href="http://spdx.org/wiki/upstream-maintainer-providing-spdx-data-url">Upstream maintainer providing SPDX data at a URL</a> [OK]</li><li><a href="http://spdx.org/wiki/upstream-maintainer-preparing-release-artifacts-including-spdx-data">Upstream maintainer preparing release artifacts (including SPDX data).</a> [OK]</li></ol><li>Project maintainer incorporates another project</li><ol><li><a href="http://spdx.org/wiki/project-maintainer-incorporates-another-project-including-source">Project maintainer incorporates another project by including source</a> [OK]</li><li><a href="http://spdx.org/wiki/project-maintainer-incorporates-another-project-including-binary">Project maintainer incorporates another project by including binary</a> [OK]</li><li><a href="http://spdx.org/wiki/project-maintainer-pulling-individual-files-out-another-project-subsetting">Project maintainer pulling individual files out of another project (subsetting)</a> [OK]</li></ol><li>SPDX-Lite:</li><ol><li><a href="http://spdx.org/wiki/low-cost-spdx-file">Allow a low investment SPDX producer to produce valid SPDX data</a> [OK-fathomed but not Approved for Implementation]</li><li><a href="http://spdx.org/wiki/producing-valid-spdx-files-face-missing-data">Produce a valid SPDX dataset even if some data is missing</a> [OK]</li></ol><li>Intermediate packager (rpm, deb, etc) passing on and adding to SPDX Data</li><ol><li>Intermediate packager builds source package from upstream source</li><ol><li><a href="http://spdx.org/wiki/intermediate-packager-builds-source-package-upstream-source-provides-spdx-data">Intermediate packager builds source package from upstream source that provides SPDX data</a> [OK]</li><li><a href="http://spdx.org/wiki/intermediate-packager-builds-source-package-upstream-source-does-not-provide-spdx-data">Intermediate packager builds source package from upstream source that does not provide SPDX data</a></li></ol><li>Intermediate packager builds binary package from upstream source</li><ol><li><a href="http://spdx.org/wiki/intermediate-packager-builds-binary-package-upstream-source-provides-spdx-data">Intermediate packager builds binary package from upstream source that provides SPDX data</a></li><li><a href="http://spdx.org/wiki/intermediate-packager-builds-binary-package-upstream-source-does-not-provides-spdx-data">Intermediate packager builds binary package from upstream source that does not provides SPDX data</a></li></ol><li>Intermediate packager adds patches to upstream source </li><ol><li><a href="http://spdx.org/wiki/intermediate-packager-adds-patches-upstream-source-provides-spdx-data">Intermediate packager adds patches to upstream source that provides SPDX data</a></li><li><a href="http://spdx.org/wiki/intermediate-packager-adds-patches-upstream-source-does-not-provide-spdx-data">Intermediate packager adds patches to upstream source that does not provide SPDX data</a></li></ol><li>Intermediate packager adds someone else's patches to upstream source</li><ol><li><a href="http://spdx.org/wiki/intermediate-packager-adds-someone-elses-patches-upstream-source-provides-spdx-data">Intermediate packager adds someone else's patches to upstream source that provides SPDX data</a></li><li><a href="http://spdx.org/wiki/intermediate-packager-adds-someone-elses-patches-upstream-source-does-not-provide-spdx-data">Intermediate packager adds someone else's patches to upstream source that does not provide SPDX data</a></li></ol><li>Intermediate packager subsetting upstream source</li><ol><li><a href="http://spdx.org/wiki/intermediate-packager-subsetting-upstream-source-provides-spdx-data">Intermediate packager subsetting upstream source that provides SPDX data</a></li><li><a href="http://spdx.org/wiki/intermediate-packager-subsetting-upstream-source-does-not-provide-spdx-data">Intermediate packager subsetting upstream source that does not provide SPDX data</a></li></ol></ol><li>Build systems (build systems want to pass on SPDX data for the thing they are building)</li><ol><li><a href="http://www.spdx.org/wiki/spdx-use-case-build-systems-yocto">Yocto</a></li><li>Linking</li><ol><li><a href="http://spdx.org/wiki/debian-has-interest-only-building-things-are-linking-license-compatible">Debian has an interest in only building things that are linking license compatible</a></li></ol><li>I just made a binary out of some source</li><ol><li><a href="http://spdx.org/wiki/spdx-data-indicating-subset-source-made-it-particular-binary-or-binary-package">SPDX data indicating subset of the source that made it into a particular binary or binary package</a></li></ol></ol><li>Aggregator aggregating many 'copyrightable items' for redistribution</li><ol><li><a title="Linux Distro" href="https://spdx.org/wiki/linux-distro">Linux Distros</a></li><li><a href="http://spdx.org/wiki/embedded-images-eg-router-images-switch-images">Embedded Images (e.g. router images, switch images)</a></li><li><a href="http://spdx.org/wiki/spdx-20-usecase-reference-implementations">Reference implementations </a>[Jack Manbeck]</li><li><a href="http://spdx.org/wiki/spdx-20-usecase-application-which-ships-documentation-media-software">Application which ships with documentation +  media + software</a> [Jack Manbeck]</li><li><a title="Use case details" href="http://spdx.org/wiki/application-which-ships-contrib-libraries">Application which ships with a contrib libraries</a></li><li><a title="Use case details" href="http://spdx.org/wiki/application-which-ships-development-tools">Application which ships with development tools</a></li><li><a href="http://spdx.org/wiki/subsetting-out-only-shippable-bits-stuff-coming-sdk">Subsetting out only the shippable bits of stuff coming from an SDK</a></li><li><a href="http://spdx.org/wiki/aggregators-aggregating-other-aggregations-redistribution">Aggregators aggregating other aggregations for redistribution</a></li></ol><li>Consumers receiving SPDX data</li><ol><li><a href="http://spdx.org/wiki/provide-sufficient-data-allow-consumer-comply-licenses-redistribution">Provide sufficient data to allow consumer to comply with licenses on redistribution</a></li></ol><li><a href="http://spdx.org/wiki/consuming-code-snippets">Consuming code snippets </a>(God help us all) (subfile pieces of code not originally intended for the project)</li><li>Signoff/multiple signoff on SPDX data</li><ol><li><a target="_blank" title="Contracts with multiple parties requiring signoff by all" href="https://spdx.org/wiki/multi-party-contracts">Contracts with multiple parties requiring signoff by al</a>l [Kate Stewart]</li></ol><li>Third party does licensing analysis</li><ol><li><a href="http://spdx.org/wiki/third-party-produces-bill-materials-software-package">Third party generates license analysis</a></li><li><a href="http://spdx.org/wiki/collecting-enough-information-allow-auditor-make-recommendations-remove-or-not-component">Collecting enough information to allow auditor to make recommendations to remove or not a component</a></li></ol><li>Auditor Analyzing/Sanity-checking/correcting Bill of Material he's handed</li><ol><li><a href="http://spdx.org/wiki/use-case-backtrack-binary-source-files">Backtrack from compiled/binary file to constituent files</a> </li><li>outbound: validate that SPDX goes hand in hand with what's being shipped [Kirsten Newcomer]</li><ol><li><a href="http://spdx.org/wiki/check-see-if-spdx-data-provided-matches-files-provided">Check to see if the SPDX data provided matches the files provided</a></li></ol></ol><li>Extensions:</li><ol><li><a href="http://spdx.org/wiki/communicate-data-beyond-what-described-spec">Communicate data beyond what is described in spec between consenting parties w/o breaking consumers that are not in the know</a></li><li><a href="http://spdx.org/wiki/license-list-extension">License list extensions, how do you handle folks who have more licenses than SPDX</a></li><li><a href="http://spdx.org/wiki/decorating-already-produces-and-signed-spdx-dataset-extension-data">Decorating an already produces and signed SPDX dataset with extension data</a> [Bill Schineller]</li></ol><li>Other arising during vetting...</li><ol><li>Given 2 SPDX files about the same codebase from the same source, be able to tell which is the later rev / more current and correct one.</li></ol></ol><div> Cross-cutting concerns:</div><div><div><ol><li>Provenance (the need to optionally use signing to validate who said what)</li><li>Trust</li><li>Handling staleness of data</li><li>Composite licensing</li><li>Ease of sharing information</li><ol><li>Collecting tribal knowledge along the way </li></ol><li>Guarding against file bloat</li><li>Simple simple simple</li><li>SPDX-Lite:</li><li>Clarity</li><li>Automation/toolifiability</li><li>Regionality</li></ol></div></div></div><div><h2>Themes:</h2></div><div> </div><div>Looking at these Use Cases, there are some underlying themes:</div><div><ol><li>Root of data (closer to upstream the better)</li><li>Subsetting of copyrightable things (and their SPDX data) (<strong>Note</strong>: Subsets of copyrightable things are usually also copyrightable things)</li><li>Aggregation of copyrightable things (and their SPDX data) (<strong>Note</strong>: Aggregations of copyrightable things are usually also copyrightable things).</li></ol></div><div> </div><div> </div><p> </p>

Technical Team/Use Cases/2.0/Intermediate packager builds source package from upstream source that provides SPDX data

2012-08-07T18:21:00Z

Knewcomer:

<ol><li style="color: #4d4d4d; font-family: Arial, Helvetica, sans-serif; font-size: 13px;"><strong>Title:</strong> Intermediate packager builds source package from upstream source that provides SPDX data</li><li style="color: #4d4d4d; font-family: Arial, Helvetica, sans-serif; font-size: 13px;"><strong>Primary Actor:</strong> Intermediate packager (someone building a rpm, deb, etc from upstream source)</li><li style="color: #4d4d4d; font-family: Arial, Helvetica, sans-serif; font-size: 13px;"><strong>Goal in Context:</strong> To include in the package SPDX data describing the packages licensing information for the package base upon the SPDX data provided by the upstream source in a way that allows the packager to verifiably reference the upstream packagers SPDX data.</li><li><strong style="color: #4d4d4d; font-family: Arial, Helvetica, sans-serif; font-size: 13px;">Stakeholders and Interests:</strong><span style="color: #4d4d4d; font-family: Arial, Helvetica, sans-serif; font-size: small;"> </span><ol><li><strong style="color: #4d4d4d; font-family: Arial, Helvetica, sans-serif; font-size: 13px;">Upstream maintainers: </strong><ol style="color: #4d4d4d; font-family: Arial, Helvetica, sans-serif; font-size: 13px;"><li>To communicate the licensing information for their copyrightable artifacts.  </li><li>To have their licenses respected</li></ol></li><li><span style="color: #4d4d4d; font-family: Arial, Helvetica, sans-serif; font-size: small;"><strong>Intermediate Packager:</strong><br /></span></li><ol><li><span style="color: #4d4d4d; font-family: Arial, Helvetica, sans-serif; font-size: small;">To communicate the licensing information for their package</span></li><li><span style="color: #4d4d4d; font-family: Arial, Helvetica, sans-serif; font-size: small;">To communicate the licensing information provided by the upstream maintainer.</span></li><li><span style="color: #4d4d4d; font-family: Arial, Helvetica, sans-serif; font-size: small;">To respect the licenses of the upstream maintainer</span></li></ol><li style="color: #4d4d4d; font-family: Arial, Helvetica, sans-serif; font-size: 13px;"><strong>Consumers of packages:</strong><ol><li>To receive accurate and clear information of licensing of packages</li><li>To be able to comply easily with licenses for packages</li><li>To be able to trust that the package SPDX data is in alignment with the upstream maintainers license assertions.</li><li>To be able to subset, extend, or aggregate artifacts and pass on clear authoritative verifiable license for the resulting new copyrightable artifacts.</li></ol></li></ol></li><li style="color: #4d4d4d; font-family: Arial, Helvetica, sans-serif; font-size: 13px;"><strong>Preconditions:</strong> <ol><li>Upstream maintainer has provided SPDX data</li></ol></li><li style="color: #4d4d4d; font-family: Arial, Helvetica, sans-serif; font-size: 13px;"><strong>Main Success Senario:</strong> Packager communicates accurate complete licensing information for their package in an SPDX data format in </li><ol><li style="color: #4d4d4d; font-family: Arial, Helvetica, sans-serif; font-size: 13px;">the package archive</li><li style="color: #4d4d4d; font-family: Arial, Helvetica, sans-serif; font-size: 13px;">or as a sidecar (file URL)</li><li style="color: #4d4d4d; font-family: Arial, Helvetica, sans-serif; font-size: 13px;">or in the SCM</li></ol><li style="color: #4d4d4d; font-family: Arial, Helvetica, sans-serif; font-size: 13px;"><strong>Failed End Condition:</strong> Package maintainer communicates inaccurate incomplete licensing information for their package.</li><li style="color: #4d4d4d; font-family: Arial, Helvetica, sans-serif; font-size: 13px;"><strong>Trigger:</strong><ol><li>Release of a new package</li></ol></li><li style="color: #4d4d4d; font-family: Arial, Helvetica, sans-serif; font-size: 13px;"><strong>Notes:</strong>  This is a base case, it is well understood that packagers both add to the upstream source, but also subset it.</li></ol>

Technical Team/Use Cases/2.0

2012-08-07T18:16:41Z

Knewcomer:

<p>We have several sources to begin pulling for SPDX Use Cases:</p><ol><li>The Pad from earlier conversations collected at <a href="http://spdx.org/wiki/use-cases-collected-20-discussion">Use Cases For SPDX 2.0 Discussion</a></li><li>The old <a href="http://spdx.org/wiki/spdx-use-case-1">SPDX 1.0 Use Cases</a> as well as the <a href="http://spdx.org/system/files/ecosystem.jpg">SDPX 1.0 Use Case Picture</a>.</li></ol><div> </div><div>I'd like to propose that we flesh out use cases here by having a brief summary listed here as a link to a more detailed child page.   Note, these use cases should be *<strong>doable</strong>* but in general not *<strong>required</strong>*.  Any item listed here that is not a link, should have a child page created for it.</div><div> </div><div><ol><li>Code commits (original work intended for the project)</li><ol><li><a href="http://spdx.org/wiki/committers-provides-spdx-data-code-being-committed">Committer provides SPDX data</a> [OK]</li><li><a href="http://spdx.org/wiki/contributor-makes-commit-subject-existing-spdx-data-project">Contributor makes commit  subject to existing SPDX data of project</a> [OK]</li></ol><li><a href="http://spdx.org/wiki/committer-annotates-source-files-spdx-data">Committer annotates source files with SPDX data</a> [OK]</li><li>Patches (original work intended for the project)</li><ol><li><a href="http://spdx.org/wiki/patch-provider-provides-spdx-data-patch">Patch provider provides SPDX data for the patch</a> [OK]</li><li><a href="http://spdx.org/wiki/patch-provider-provides-spdx-data-patch-indicating-it-licensed-however-hell-its-applied">Patch provider provides SPDX data for the patch indicating it is licensed however the hell its applied</a> [OK]</li><li><a href="http://spdx.org/wiki/patch-provider-provides-patch-subject-existing-spdx-data-project">Patch provider provides patch subject to existing SPDX data of project</a> [OK]</li></ol><li>Patch provider provides a patch that modifies existing SPDX data of project</li><ol><li><a href="http://spdx.org/wiki/downstream-consumers-contributing-patches-provide-spdx-data-upstream-doesnt-have-it">Downstream consumers contributing patches to provide SPDX data to an upstream that doesn't have it.</a>[OK]</li><li><a href="http://spdx.org/wiki/downstream-consumers-contributing-patches-provide-corrections-spdx-data-upstream-does-have-it">Downstream consumers contributing patches to provide corrections to SPDX data for an upstream that does have it.</a> [OK]</li></ol><li><a href="http://spdx.org/wiki/spdx-20-usecase-upstream-maintainer-providing-spdx-data">Upstream maintainer providing SPDX data</a></li><ol><li><a href="http://spdx.org/wiki/upstream-maintainer-providing-spdx-data-source-archive">Upstream maintainer providing SPDX data in source archive</a>[OK]</li><li><a href="http://spdx.org/wiki/upstream-maintainer-providing-spdx-data-scm">Upstream maintainer providing SPDX data in SCM</a> [OK]</li><li><a href="http://spdx.org/wiki/upstream-maintainer-providing-spdx-data-url">Upstream maintainer providing SPDX data at a URL</a> [OK]</li><li><a href="http://spdx.org/wiki/upstream-maintainer-preparing-release-artifacts-including-spdx-data">Upstream maintainer preparing release artifacts (including SPDX data).</a> [OK]</li></ol><li>Project maintainer incorporates another project</li><ol><li><a href="http://spdx.org/wiki/project-maintainer-incorporates-another-project-including-source">Project maintainer incorporates another project by including source</a> [OK]</li><li><a href="http://spdx.org/wiki/project-maintainer-incorporates-another-project-including-binary">Project maintainer incorporates another project by including binary</a> [OK]</li><li><a href="http://spdx.org/wiki/project-maintainer-pulling-individual-files-out-another-project-subsetting">Project maintainer pulling individual files out of another project (subsetting)</a> [OK]</li></ol><li>SPDX-Lite:</li><ol><li><a href="http://spdx.org/wiki/low-cost-spdx-file">Allow a low investment SPDX producer to produce valid SPDX data</a> [OK-fathomed but not Approved for Implementation]</li><li><a href="http://spdx.org/wiki/producing-valid-spdx-files-face-missing-data">Produce a valid SPDX dataset even if some data is missing</a> [OK]</li></ol><li>Intermediate packager (rpm, deb, etc) passing on and adding to SPDX Data</li><ol><li>Intermediate packager builds source package from upstream source</li><ol><li><a href="http://spdx.org/wiki/intermediate-packager-builds-source-package-upstream-source-provides-spdx-data">Intermediate packager builds source package from upstream source that provides SPDX data</a></li><li><a href="http://spdx.org/wiki/intermediate-packager-builds-source-package-upstream-source-does-not-provide-spdx-data">Intermediate packager builds source package from upstream source that does not provide SPDX data</a></li></ol><li>Intermediate packager builds binary package from upstream source</li><ol><li><a href="http://spdx.org/wiki/intermediate-packager-builds-binary-package-upstream-source-provides-spdx-data">Intermediate packager builds binary package from upstream source that provides SPDX data</a></li><li><a href="http://spdx.org/wiki/intermediate-packager-builds-binary-package-upstream-source-does-not-provides-spdx-data">Intermediate packager builds binary package from upstream source that does not provides SPDX data</a></li></ol><li>Intermediate packager adds patches to upstream source </li><ol><li><a href="http://spdx.org/wiki/intermediate-packager-adds-patches-upstream-source-provides-spdx-data">Intermediate packager adds patches to upstream source that provides SPDX data</a></li><li><a href="http://spdx.org/wiki/intermediate-packager-adds-patches-upstream-source-does-not-provide-spdx-data">Intermediate packager adds patches to upstream source that does not provide SPDX data</a></li></ol><li>Intermediate packager adds someone else's patches to upstream source</li><ol><li><a href="http://spdx.org/wiki/intermediate-packager-adds-someone-elses-patches-upstream-source-provides-spdx-data">Intermediate packager adds someone else's patches to upstream source that provides SPDX data</a></li><li><a href="http://spdx.org/wiki/intermediate-packager-adds-someone-elses-patches-upstream-source-does-not-provide-spdx-data">Intermediate packager adds someone else's patches to upstream source that does not provide SPDX data</a></li></ol><li>Intermediate packager subsetting upstream source</li><ol><li><a href="http://spdx.org/wiki/intermediate-packager-subsetting-upstream-source-provides-spdx-data">Intermediate packager subsetting upstream source that provides SPDX data</a></li><li><a href="http://spdx.org/wiki/intermediate-packager-subsetting-upstream-source-does-not-provide-spdx-data">Intermediate packager subsetting upstream source that does not provide SPDX data</a></li></ol></ol><li>Build systems (build systems want to pass on SPDX data for the thing they are building)</li><ol><li><a href="http://www.spdx.org/wiki/spdx-use-case-build-systems-yocto">Yocto</a></li><li>Linking</li><ol><li><a href="http://spdx.org/wiki/debian-has-interest-only-building-things-are-linking-license-compatible">Debian has an interest in only building things that are linking license compatible</a></li></ol><li>I just made a binary out of some source</li><ol><li><a href="http://spdx.org/wiki/spdx-data-indicating-subset-source-made-it-particular-binary-or-binary-package">SPDX data indicating subset of the source that made it into a particular binary or binary package</a></li></ol></ol><li>Aggregator aggregating many 'copyrightable items' for redistribution</li><ol><li><a title="Linux Distro" href="https://spdx.org/wiki/linux-distro">Linux Distros</a></li><li><a href="http://spdx.org/wiki/embedded-images-eg-router-images-switch-images">Embedded Images (e.g. router images, switch images)</a></li><li><a href="http://spdx.org/wiki/spdx-20-usecase-reference-implementations">Reference implementations </a>[Jack Manbeck]</li><li><a href="http://spdx.org/wiki/spdx-20-usecase-application-which-ships-documentation-media-software">Application which ships with documentation +  media + software</a> [Jack Manbeck]</li><li><a title="Use case details" href="http://spdx.org/wiki/application-which-ships-contrib-libraries">Application which ships with a contrib libraries</a></li><li><a title="Use case details" href="http://spdx.org/wiki/application-which-ships-development-tools">Application which ships with development tools</a></li><li><a href="http://spdx.org/wiki/subsetting-out-only-shippable-bits-stuff-coming-sdk">Subsetting out only the shippable bits of stuff coming from an SDK</a></li><li><a href="http://spdx.org/wiki/aggregators-aggregating-other-aggregations-redistribution">Aggregators aggregating other aggregations for redistribution</a></li></ol><li>Consumers receiving SPDX data</li><ol><li><a href="http://spdx.org/wiki/provide-sufficient-data-allow-consumer-comply-licenses-redistribution">Provide sufficient data to allow consumer to comply with licenses on redistribution</a></li></ol><li><a href="http://spdx.org/wiki/consuming-code-snippets">Consuming code snippets </a>(God help us all) (subfile pieces of code not originally intended for the project)</li><li>Signoff/multiple signoff on SPDX data</li><ol><li><a target="_blank" title="Contracts with multiple parties requiring signoff by all" href="https://spdx.org/wiki/multi-party-contracts">Contracts with multiple parties requiring signoff by al</a>l [Kate Stewart]</li></ol><li>Third party does licensing analysis</li><ol><li><a href="http://spdx.org/wiki/third-party-produces-bill-materials-software-package">Third party generates license analysis</a></li><li><a href="http://spdx.org/wiki/collecting-enough-information-allow-auditor-make-recommendations-remove-or-not-component">Collecting enough information to allow auditor to make recommendations to remove or not a component</a></li></ol><li>Auditor Analyzing/Sanity-checking/correcting Bill of Material he's handed</li><ol><li><a href="http://spdx.org/wiki/use-case-backtrack-binary-source-files">Backtrack from compiled/binary file to constituent files</a> </li><li>outbound: validate that SPDX goes hand in hand with what's being shipped [Kirsten Newcomer]</li><ol><li><a href="http://spdx.org/wiki/check-see-if-spdx-data-provided-matches-files-provided">Check to see if the SPDX data provided matches the files provided</a></li></ol></ol><li>Extensions:</li><ol><li><a href="http://spdx.org/wiki/communicate-data-beyond-what-described-spec">Communicate data beyond what is described in spec between consenting parties w/o breaking consumers that are not in the know</a></li><li><a href="http://spdx.org/wiki/license-list-extension">License list extensions, how do you handle folks who have more licenses than SPDX</a></li><li><a href="http://spdx.org/wiki/decorating-already-produces-and-signed-spdx-dataset-extension-data">Decorating an already produces and signed SPDX dataset with extension data</a> [Bill Schineller]</li></ol><li>Other arising during vetting...</li><ol><li>Given 2 SPDX files about the same codebase from the same source, be able to tell which is the later rev / more current and correct one.</li></ol></ol><div> Cross-cutting concerns:</div><div><div><ol><li>Provenance (the need to optionally use signing to validate who said what)</li><li>Trust</li><li>Handling staleness of data</li><li>Composite licensing</li><li>Ease of sharing information</li><ol><li>Collecting tribal knowledge along the way </li></ol><li>Guarding against file bloat</li><li>Simple simple simple</li><li>SPDX-Lite:</li><li>Clarity</li><li>Automation/toolifiability</li><li>Regionality</li></ol></div></div></div><div><h2>Themes:</h2></div><div> </div><div>Looking at these Use Cases, there are some underlying themes:</div><div><ol><li>Root of data (closer to upstream the better)</li><li>Subsetting of copyrightable things (and their SPDX data) (<strong>Note</strong>: Subsets of copyrightable things are usually also copyrightable things)</li><li>Aggregation of copyrightable things (and their SPDX data) (<strong>Note</strong>: Aggregations of copyrightable things are usually also copyrightable things).</li></ol></div><div> </div><div> </div><p> </p>

Technical Team/Old/Use Cases Collected during 1.x timeframe

2012-07-31T18:30:41Z

Knewcomer:

<div id="magicdomid149" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-sz122z2pgf4uw9k6kz122zz122z6" style="cursor: auto; background-color: #f1e3ff; padding-top: 1px; padding-bottom: 1px;">Use cases from 1.0 discussions</span></div><div style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-sz122z2pgf4uw9k6kz122zz122z6" style="cursor: auto; background-color: #f1e3ff; padding-top: 1px; padding-bottom: 1px;"> ===========================================<br /></span></div><div style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-sz122z2pgf4uw9k6kz122zz122z6" style="cursor: auto; background-color: #f1e3ff; padding-top: 1px; padding-bottom: 1px;"><br /></span></div><div style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-sz122z2pgf4uw9k6kz122zz122z6" style="cursor: auto; background-color: #f1e3ff; padding-top: 1px; padding-bottom: 1px;">http://spdx.org/wiki/spdx/examples<br /></span></div><div style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-sz122z2pgf4uw9k6kz122zz122z6" style="cursor: auto; background-color: #f1e3ff; padding-top: 1px; padding-bottom: 1px;"><br /></span></div><div style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-sz122z2pgf4uw9k6kz122zz122z6" style="cursor: auto; background-color: #f1e3ff; padding-top: 1px; padding-bottom: 1px;"><br /></span></div><div style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-sz122z2pgf4uw9k6kz122zz122z6" style="cursor: auto; background-color: #f1e3ff; padding-top: 1px; padding-bottom: 1px;">Use Cases to consider for SPDX 2.0 - working draft</span></div><div id="magicdomid150" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-sz122z2pgf4uw9k6kz122zz122z6" style="cursor: auto; background-color: #f1e3ff; padding-top: 1px; padding-bottom: 1px;">======================================</span></div><div id="magicdomid151" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"> </div><div id="magicdomid152" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-gr61e6romqg35ji7" style="cursor: auto; background-color: #ecbcbc; padding-top: 1px; padding-bottom: 1px;">Source code for SPDX-tools are available at: </span><span class="author-g-gr61e6romqg35ji7 url" style="cursor: auto; background-color: #ecbcbc; padding-top: 1px; padding-bottom: 1px;"><a style="cursor: pointer !important;" href="https://github.com/goneall/SPDX-Tools">https://github.com/goneall/SPDX-Tools</a></span></div><div id="magicdomid153" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"> </div><div id="magicdomid154" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span style="cursor: auto; padding-top: 1px; padding-bottom: 1px;">Use case details:</span></div><div id="magicdomid155" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"> </div><div id="magicdomid156" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span style="cursor: auto; padding-top: 1px; padding-bottom: 1px;"> * </span><span class=" url" style="cursor: auto; padding-top: 1px; padding-bottom: 1px;"><a style="cursor: pointer !important;" href="http://pad.ubuntu.com/spdx-tech--use-case-embedded-java-jar">http://pad.ubuntu.com/spdx-tech--use-case-embedded-java-jar</a></span></div><div id="magicdomid157" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-gr61e6romqg35ji7" style="cursor: auto; background-color: #ecbcbc; padding-top: 1px; padding-bottom: 1px;"> </span></div><div id="magicdomid158" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-gr61e6romqg35ji7" style="cursor: auto; background-color: #ecbcbc; padding-top: 1px; padding-bottom: 1px;"> [The way I am thinking about the use cases is there are 2 different groups of use cases which I am calling scenarios.  From what I can think of the same solutions should work for both scenarios, but there may be value in keeping these 2 scenarios in mind while working through the detailed use cases]</span></div><div id="magicdomid159" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-gr61e6romqg35ji7" style="cursor: auto; background-color: #ecbcbc; padding-top: 1px; padding-bottom: 1px;"> </span></div><div id="magicdomid160" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-gr61e6romqg35ji7" style="cursor: auto; background-color: #ecbcbc; padding-top: 1px; padding-bottom: 1px;"> High level general use case Scenarios:</span></div><div id="magicdomid161" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-gr61e6romqg35ji7" style="cursor: auto; background-color: #ecbcbc; padding-top: 1px; padding-bottom: 1px;"> A: Embedded Packages</span><span class="author-g-ha6r9ljem9yalssm" style="cursor: auto; background-color: #f1ffe3; padding-top: 1px; padding-bottom: 1px;"> (a typical "Audit" scenario)</span></div><div id="magicdomid162" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-gr61e6romqg35ji7" style="cursor: auto; background-color: #ecbcbc; padding-top: 1px; padding-bottom: 1px;"> - Actors: </span></div><div id="magicdomid163" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-gr61e6romqg35ji7" style="cursor: auto; background-color: #ecbcbc; padding-top: 1px; padding-bottom: 1px;">     - Package Supplier: person or entity supplying the package represented by the highest lievel SPDX document</span></div><div id="magicdomid164" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-gr61e6romqg35ji7" style="cursor: auto; background-color: #ecbcbc; padding-top: 1px; padding-bottom: 1px;">     - Package Consumer: person or entity using the package represented by the highest level SPDX document</span></div><div id="magicdomid165" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-gr61e6romqg35ji7" style="cursor: auto; background-color: #ecbcbc; padding-top: 1px; padding-bottom: 1px;">Use Cases: </span></div><div id="magicdomid166" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-gr61e6romqg35ji7" style="cursor: auto; background-color: #ecbcbc; padding-top: 1px; padding-bottom: 1px;">- embedded java jar </span></div><div id="magicdomid167" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-gr61e6romqg35ji7" style="cursor: auto; background-color: #ecbcbc; padding-top: 1px; padding-bottom: 1px;">- embedded source distribution</span></div><div id="magicdomid168" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-gr61e6romqg35ji7" style="cursor: auto; background-color: #ecbcbc; padding-top: 1px; padding-bottom: 1px;">- embedded source with unused contrib library </span></div><div id="magicdomid169" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-gr61e6romqg35ji7" style="cursor: auto; background-color: #ecbcbc; padding-top: 1px; padding-bottom: 1px;">- embedded build tools</span></div><div id="magicdomid170" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"> </div><div id="magicdomid171" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-gr61e6romqg35ji7" style="cursor: auto; background-color: #ecbcbc; padding-top: 1px; padding-bottom: 1px;">B: Package Supply Chain</span></div><div id="magicdomid172" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-gr61e6romqg35ji7" style="cursor: auto; background-color: #ecbcbc; padding-top: 1px; padding-bottom: 1px;">- Actors:</span></div><div id="magicdomid173" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-gr61e6romqg35ji7" style="cursor: auto; background-color: #ecbcbc; padding-top: 1px; padding-bottom: 1px;">  - Package Originator: Original supplier of a package represented by an SPDX document - likely (but not always) the creator</span></div><div id="magicdomid174" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-gr61e6romqg35ji7" style="cursor: auto; background-color: #ecbcbc; padding-top: 1px; padding-bottom: 1px;">  - Intermediate Packager: person or entity that redistributes an original package with its own SPDX document</span></div><div id="magicdomid175" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-gr61e6romqg35ji7" style="cursor: auto; background-color: #ecbcbc; padding-top: 1px; padding-bottom: 1px;">  - End Package Consumer: The consumer of the final package in the supply chain - note that the same entity or person can be both an End Package Consumer and an Intermediate Packager</span></div><div id="magicdomid176" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-gr61e6romqg35ji7" style="cursor: auto; background-color: #ecbcbc; padding-top: 1px; padding-bottom: 1px;">- Use Cases:</span></div><div id="magicdomid177" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-gr61e6romqg35ji7" style="cursor: auto; background-color: #ecbcbc; padding-top: 1px; padding-bottom: 1px;">  - simple redistribution</span></div><div id="magicdomid178" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-gr61e6romqg35ji7" style="cursor: auto; background-color: #ecbcbc; padding-top: 1px; padding-bottom: 1px;">  - package aggregation</span></div><div id="magicdomid179" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-gr61e6romqg35ji7" style="cursor: auto; background-color: #ecbcbc; padding-top: 1px; padding-bottom: 1px;">  - modified redistribution</span></div><div id="magicdomid180" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-gr61e6romqg35ji7" style="cursor: auto; background-color: #ecbcbc; padding-top: 1px; padding-bottom: 1px;">  - patches provided to existing (already distributed) package</span></div><div id="magicdomid181" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-gr61e6romqg35ji7" style="cursor: auto; background-color: #ecbcbc; padding-top: 1px; padding-bottom: 1px;">  - appstore</span></div><div id="magicdomid182" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"> </div><div id="magicdomid183" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-gr61e6romqg35ji7" style="cursor: auto; background-color: #ecbcbc; padding-top: 1px; padding-bottom: 1px;">Use Case: embedded source</span></div><div id="magicdomid184" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-ha6r9ljem9yalssm" style="cursor: auto; background-color: #f1ffe3; padding-top: 1px; padding-bottom: 1px;">Givens:</span></div><div id="magicdomid185" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-ha6r9ljem9yalssm" style="cursor: auto; background-color: #f1ffe3; padding-top: 1px; padding-bottom: 1px;">1) Given a pre-existing source tarball (commons-logging-1.1.1.tar.gz) with an SPDX document is available for re-use</span></div><div id="magicdomid186" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-ha6r9ljem9yalssm" style="cursor: auto; background-color: #f1ffe3; padding-top: 1px; padding-bottom: 1px;">2) Given: To build MyApp which re-uses it, commons-logging-1.1.1.tar.gz gets expanded somewhere into the MyApp source tree</span></div><div id="magicdomid187" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"> </div><div id="magicdomid188" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-ha6r9ljem9yalssm" style="cursor: auto; background-color: #f1ffe3; padding-top: 1px; padding-bottom: 1px;">Problem:</span></div><div id="magicdomid189" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-ha6r9ljem9yalssm" style="cursor: auto; background-color: #f1ffe3; padding-top: 1px; padding-bottom: 1px;">Create an SPDX analysis of MyApp that can reference the pre-existing SPDX document for commons-logging-1.1.1.tar.gz without having to repeat all the info (e.g. every File node...) which was already in the consumed SPDX document.</span></div><div id="magicdomid190" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"> </div><div id="magicdomid191" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-ha6r9ljem9yalssm" style="cursor: auto; background-color: #f1ffe3; padding-top: 1px; padding-bottom: 1px;">Discussion:</span></div><div id="magicdomid192" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"> </div><div id="magicdomid193" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-gr61e6romqg35ji7" style="cursor: auto; background-color: #ecbcbc; padding-top: 1px; padding-bottom: 1px;">  A package supplier includes another open source package in source form (e.g. Apache Jakarta Commons Logging).  The source code is unmodified and intended to be compiled into the final solution by the Package Consumer.  The source code is in a distinct archive file (e.g. commons-logging-1.1.1.tar.gz).  The archive source file would be represented as a single file in the highest level SPDX document.  The archive file would contain an SPDX document representing the embedded source files.  </span></div><div id="magicdomid194" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-gr61e6romqg35ji7" style="cursor: auto; background-color: #ecbcbc; padding-top: 1px; padding-bottom: 1px;">  Variation: the source code would be in its own distinct subdirectory (e.g. source/java/org/apache/commons/logging/*).  In this variation, the highest level SPDX document would detail all files within the embedded package and the "artifact-of" property would reference the embedded package.</span></div><div id="magicdomid195" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-ha6r9ljem9yalssm" style="cursor: auto; background-color: #f1ffe3; padding-top: 1px; padding-bottom: 1px;">  [Comment: (BillSchineller) - the use case of the supplier handing off a tarball with accompanying (inside or 'sidecar'...) SPDX analysis/doc is the Given.  But the reality is that the consumer must crack it open and expand its contents into the source tree for the build/compile step.   </span></div><div id="magicdomid196" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"> </div><div id="magicdomid197" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-ha6r9ljem9yalssm" style="cursor: auto; background-color: #f1ffe3; padding-top: 1px; padding-bottom: 1px;">=================</span></div><div id="magicdomid198" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-gr61e6romqg35ji7" style="cursor: auto; background-color: #ecbcbc; padding-top: 1px; padding-bottom: 1px;">  </span></div><div id="magicdomid199" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-gr61e6romqg35ji7" style="cursor: auto; background-color: #ecbcbc; padding-top: 1px; padding-bottom: 1px;">Use Case: embedded source with unused contrib library</span></div><div id="magicdomid200" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-gr61e6romqg35ji7" style="cursor: auto; background-color: #ecbcbc; padding-top: 1px; padding-bottom: 1px;"> Similar to embedded source except there would be source file known to not be compiled into the resultant binaries of the final package, for example the zlib contrib directory.  Solution suggestion: the excluded files could be represented in the SPDX documents with an "unused" property and the license properties for the files would still be represented in the SPDX document (exact mechanism TBD)</span></div><div id="magicdomid201" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"> </div><div id="magicdomid202" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-gr61e6romqg35ji7" style="cursor: auto; background-color: #ecbcbc; padding-top: 1px; padding-bottom: 1px;">Use Case: embedded build tools  A Package Supplier includes build utilities (source, scripts, or binaries) which are only used to build the resultant packages.  The specific build tool files are represented in the SPDX document with the appropriate license and and artifact-of property which points to the origin of the tools.  Solution suggestion: A property could designate that this file is used as a tool.</span></div><div id="magicdomid203" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-gr61e6romqg35ji7" style="cursor: auto; background-color: #ecbcbc; padding-top: 1px; padding-bottom: 1px;"> </span></div><div id="magicdomid204" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-gr61e6romqg35ji7" style="cursor: auto; background-color: #ecbcbc; padding-top: 1px; padding-bottom: 1px;">Use Case: simple redistribution </span></div><div id="magicdomid205" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-gr61e6romqg35ji7" style="cursor: auto; background-color: #ecbcbc; padding-top: 1px; padding-bottom: 1px;"> An Intermediate Packager redistributes an original package without source code modification.  Additional meta data may be supplied by the Intermediate Packager.  Example - Debian packag</span><span class="author-g-sz122z2pgf4uw9k6kz122zz122z6" style="cursor: auto; background-color: #f1e3ff; padding-top: 1px; padding-bottom: 1px;">ing</span><span class="author-g-gr61e6romqg35ji7" style="cursor: auto; background-color: #ecbcbc; padding-top: 1px; padding-bottom: 1px;">.</span></div><div id="magicdomid206" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-gr61e6romqg35ji7" style="cursor: auto; background-color: #ecbcbc; padding-top: 1px; padding-bottom: 1px;"> </span></div><div id="magicdomid207" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-gr61e6romqg35ji7" style="cursor: auto; background-color: #ecbcbc; padding-top: 1px; padding-bottom: 1px;">Use Case: package aggregation </span></div><div id="magicdomid208" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-gr61e6romqg35ji7" style="cursor: auto; background-color: #ecbcbc; padding-top: 1px; padding-bottom: 1px;">  An Intermediate Packager aggregates several open source packages into a single distribution.  Additional meta data is added.  Example - Linux distribution</span><span class="author-g-sz122z2pgf4uw9k6kz122zz122z6" style="cursor: auto; background-color: #f1e3ff; padding-top: 1px; padding-bottom: 1px;">, Android, Ubuntu, Debian</span></div><div id="magicdomid209" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-gr61e6romqg35ji7" style="cursor: auto; background-color: #ecbcbc; padding-top: 1px; padding-bottom: 1px;"> </span></div><div id="magicdomid210" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-gr61e6romqg35ji7" style="cursor: auto; background-color: #ecbcbc; padding-top: 1px; padding-bottom: 1px;">Use Case: modified redistribution </span></div><div id="magicdomid211" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-gr61e6romqg35ji7" style="cursor: auto; background-color: #ecbcbc; padding-top: 1px; padding-bottom: 1px;"> An Intermediate Package redistributes a package from the Package Originator with some modifications to the original code.  These modifications may impact the resultant licensing</span></div><div id="magicdomid212" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"> </div><div id="magicdomid213" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-sz122z2pgf4uw9k6kz122zz122z6" style="cursor: auto; background-color: #f1e3ff; padding-top: 1px; padding-bottom: 1px;">Use Case:  application store - how built and manifest, and how products handled</span></div><div id="magicdomid214" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-sz122z2pgf4uw9k6kz122zz122z6" style="cursor: auto; background-color: #f1e3ff; padding-top: 1px; padding-bottom: 1px;">Pass through provider (Android Market Place, Apple Store), Facebook app?</span></div><div id="magicdomid215" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-sz122z2pgf4uw9k6kz122zz122z6" style="cursor: auto; background-color: #f1e3ff; padding-top: 1px; padding-bottom: 1px;">Downloadable components (clients that are downloadable and resident).</span></div><div id="magicdomid216" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"> </div><div id="magicdomid217" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-gr61e6romqg35ji7" style="cursor: auto; background-color: #ecbcbc; padding-top: 1px; padding-bottom: 1px;">Use Case: patches provided to existing (already distributed) package - An existing package with a pre-existing spdx document is patched.  The patch may contain additional licensing information</span></div><div><span class="author-g-gr61e6romqg35ji7" style="cursor: auto; background-color: #ecbcbc; padding-top: 1px; padding-bottom: 1px;"><br /></span></div>

Technical Team/Old/Use Cases Collected during 1.x timeframe

2012-07-31T18:25:24Z

Knewcomer:

<div id="magicdomid149" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-sz122z2pgf4uw9k6kz122zz122z6" style="cursor: auto; background-color: #f1e3ff; padding-top: 1px; padding-bottom: 1px;">Use cases from fossbazaar site from pre-1.0 discussions</span></div><div style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-sz122z2pgf4uw9k6kz122zz122z6" style="cursor: auto; background-color: #f1e3ff; padding-top: 1px; padding-bottom: 1px;"> ===========================================<br /></span></div><div style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-sz122z2pgf4uw9k6kz122zz122z6" style="cursor: auto; background-color: #f1e3ff; padding-top: 1px; padding-bottom: 1px;"><br /></span></div><div style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-sz122z2pgf4uw9k6kz122zz122z6" style="cursor: auto; background-color: #f1e3ff; padding-top: 1px; padding-bottom: 1px;">https://fossbazaar.org/wiki/spdx-use-case-1</span></div><div style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"></div><div style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-sz122z2pgf4uw9k6kz122zz122z6" style="cursor: auto; background-color: #f1e3ff; padding-top: 1px; padding-bottom: 1px;">some of these taken from http://pad.ubuntu.com/spdx-tech  </span></div><div style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-sz122z2pgf4uw9k6kz122zz122z6" style="cursor: auto; background-color: #f1e3ff; padding-top: 1px; padding-bottom: 1px;"><br /></span></div><div style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-sz122z2pgf4uw9k6kz122zz122z6" style="cursor: auto; background-color: #f1e3ff; padding-top: 1px; padding-bottom: 1px;"><br /></span></div><div style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-sz122z2pgf4uw9k6kz122zz122z6" style="cursor: auto; background-color: #f1e3ff; padding-top: 1px; padding-bottom: 1px;">Use Cases to consider for SPDX 2.0 - working draft</span></div><div id="magicdomid150" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-sz122z2pgf4uw9k6kz122zz122z6" style="cursor: auto; background-color: #f1e3ff; padding-top: 1px; padding-bottom: 1px;">======================================</span></div><div id="magicdomid151" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"> </div><div id="magicdomid152" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-gr61e6romqg35ji7" style="cursor: auto; background-color: #ecbcbc; padding-top: 1px; padding-bottom: 1px;">Source code for SPDX-tools are available at: </span><span class="author-g-gr61e6romqg35ji7 url" style="cursor: auto; background-color: #ecbcbc; padding-top: 1px; padding-bottom: 1px;"><a style="cursor: pointer !important;" href="https://github.com/goneall/SPDX-Tools">https://github.com/goneall/SPDX-Tools</a></span></div><div id="magicdomid153" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"> </div><div id="magicdomid154" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span style="cursor: auto; padding-top: 1px; padding-bottom: 1px;">Use case details:</span></div><div id="magicdomid155" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"> </div><div id="magicdomid156" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span style="cursor: auto; padding-top: 1px; padding-bottom: 1px;"> * </span><span class=" url" style="cursor: auto; padding-top: 1px; padding-bottom: 1px;"><a style="cursor: pointer !important;" href="http://pad.ubuntu.com/spdx-tech--use-case-embedded-java-jar">http://pad.ubuntu.com/spdx-tech--use-case-embedded-java-jar</a></span></div><div id="magicdomid157" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-gr61e6romqg35ji7" style="cursor: auto; background-color: #ecbcbc; padding-top: 1px; padding-bottom: 1px;"> </span></div><div id="magicdomid158" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-gr61e6romqg35ji7" style="cursor: auto; background-color: #ecbcbc; padding-top: 1px; padding-bottom: 1px;"> [The way I am thinking about the use cases is there are 2 different groups of use cases which I am calling scenarios.  From what I can think of the same solutions should work for both scenarios, but there may be value in keeping these 2 scenarios in mind while working through the detailed use cases]</span></div><div id="magicdomid159" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-gr61e6romqg35ji7" style="cursor: auto; background-color: #ecbcbc; padding-top: 1px; padding-bottom: 1px;"> </span></div><div id="magicdomid160" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-gr61e6romqg35ji7" style="cursor: auto; background-color: #ecbcbc; padding-top: 1px; padding-bottom: 1px;"> High level general use case Scenarios:</span></div><div id="magicdomid161" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-gr61e6romqg35ji7" style="cursor: auto; background-color: #ecbcbc; padding-top: 1px; padding-bottom: 1px;"> A: Embedded Packages</span><span class="author-g-ha6r9ljem9yalssm" style="cursor: auto; background-color: #f1ffe3; padding-top: 1px; padding-bottom: 1px;"> (a typical "Audit" scenario)</span></div><div id="magicdomid162" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-gr61e6romqg35ji7" style="cursor: auto; background-color: #ecbcbc; padding-top: 1px; padding-bottom: 1px;"> - Actors: </span></div><div id="magicdomid163" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-gr61e6romqg35ji7" style="cursor: auto; background-color: #ecbcbc; padding-top: 1px; padding-bottom: 1px;">     - Package Supplier: person or entity supplying the package represented by the highest lievel SPDX document</span></div><div id="magicdomid164" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-gr61e6romqg35ji7" style="cursor: auto; background-color: #ecbcbc; padding-top: 1px; padding-bottom: 1px;">     - Package Consumer: person or entity using the package represented by the highest level SPDX document</span></div><div id="magicdomid165" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-gr61e6romqg35ji7" style="cursor: auto; background-color: #ecbcbc; padding-top: 1px; padding-bottom: 1px;">Use Cases: </span></div><div id="magicdomid166" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-gr61e6romqg35ji7" style="cursor: auto; background-color: #ecbcbc; padding-top: 1px; padding-bottom: 1px;">- embedded java jar </span></div><div id="magicdomid167" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-gr61e6romqg35ji7" style="cursor: auto; background-color: #ecbcbc; padding-top: 1px; padding-bottom: 1px;">- embedded source distribution</span></div><div id="magicdomid168" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-gr61e6romqg35ji7" style="cursor: auto; background-color: #ecbcbc; padding-top: 1px; padding-bottom: 1px;">- embedded source with unused contrib library </span></div><div id="magicdomid169" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-gr61e6romqg35ji7" style="cursor: auto; background-color: #ecbcbc; padding-top: 1px; padding-bottom: 1px;">- embedded build tools</span></div><div id="magicdomid170" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"> </div><div id="magicdomid171" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-gr61e6romqg35ji7" style="cursor: auto; background-color: #ecbcbc; padding-top: 1px; padding-bottom: 1px;">B: Package Supply Chain</span></div><div id="magicdomid172" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-gr61e6romqg35ji7" style="cursor: auto; background-color: #ecbcbc; padding-top: 1px; padding-bottom: 1px;">- Actors:</span></div><div id="magicdomid173" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-gr61e6romqg35ji7" style="cursor: auto; background-color: #ecbcbc; padding-top: 1px; padding-bottom: 1px;">  - Package Originator: Original supplier of a package represented by an SPDX document - likely (but not always) the creator</span></div><div id="magicdomid174" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-gr61e6romqg35ji7" style="cursor: auto; background-color: #ecbcbc; padding-top: 1px; padding-bottom: 1px;">  - Intermediate Packager: person or entity that redistributes an original package with its own SPDX document</span></div><div id="magicdomid175" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-gr61e6romqg35ji7" style="cursor: auto; background-color: #ecbcbc; padding-top: 1px; padding-bottom: 1px;">  - End Package Consumer: The consumer of the final package in the supply chain - note that the same entity or person can be both an End Package Consumer and an Intermediate Packager</span></div><div id="magicdomid176" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-gr61e6romqg35ji7" style="cursor: auto; background-color: #ecbcbc; padding-top: 1px; padding-bottom: 1px;">- Use Cases:</span></div><div id="magicdomid177" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-gr61e6romqg35ji7" style="cursor: auto; background-color: #ecbcbc; padding-top: 1px; padding-bottom: 1px;">  - simple redistribution</span></div><div id="magicdomid178" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-gr61e6romqg35ji7" style="cursor: auto; background-color: #ecbcbc; padding-top: 1px; padding-bottom: 1px;">  - package aggregation</span></div><div id="magicdomid179" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-gr61e6romqg35ji7" style="cursor: auto; background-color: #ecbcbc; padding-top: 1px; padding-bottom: 1px;">  - modified redistribution</span></div><div id="magicdomid180" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-gr61e6romqg35ji7" style="cursor: auto; background-color: #ecbcbc; padding-top: 1px; padding-bottom: 1px;">  - patches provided to existing (already distributed) package</span></div><div id="magicdomid181" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-gr61e6romqg35ji7" style="cursor: auto; background-color: #ecbcbc; padding-top: 1px; padding-bottom: 1px;">  - appstore</span></div><div id="magicdomid182" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"> </div><div id="magicdomid183" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-gr61e6romqg35ji7" style="cursor: auto; background-color: #ecbcbc; padding-top: 1px; padding-bottom: 1px;">Use Case: embedded source</span></div><div id="magicdomid184" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-ha6r9ljem9yalssm" style="cursor: auto; background-color: #f1ffe3; padding-top: 1px; padding-bottom: 1px;">Givens:</span></div><div id="magicdomid185" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-ha6r9ljem9yalssm" style="cursor: auto; background-color: #f1ffe3; padding-top: 1px; padding-bottom: 1px;">1) Given a pre-existing source tarball (commons-logging-1.1.1.tar.gz) with an SPDX document is available for re-use</span></div><div id="magicdomid186" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-ha6r9ljem9yalssm" style="cursor: auto; background-color: #f1ffe3; padding-top: 1px; padding-bottom: 1px;">2) Given: To build MyApp which re-uses it, commons-logging-1.1.1.tar.gz gets expanded somewhere into the MyApp source tree</span></div><div id="magicdomid187" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"> </div><div id="magicdomid188" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-ha6r9ljem9yalssm" style="cursor: auto; background-color: #f1ffe3; padding-top: 1px; padding-bottom: 1px;">Problem:</span></div><div id="magicdomid189" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-ha6r9ljem9yalssm" style="cursor: auto; background-color: #f1ffe3; padding-top: 1px; padding-bottom: 1px;">Create an SPDX analysis of MyApp that can reference the pre-existing SPDX document for commons-logging-1.1.1.tar.gz without having to repeat all the info (e.g. every File node...) which was already in the consumed SPDX document.</span></div><div id="magicdomid190" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"> </div><div id="magicdomid191" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-ha6r9ljem9yalssm" style="cursor: auto; background-color: #f1ffe3; padding-top: 1px; padding-bottom: 1px;">Discussion:</span></div><div id="magicdomid192" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"> </div><div id="magicdomid193" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-gr61e6romqg35ji7" style="cursor: auto; background-color: #ecbcbc; padding-top: 1px; padding-bottom: 1px;">  A package supplier includes another open source package in source form (e.g. Apache Jakarta Commons Logging).  The source code is unmodified and intended to be compiled into the final solution by the Package Consumer.  The source code is in a distinct archive file (e.g. commons-logging-1.1.1.tar.gz).  The archive source file would be represented as a single file in the highest level SPDX document.  The archive file would contain an SPDX document representing the embedded source files.  </span></div><div id="magicdomid194" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-gr61e6romqg35ji7" style="cursor: auto; background-color: #ecbcbc; padding-top: 1px; padding-bottom: 1px;">  Variation: the source code would be in its own distinct subdirectory (e.g. source/java/org/apache/commons/logging/*).  In this variation, the highest level SPDX document would detail all files within the embedded package and the "artifact-of" property would reference the embedded package.</span></div><div id="magicdomid195" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-ha6r9ljem9yalssm" style="cursor: auto; background-color: #f1ffe3; padding-top: 1px; padding-bottom: 1px;">  [Comment: (BillSchineller) - the use case of the supplier handing off a tarball with accompanying (inside or 'sidecar'...) SPDX analysis/doc is the Given.  But the reality is that the consumer must crack it open and expand its contents into the source tree for the build/compile step.   </span></div><div id="magicdomid196" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"> </div><div id="magicdomid197" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-ha6r9ljem9yalssm" style="cursor: auto; background-color: #f1ffe3; padding-top: 1px; padding-bottom: 1px;">=================</span></div><div id="magicdomid198" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-gr61e6romqg35ji7" style="cursor: auto; background-color: #ecbcbc; padding-top: 1px; padding-bottom: 1px;">  </span></div><div id="magicdomid199" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-gr61e6romqg35ji7" style="cursor: auto; background-color: #ecbcbc; padding-top: 1px; padding-bottom: 1px;">Use Case: embedded source with unused contrib library</span></div><div id="magicdomid200" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-gr61e6romqg35ji7" style="cursor: auto; background-color: #ecbcbc; padding-top: 1px; padding-bottom: 1px;"> Similar to embedded source except there would be source file known to not be compiled into the resultant binaries of the final package, for example the zlib contrib directory.  Solution suggestion: the excluded files could be represented in the SPDX documents with an "unused" property and the license properties for the files would still be represented in the SPDX document (exact mechanism TBD)</span></div><div id="magicdomid201" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"> </div><div id="magicdomid202" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-gr61e6romqg35ji7" style="cursor: auto; background-color: #ecbcbc; padding-top: 1px; padding-bottom: 1px;">Use Case: embedded build tools  A Package Supplier includes build utilities (source, scripts, or binaries) which are only used to build the resultant packages.  The specific build tool files are represented in the SPDX document with the appropriate license and and artifact-of property which points to the origin of the tools.  Solution suggestion: A property could designate that this file is used as a tool.</span></div><div id="magicdomid203" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-gr61e6romqg35ji7" style="cursor: auto; background-color: #ecbcbc; padding-top: 1px; padding-bottom: 1px;"> </span></div><div id="magicdomid204" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-gr61e6romqg35ji7" style="cursor: auto; background-color: #ecbcbc; padding-top: 1px; padding-bottom: 1px;">Use Case: simple redistribution </span></div><div id="magicdomid205" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-gr61e6romqg35ji7" style="cursor: auto; background-color: #ecbcbc; padding-top: 1px; padding-bottom: 1px;"> An Intermediate Packager redistributes an original package without source code modification.  Additional meta data may be supplied by the Intermediate Packager.  Example - Debian packag</span><span class="author-g-sz122z2pgf4uw9k6kz122zz122z6" style="cursor: auto; background-color: #f1e3ff; padding-top: 1px; padding-bottom: 1px;">ing</span><span class="author-g-gr61e6romqg35ji7" style="cursor: auto; background-color: #ecbcbc; padding-top: 1px; padding-bottom: 1px;">.</span></div><div id="magicdomid206" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-gr61e6romqg35ji7" style="cursor: auto; background-color: #ecbcbc; padding-top: 1px; padding-bottom: 1px;"> </span></div><div id="magicdomid207" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-gr61e6romqg35ji7" style="cursor: auto; background-color: #ecbcbc; padding-top: 1px; padding-bottom: 1px;">Use Case: package aggregation </span></div><div id="magicdomid208" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-gr61e6romqg35ji7" style="cursor: auto; background-color: #ecbcbc; padding-top: 1px; padding-bottom: 1px;">  An Intermediate Packager aggregates several open source packages into a single distribution.  Additional meta data is added.  Example - Linux distribution</span><span class="author-g-sz122z2pgf4uw9k6kz122zz122z6" style="cursor: auto; background-color: #f1e3ff; padding-top: 1px; padding-bottom: 1px;">, Android, Ubuntu, Debian</span></div><div id="magicdomid209" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-gr61e6romqg35ji7" style="cursor: auto; background-color: #ecbcbc; padding-top: 1px; padding-bottom: 1px;"> </span></div><div id="magicdomid210" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-gr61e6romqg35ji7" style="cursor: auto; background-color: #ecbcbc; padding-top: 1px; padding-bottom: 1px;">Use Case: modified redistribution </span></div><div id="magicdomid211" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-gr61e6romqg35ji7" style="cursor: auto; background-color: #ecbcbc; padding-top: 1px; padding-bottom: 1px;"> An Intermediate Package redistributes a package from the Package Originator with some modifications to the original code.  These modifications may impact the resultant licensing</span></div><div id="magicdomid212" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"> </div><div id="magicdomid213" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-sz122z2pgf4uw9k6kz122zz122z6" style="cursor: auto; background-color: #f1e3ff; padding-top: 1px; padding-bottom: 1px;">Use Case:  application store - how built and manifest, and how products handled</span></div><div id="magicdomid214" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-sz122z2pgf4uw9k6kz122zz122z6" style="cursor: auto; background-color: #f1e3ff; padding-top: 1px; padding-bottom: 1px;">Pass through provider (Android Market Place, Apple Store), Facebook app?</span></div><div id="magicdomid215" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-sz122z2pgf4uw9k6kz122zz122z6" style="cursor: auto; background-color: #f1e3ff; padding-top: 1px; padding-bottom: 1px;">Downloadable components (clients that are downloadable and resident).</span></div><div id="magicdomid216" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"> </div><div id="magicdomid217" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-gr61e6romqg35ji7" style="cursor: auto; background-color: #ecbcbc; padding-top: 1px; padding-bottom: 1px;">Use Case: patches provided to existing (already distributed) package - An existing package with a pre-existing spdx document is patched.  The patch may contain additional licensing information</span></div><div><span class="author-g-gr61e6romqg35ji7" style="cursor: auto; background-color: #ecbcbc; padding-top: 1px; padding-bottom: 1px;"><br /></span></div>

Technical Team/Old/Use Cases Collected during 1.x timeframe

2012-07-31T18:24:04Z

Knewcomer:

<div id="magicdomid149" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-sz122z2pgf4uw9k6kz122zz122z6" style="cursor: auto; background-color: #f1e3ff; padding-top: 1px; padding-bottom: 1px;">Use cases from fossbazaar site from pre-1.0 discussions:   https://fossbazaar.org/wiki/spdx-use-case-1</span></div><div style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"></div><div style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-sz122z2pgf4uw9k6kz122zz122z6" style="cursor: auto; background-color: #f1e3ff; padding-top: 1px; padding-bottom: 1px;">some of these taken from http://pad.ubuntu.com/spdx-tech  </span></div><div style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-sz122z2pgf4uw9k6kz122zz122z6" style="cursor: auto; background-color: #f1e3ff; padding-top: 1px; padding-bottom: 1px;"><br /></span></div><div style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-sz122z2pgf4uw9k6kz122zz122z6" style="cursor: auto; background-color: #f1e3ff; padding-top: 1px; padding-bottom: 1px;"><br /></span></div><div style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-sz122z2pgf4uw9k6kz122zz122z6" style="cursor: auto; background-color: #f1e3ff; padding-top: 1px; padding-bottom: 1px;">Use Cases to consider for SPDX 2.0 - working draft</span></div><div id="magicdomid150" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-sz122z2pgf4uw9k6kz122zz122z6" style="cursor: auto; background-color: #f1e3ff; padding-top: 1px; padding-bottom: 1px;">======================================</span></div><div id="magicdomid151" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"> </div><div id="magicdomid152" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-gr61e6romqg35ji7" style="cursor: auto; background-color: #ecbcbc; padding-top: 1px; padding-bottom: 1px;">Source code for SPDX-tools are available at: </span><span class="author-g-gr61e6romqg35ji7 url" style="cursor: auto; background-color: #ecbcbc; padding-top: 1px; padding-bottom: 1px;"><a style="cursor: pointer !important;" href="https://github.com/goneall/SPDX-Tools">https://github.com/goneall/SPDX-Tools</a></span></div><div id="magicdomid153" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"> </div><div id="magicdomid154" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span style="cursor: auto; padding-top: 1px; padding-bottom: 1px;">Use case details:</span></div><div id="magicdomid155" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"> </div><div id="magicdomid156" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span style="cursor: auto; padding-top: 1px; padding-bottom: 1px;"> * </span><span class=" url" style="cursor: auto; padding-top: 1px; padding-bottom: 1px;"><a style="cursor: pointer !important;" href="http://pad.ubuntu.com/spdx-tech--use-case-embedded-java-jar">http://pad.ubuntu.com/spdx-tech--use-case-embedded-java-jar</a></span></div><div id="magicdomid157" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-gr61e6romqg35ji7" style="cursor: auto; background-color: #ecbcbc; padding-top: 1px; padding-bottom: 1px;"> </span></div><div id="magicdomid158" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-gr61e6romqg35ji7" style="cursor: auto; background-color: #ecbcbc; padding-top: 1px; padding-bottom: 1px;"> [The way I am thinking about the use cases is there are 2 different groups of use cases which I am calling scenarios.  From what I can think of the same solutions should work for both scenarios, but there may be value in keeping these 2 scenarios in mind while working through the detailed use cases]</span></div><div id="magicdomid159" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-gr61e6romqg35ji7" style="cursor: auto; background-color: #ecbcbc; padding-top: 1px; padding-bottom: 1px;"> </span></div><div id="magicdomid160" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-gr61e6romqg35ji7" style="cursor: auto; background-color: #ecbcbc; padding-top: 1px; padding-bottom: 1px;"> High level general use case Scenarios:</span></div><div id="magicdomid161" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-gr61e6romqg35ji7" style="cursor: auto; background-color: #ecbcbc; padding-top: 1px; padding-bottom: 1px;"> A: Embedded Packages</span><span class="author-g-ha6r9ljem9yalssm" style="cursor: auto; background-color: #f1ffe3; padding-top: 1px; padding-bottom: 1px;"> (a typical "Audit" scenario)</span></div><div id="magicdomid162" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-gr61e6romqg35ji7" style="cursor: auto; background-color: #ecbcbc; padding-top: 1px; padding-bottom: 1px;"> - Actors: </span></div><div id="magicdomid163" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-gr61e6romqg35ji7" style="cursor: auto; background-color: #ecbcbc; padding-top: 1px; padding-bottom: 1px;">     - Package Supplier: person or entity supplying the package represented by the highest lievel SPDX document</span></div><div id="magicdomid164" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-gr61e6romqg35ji7" style="cursor: auto; background-color: #ecbcbc; padding-top: 1px; padding-bottom: 1px;">     - Package Consumer: person or entity using the package represented by the highest level SPDX document</span></div><div id="magicdomid165" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-gr61e6romqg35ji7" style="cursor: auto; background-color: #ecbcbc; padding-top: 1px; padding-bottom: 1px;">Use Cases: </span></div><div id="magicdomid166" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-gr61e6romqg35ji7" style="cursor: auto; background-color: #ecbcbc; padding-top: 1px; padding-bottom: 1px;">- embedded java jar </span></div><div id="magicdomid167" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-gr61e6romqg35ji7" style="cursor: auto; background-color: #ecbcbc; padding-top: 1px; padding-bottom: 1px;">- embedded source distribution</span></div><div id="magicdomid168" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-gr61e6romqg35ji7" style="cursor: auto; background-color: #ecbcbc; padding-top: 1px; padding-bottom: 1px;">- embedded source with unused contrib library </span></div><div id="magicdomid169" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-gr61e6romqg35ji7" style="cursor: auto; background-color: #ecbcbc; padding-top: 1px; padding-bottom: 1px;">- embedded build tools</span></div><div id="magicdomid170" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"> </div><div id="magicdomid171" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-gr61e6romqg35ji7" style="cursor: auto; background-color: #ecbcbc; padding-top: 1px; padding-bottom: 1px;">B: Package Supply Chain</span></div><div id="magicdomid172" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-gr61e6romqg35ji7" style="cursor: auto; background-color: #ecbcbc; padding-top: 1px; padding-bottom: 1px;">- Actors:</span></div><div id="magicdomid173" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-gr61e6romqg35ji7" style="cursor: auto; background-color: #ecbcbc; padding-top: 1px; padding-bottom: 1px;">  - Package Originator: Original supplier of a package represented by an SPDX document - likely (but not always) the creator</span></div><div id="magicdomid174" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-gr61e6romqg35ji7" style="cursor: auto; background-color: #ecbcbc; padding-top: 1px; padding-bottom: 1px;">  - Intermediate Packager: person or entity that redistributes an original package with its own SPDX document</span></div><div id="magicdomid175" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-gr61e6romqg35ji7" style="cursor: auto; background-color: #ecbcbc; padding-top: 1px; padding-bottom: 1px;">  - End Package Consumer: The consumer of the final package in the supply chain - note that the same entity or person can be both an End Package Consumer and an Intermediate Packager</span></div><div id="magicdomid176" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-gr61e6romqg35ji7" style="cursor: auto; background-color: #ecbcbc; padding-top: 1px; padding-bottom: 1px;">- Use Cases:</span></div><div id="magicdomid177" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-gr61e6romqg35ji7" style="cursor: auto; background-color: #ecbcbc; padding-top: 1px; padding-bottom: 1px;">  - simple redistribution</span></div><div id="magicdomid178" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-gr61e6romqg35ji7" style="cursor: auto; background-color: #ecbcbc; padding-top: 1px; padding-bottom: 1px;">  - package aggregation</span></div><div id="magicdomid179" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-gr61e6romqg35ji7" style="cursor: auto; background-color: #ecbcbc; padding-top: 1px; padding-bottom: 1px;">  - modified redistribution</span></div><div id="magicdomid180" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-gr61e6romqg35ji7" style="cursor: auto; background-color: #ecbcbc; padding-top: 1px; padding-bottom: 1px;">  - patches provided to existing (already distributed) package</span></div><div id="magicdomid181" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-gr61e6romqg35ji7" style="cursor: auto; background-color: #ecbcbc; padding-top: 1px; padding-bottom: 1px;">  - appstore</span></div><div id="magicdomid182" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"> </div><div id="magicdomid183" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-gr61e6romqg35ji7" style="cursor: auto; background-color: #ecbcbc; padding-top: 1px; padding-bottom: 1px;">Use Case: embedded source</span></div><div id="magicdomid184" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-ha6r9ljem9yalssm" style="cursor: auto; background-color: #f1ffe3; padding-top: 1px; padding-bottom: 1px;">Givens:</span></div><div id="magicdomid185" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-ha6r9ljem9yalssm" style="cursor: auto; background-color: #f1ffe3; padding-top: 1px; padding-bottom: 1px;">1) Given a pre-existing source tarball (commons-logging-1.1.1.tar.gz) with an SPDX document is available for re-use</span></div><div id="magicdomid186" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-ha6r9ljem9yalssm" style="cursor: auto; background-color: #f1ffe3; padding-top: 1px; padding-bottom: 1px;">2) Given: To build MyApp which re-uses it, commons-logging-1.1.1.tar.gz gets expanded somewhere into the MyApp source tree</span></div><div id="magicdomid187" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"> </div><div id="magicdomid188" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-ha6r9ljem9yalssm" style="cursor: auto; background-color: #f1ffe3; padding-top: 1px; padding-bottom: 1px;">Problem:</span></div><div id="magicdomid189" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-ha6r9ljem9yalssm" style="cursor: auto; background-color: #f1ffe3; padding-top: 1px; padding-bottom: 1px;">Create an SPDX analysis of MyApp that can reference the pre-existing SPDX document for commons-logging-1.1.1.tar.gz without having to repeat all the info (e.g. every File node...) which was already in the consumed SPDX document.</span></div><div id="magicdomid190" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"> </div><div id="magicdomid191" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-ha6r9ljem9yalssm" style="cursor: auto; background-color: #f1ffe3; padding-top: 1px; padding-bottom: 1px;">Discussion:</span></div><div id="magicdomid192" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"> </div><div id="magicdomid193" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-gr61e6romqg35ji7" style="cursor: auto; background-color: #ecbcbc; padding-top: 1px; padding-bottom: 1px;">  A package supplier includes another open source package in source form (e.g. Apache Jakarta Commons Logging).  The source code is unmodified and intended to be compiled into the final solution by the Package Consumer.  The source code is in a distinct archive file (e.g. commons-logging-1.1.1.tar.gz).  The archive source file would be represented as a single file in the highest level SPDX document.  The archive file would contain an SPDX document representing the embedded source files.  </span></div><div id="magicdomid194" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-gr61e6romqg35ji7" style="cursor: auto; background-color: #ecbcbc; padding-top: 1px; padding-bottom: 1px;">  Variation: the source code would be in its own distinct subdirectory (e.g. source/java/org/apache/commons/logging/*).  In this variation, the highest level SPDX document would detail all files within the embedded package and the "artifact-of" property would reference the embedded package.</span></div><div id="magicdomid195" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-ha6r9ljem9yalssm" style="cursor: auto; background-color: #f1ffe3; padding-top: 1px; padding-bottom: 1px;">  [Comment: (BillSchineller) - the use case of the supplier handing off a tarball with accompanying (inside or 'sidecar'...) SPDX analysis/doc is the Given.  But the reality is that the consumer must crack it open and expand its contents into the source tree for the build/compile step.   </span></div><div id="magicdomid196" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"> </div><div id="magicdomid197" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-ha6r9ljem9yalssm" style="cursor: auto; background-color: #f1ffe3; padding-top: 1px; padding-bottom: 1px;">=================</span></div><div id="magicdomid198" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-gr61e6romqg35ji7" style="cursor: auto; background-color: #ecbcbc; padding-top: 1px; padding-bottom: 1px;">  </span></div><div id="magicdomid199" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-gr61e6romqg35ji7" style="cursor: auto; background-color: #ecbcbc; padding-top: 1px; padding-bottom: 1px;">Use Case: embedded source with unused contrib library</span></div><div id="magicdomid200" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-gr61e6romqg35ji7" style="cursor: auto; background-color: #ecbcbc; padding-top: 1px; padding-bottom: 1px;"> Similar to embedded source except there would be source file known to not be compiled into the resultant binaries of the final package, for example the zlib contrib directory.  Solution suggestion: the excluded files could be represented in the SPDX documents with an "unused" property and the license properties for the files would still be represented in the SPDX document (exact mechanism TBD)</span></div><div id="magicdomid201" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"> </div><div id="magicdomid202" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-gr61e6romqg35ji7" style="cursor: auto; background-color: #ecbcbc; padding-top: 1px; padding-bottom: 1px;">Use Case: embedded build tools  A Package Supplier includes build utilities (source, scripts, or binaries) which are only used to build the resultant packages.  The specific build tool files are represented in the SPDX document with the appropriate license and and artifact-of property which points to the origin of the tools.  Solution suggestion: A property could designate that this file is used as a tool.</span></div><div id="magicdomid203" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-gr61e6romqg35ji7" style="cursor: auto; background-color: #ecbcbc; padding-top: 1px; padding-bottom: 1px;"> </span></div><div id="magicdomid204" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-gr61e6romqg35ji7" style="cursor: auto; background-color: #ecbcbc; padding-top: 1px; padding-bottom: 1px;">Use Case: simple redistribution </span></div><div id="magicdomid205" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-gr61e6romqg35ji7" style="cursor: auto; background-color: #ecbcbc; padding-top: 1px; padding-bottom: 1px;"> An Intermediate Packager redistributes an original package without source code modification.  Additional meta data may be supplied by the Intermediate Packager.  Example - Debian packag</span><span class="author-g-sz122z2pgf4uw9k6kz122zz122z6" style="cursor: auto; background-color: #f1e3ff; padding-top: 1px; padding-bottom: 1px;">ing</span><span class="author-g-gr61e6romqg35ji7" style="cursor: auto; background-color: #ecbcbc; padding-top: 1px; padding-bottom: 1px;">.</span></div><div id="magicdomid206" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-gr61e6romqg35ji7" style="cursor: auto; background-color: #ecbcbc; padding-top: 1px; padding-bottom: 1px;"> </span></div><div id="magicdomid207" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-gr61e6romqg35ji7" style="cursor: auto; background-color: #ecbcbc; padding-top: 1px; padding-bottom: 1px;">Use Case: package aggregation </span></div><div id="magicdomid208" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-gr61e6romqg35ji7" style="cursor: auto; background-color: #ecbcbc; padding-top: 1px; padding-bottom: 1px;">  An Intermediate Packager aggregates several open source packages into a single distribution.  Additional meta data is added.  Example - Linux distribution</span><span class="author-g-sz122z2pgf4uw9k6kz122zz122z6" style="cursor: auto; background-color: #f1e3ff; padding-top: 1px; padding-bottom: 1px;">, Android, Ubuntu, Debian</span></div><div id="magicdomid209" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-gr61e6romqg35ji7" style="cursor: auto; background-color: #ecbcbc; padding-top: 1px; padding-bottom: 1px;"> </span></div><div id="magicdomid210" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-gr61e6romqg35ji7" style="cursor: auto; background-color: #ecbcbc; padding-top: 1px; padding-bottom: 1px;">Use Case: modified redistribution </span></div><div id="magicdomid211" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-gr61e6romqg35ji7" style="cursor: auto; background-color: #ecbcbc; padding-top: 1px; padding-bottom: 1px;"> An Intermediate Package redistributes a package from the Package Originator with some modifications to the original code.  These modifications may impact the resultant licensing</span></div><div id="magicdomid212" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"> </div><div id="magicdomid213" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-sz122z2pgf4uw9k6kz122zz122z6" style="cursor: auto; background-color: #f1e3ff; padding-top: 1px; padding-bottom: 1px;">Use Case:  application store - how built and manifest, and how products handled</span></div><div id="magicdomid214" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-sz122z2pgf4uw9k6kz122zz122z6" style="cursor: auto; background-color: #f1e3ff; padding-top: 1px; padding-bottom: 1px;">Pass through provider (Android Market Place, Apple Store), Facebook app?</span></div><div id="magicdomid215" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-sz122z2pgf4uw9k6kz122zz122z6" style="cursor: auto; background-color: #f1e3ff; padding-top: 1px; padding-bottom: 1px;">Downloadable components (clients that are downloadable and resident).</span></div><div id="magicdomid216" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"> </div><div id="magicdomid217" style="padding-right: 1px; font-family: Arial, sans-serif; font-size: 13px; line-height: 17px;"><span class="author-g-gr61e6romqg35ji7" style="cursor: auto; background-color: #ecbcbc; padding-top: 1px; padding-bottom: 1px;">Use Case: patches provided to existing (already distributed) package - An existing package with a pre-existing spdx document is patched.  The patch may contain additional licensing information</span></div><div><span class="author-g-gr61e6romqg35ji7" style="cursor: auto; background-color: #ecbcbc; padding-top: 1px; padding-bottom: 1px;"><br /></span></div>

Business Team/Events/2012

2012-05-27T15:44:12Z

Knewcomer:

<p>Here are potential events where we would like to have a talk on SPDX.  We will create an abstract that anyone can use.  If you are planning to be at one of these events (or an event that's not listed)  and would like to submit a talk on SPDX, please let Kim know kim.weins@openlogic.com.</p><ul><li>LF<ul><li>Android Builder/Embedded – Feb CA - Mark Gisi Wind River submitting proposal on compliance/SPDX, Phil O to look into including in BD talk</li><li>Collab Summit – Apr CA -- Kim to submit a talk</li><li>Enterprise Summit – May NY</li><li>LinuxCon Japan – June Yokohama -- Shoken Kim & Kirsten Newcomer presenting on SPDX</li><li>LinuxCon NA – Aug San Diego</li><li>LinuxCon Europe – Nov Barcelona</li></ul></li><li>Others<ul><li>DebConf Jul 2012 Nicaragua</li><li>OSCON – Jul Portland -- </li><li>ApacheCOn – Nov  -  Scott Lamons willing to speak</li><li>EclipseCon – Mar DC - BOF Mahshad/Chuck putting together</li><li>FUDCon – Jan VA</li><li>Open World Forum -- End Sep. Guillaume willing to speak</li><li>FOSDEM Legal DevRoom  http://info9.net/wiki/fosdem/LegalIssuesDevRoom/  Philippe O or Antelink</li></ul></li></ul>

General Meeting/Minutes/2012-04-19

2012-04-24T18:41:22Z

Knewcomer:

<p style="margin-top: 5px; margin-right: 0px; margin-bottom: 10px; margin-left: 0px; font-size: 12px; color: #666666; line-height: 18px; font-weight: normal; padding: 0px;">Attendance: 12<br />Previous minutes not reviewed<br />     </p><p style="margin-top: 5px; margin-right: 0px; margin-bottom: 10px; margin-left: 0px; font-size: 12px; color: #666666; line-height: 18px; font-weight: normal; padding: 0px;"><strong>Legal Team Report - Adam<br /></strong></p><ul style="list-style-type: disc; margin-top: 0px; margin-right: 0px; margin-bottom: 10px; margin-left: 20px; font-size: 12px; padding: 0px;"><li style="margin-top: 0px; margin-right: 0px; margin-bottom: 5px; margin-left: 0px;">Discussing proposal for license list submissions. Goals</li><ul><li style="margin-top: 0px; margin-right: 0px; margin-bottom: 5px; margin-left: 0px;">evaluated proposal from business team; would like to makes it easier / faster and take advantage of community</li><li style="margin-top: 0px; margin-right: 0px; margin-bottom: 5px; margin-left: 0px;">will circulate proposal soon</li></ul><li style="margin-top: 0px; margin-right: 0px; margin-bottom: 5px; margin-left: 0px;">Discussion of issues on headers & notices led to broader discussion </li><ul><li style="margin-top: 0px; margin-right: 0px; margin-bottom: 5px; margin-left: 0px;">plan to review vision, direction, refine charter</li><li style="margin-top: 0px; margin-right: 0px; margin-bottom: 5px; margin-left: 0px;">need to clarify problems we want to solve since we can't solve every problem</li><li style="margin-top: 0px; margin-right: 0px; margin-bottom: 5px; margin-left: 0px;">prioritizing problems is a cross-functional concern; plan to discuss more broadly</li></ul><li style="margin-top: 0px; margin-right: 0px; margin-bottom: 5px; margin-left: 0px;">Starting to develop legal use cases</li></ul><p style="margin-top: 5px; margin-right: 0px; margin-bottom: 10px; margin-left: 0px; font-size: 12px; color: #666666; line-height: 18px; font-weight: normal; padding: 0px;"><strong>Technical Team Report - Kate<br /></strong></p><ul style="list-style-type: disc; margin-top: 0px; margin-right: 0px; margin-bottom: 10px; margin-left: 20px; font-size: 12px; padding: 0px;"><li style="margin-top: 0px; margin-right: 0px; margin-bottom: 5px; margin-left: 0px;">2.0 Spec</li><ul><li style="margin-top: 0px; margin-right: 0px; margin-bottom: 5px; margin-left: 0px;">Working through use cases; have extended deadline for capturing use cases</li></ul><li style="margin-top: 0px; margin-right: 0px; margin-bottom: 5px; margin-left: 0px;">1.1 Still in progress</li><ul><li style="margin-top: 0px; margin-right: 0px; margin-bottom: 5px; margin-left: 0px;">additional comment fields proposed: license level and file level</li><li style="margin-top: 0px; margin-right: 0px; margin-bottom: 5px; margin-left: 0px;">as soon as ready, will announce for review and close 2 weeks later</li><li style="margin-top: 0px; margin-right: 0px; margin-bottom: 5px; margin-left: 0px;">rough timeframe: end of May</li></ul></ul><p style="margin-top: 5px; margin-right: 0px; margin-bottom: 10px; margin-left: 0px; font-size: 12px; color: #666666; line-height: 18px; font-weight: normal; padding: 0px;"><strong>Business Team Report - Scott</strong></p><ul style="list-style-type: disc; margin-top: 0px; margin-right: 0px; margin-bottom: 10px; margin-left: 20px; font-size: 12px; padding: 0px;"><li style="margin-top: 0px; margin-right: 0px; margin-bottom: 5px; margin-left: 0px;">Jack & Scott have planned formal hand-off with Kim</li><li style="margin-top: 0px; margin-right: 0px; margin-bottom: 5px; margin-left: 0px;">Call in #s will change; check the webite</li><li style="margin-top: 0px; margin-right: 0px; margin-bottom: 5px; margin-left: 0px;">Primary focus wil be follow-up on SPDX forum brainstorming on ways to encourage adoption </li></ul><p style="margin-top: 5px; margin-right: 0px; margin-bottom: 10px; margin-left: 0px; font-size: 12px; color: #666666; line-height: 18px; padding: 0px;"><strong><br /></strong></p><p style="margin-top: 5px; margin-right: 0px; margin-bottom: 10px; margin-left: 0px; font-size: 12px; color: #666666; line-height: 18px; font-weight: normal; padding: 0px;"><strong>Cross Functional Issues – Kirsten</strong></p><ul style="list-style-type: disc; margin-top: 0px; margin-right: 0px; margin-bottom: 10px; margin-left: 20px; font-size: 12px; padding: 0px;"><li style="margin-top: 0px; margin-right: 0px; margin-bottom: 5px; margin-left: 0px;">Kirsten & Pierre will work with Steve and Martin to create plan for migrating to new web pages</li></ul><p style="margin-top: 5px; margin-right: 0px; margin-bottom: 10px; margin-left: 0px; font-size: 12px; color: #666666; line-height: 18px; font-weight: normal; padding: 0px;"><strong><br /></strong></p><p class="p1" style="margin-top: 5px; margin-right: 0px; margin-bottom: 10px; margin-left: 0px; font-size: 12px; color: #666666; line-height: 18px; font-weight: normal; padding: 0px;"><strong>Attendees</strong></p><ul class="ul1" style="list-style-type: disc; margin-top: 0px; margin-right: 0px; margin-bottom: 10px; margin-left: 20px; font-size: 12px; padding: 0px;"><li class="li2" style="margin-top: 0px; margin-right: 0px; margin-bottom: 5px; margin-left: 0px;">Kirsten Newcomer, Black Duck Software</li><li class="li2" style="margin-top: 0px; margin-right: 0px; margin-bottom: 5px; margin-left: 0px;">Kevin Fleming</li><li style="margin-top: 0px; margin-right: 0px; margin-bottom: 5px; margin-left: 0px;">Pierre LaPonte, nexB</li><li style="margin-top: 0px; margin-right: 0px; margin-bottom: 5px; margin-left: 0px;">Kate Stewart, Canonical</li><li style="margin-top: 0px; margin-right: 0px; margin-bottom: 5px; margin-left: 0px;">Adam Cohn, Cisco</li><li style="margin-top: 0px; margin-right: 0px; margin-bottom: 5px; margin-left: 0px;">Michael Herzog, nexB</li><li style="margin-top: 0px; margin-right: 0px; margin-bottom: 5px; margin-left: 0px;">Scott Lamons, HP</li><li style="margin-top: 0px; margin-right: 0px; margin-bottom: 5px; margin-left: 0px;">Tom Incorvia, Microfocus</li><li style="margin-top: 0px; margin-right: 0px; margin-bottom: 5px; margin-left: 0px;">Chuck Gandreau, Protecode</li><li style="margin-top: 0px; margin-right: 0px; margin-bottom: 5px; margin-left: 0px;">Gary O'Neall, Source Auditor</li><li style="margin-top: 0px; margin-right: 0px; margin-bottom: 5px; margin-left: 0px;">Mark Gisi, Windriver</li><li style="margin-top: 0px; margin-right: 0px; margin-bottom: 5px; margin-left: 0px;">Jack Manbeck, TI</li></ul>

Technical Team/Use Cases/2.0

2012-04-06T21:00:21Z

Knewcomer:

<p>We have several sources to begin pulling for SPDX Use Cases:</p><ol><li>The Pad from earlier conversations collected at <a href="http://spdx.org/wiki/use-cases-collected-20-discussion">Use Cases For SPDX 2.0 Discussion</a></li><li>The old <a href="http://spdx.org/wiki/spdx-use-case-1">SPDX 1.0 Use Cases</a> as well as the <a href="http://spdx.org/system/files/ecosystem.jpg">SDPX 1.0 Use Case Picture</a>.</li></ol><div> </div><div>I'd like to propose that we flesh out use cases here by having a brief summary listed here as a link to a more detailed child page.   Note, these use cases should be *<strong>doable</strong>* but in general not *<strong>required</strong>*.  Any item listed here that is not a link, should have a child page created for it.</div><div> </div><div><ol><li>Code commits (original work intended for the project)</li><ol><li><a href="http://spdx.org/wiki/committers-provides-spdx-data-code-being-committed">Committer provides SPDX data</a></li><li><a href="http://spdx.org/wiki/contributor-makes-commit-subject-existing-spdx-data-project">Contributor makes commit  subject to existing SPDX data of project</a></li><li>Contributor makes commit subject to existing SPDX data of a dual licensed project and selects one license</li><li>Committer annotates source files with SPDX data</li></ol><li>Patches (original work intended for the project)</li><ol><li>Patch provider provides SPDX data for the patch</li><li>Patch provider provides SPDX data for the patch indicating it is licensed however the hell its applied</li><li>Patch provider provides patch subject to existing SPDX data of project</li><li>Patch provider provides a patch that modifies existing SPDX data of project</li></ol><li><a href="http://spdx.org/wiki/spdx-20-usecase-upstream-maintainer-providing-spdx-data">Upstream maintainer providing SPDX data</a></li><ol><li><a href="http://spdx.org/wiki/upstream-maintainer-providing-spdx-data-source-archive">Upstream maintainer providing SPDX data in source archive</a></li><li><a href="http://spdx.org/wiki/upstream-maintainer-providing-spdx-data-scm">Upstream maintainer providing SPDX data in SCM</a></li><li>Upstream maintainer providing SPDX data at a URL</li><li>Upstream maintainer preparing release artifacts (including SPDX data).</li></ol><li>Unaffiliated third party provides SPDX data for a project</li><li>Project maintainer incorporates another project</li><ol><li>Project maintainer incorporates another project by including source</li><li>Project maintainer incorporates another project by including binary</li><li>Project maintainer incorporates another copyrightable artifact by reference (think maven, possibly linking cases)</li><ol><li>by static reference (the referenced library is included with a redistribution)</li><li>by dynamic reference (express runtime dependency on the external library, but not redistributing it)</li><li>Maven case</li></ol><li>Project maintainer pulling individual files out of another project (subsetting)</li></ol><li>Intermediate packager (rpm, deb, etc) passing on and adding to SPDX Data</li><ol><li>Intermediate packager builds source package from upstream source</li><ol><li><a href="http://spdx.org/wiki/intermediate-packager-builds-source-package-upstream-source-provides-spdx-data">Intermediate packager builds source package from upstream source that provides SPDX data</a></li><li>Intermediate packager builds source package from upstream source that does not provide SPDX data</li></ol><li>Intermediate packager builds binary package from upstream source</li><ol><li><a href="http://spdx.org/wiki/intermediate-packager-builds-binary-package-upstream-source-provides-spdx-data">Intermediate packager builds binary package from upstream source that provides SPDX data</a></li><li>Intermediate packager builds binary package from upstream source that does not provides SPDX data</li></ol><li>Intermediate packager adds patches to upstream source </li><ol><li><a href="http://spdx.org/wiki/intermediate-packager-adds-patches-upstream-source-provides-spdx-data">Intermediate packager adds patches to upstream source that provides SPDX data</a></li><li>Intermediate packager adds patches to upstream source that does not provide SPDX data</li></ol><li>Intermediate packager adds someone else's patches to upstream source</li><ol><li><a href="http://spdx.org/wiki/intermediate-packager-adds-someone-elses-patches-upstream-source-provides-spdx-data">Intermediate packager adds someone else's patches to upstream source that provides SPDX data</a></li><li>Intermediate packager adds someone else's patches to upstream source that does not provide SPDX data</li></ol><li>Intermediate packager subsetting upstream source</li><ol><li><a href="http://spdx.org/wiki/intermediate-packager-subsetting-upstream-source-provides-spdx-data">Intermediate packager subsetting upstream source that provides SPDX data</a></li><li>Intermediate packager subsetting upstream source that does not provide SPDX data</li></ol><li>Intermediate packager chooses to distribute one of multiple available under licenses provided for by upstream (check with legal team)</li><li>Intermediate packager reviews SPDX data provided by upstream.</li></ol><li>Build systems (build systems want to pass on SPDX data for the thing they are building)</li><ol><li>Yocto [Jack Manbeck]</li><ol><li>How does SPDX work in an environment where the sources aren't there, but are pulled from git or a mirror and patched.</li></ol><li>Maven [ Brian Fox ]</li><ol><li>Rolling into release artifacts things only referenced in the POM file</li><li>Shading (subsetting) portions of a transitive dependency for inclusion in your artifact</li></ol><li>Continuous integration around SPDX files (fixing SPDX files for commits coming in etc).</li></ol><li>Aggregator aggregating many 'copyrightable items' for redistribution</li><ol><li>Linux Distros [Kate Stewart]</li><li>Embedded Images (e.g. router images, switch images)</li><li>SDKs [Jack Manbeck]</li><li><a href="http://spdx.org/wiki/spdx-20-usecase-reference-implementations">Reference implementations </a>[Jack Manbeck]</li><li>Eclipse/OSGI distributions</li><li><a href="http://spdx.org/wiki/spdx-20-usecase-application-which-ships-documentation-media-software">Application which ships with documentation +  media + software</a> [Jack Manbeck]</li><li><a title="Use case details" href="http://spdx.org/wiki/application-which-ships-contrib-libraries">Application which ships with a contrib libraries</a> [Gary O'Neall]</li><li><a title="Use case details" href="http://spdx.org/wiki/application-which-ships-development-tools">Application which ships with development tools</a> [Gary O'Neall]</li><li>Receiving what appears to be commercial software but that commercial software contains Open Source</li><li>Receiving what appears to be opensource software but that opensource software contains commercial software</li><li>Subsetting out only the shippable bits of stuff coming from an SDK</li></ol><li>Tool used to produce software infecting distribution license of the software itself [Kevin Fleming]</li><li>Aggregators aggregating other aggregations for redistribution</li><li>I just made a binary out of some source</li><ol><li>SPDX data indicating subset of the source that made it into a particular binary or binary package</li></ol><li>Asserting corrections to SPDX data provided by others further upstream</li><li>Consumers receiving SPDX data</li><ol><li>Procurement needs to view it and review it</li><li>Legal department needs to review</li><li>Comply with licensing when there are multiple rights holders each with licensing use under a different license</li><li>Bradley want to extract all rights holders for a particular file</li><li>Multiple SPDX files you need to reconcile</li><li>Recognizing the same SPDX data for the same code coming from multiple supply chain paths</li><li>Incomplete SPDX data you may need to complete</li><li>Flagging potential issues revealed by the SPDX</li><ol><li>License conflicts</li><li>Listing out obligations</li></ol></ol><li>Consuming code snippets (God help us all) (subfile pieces of code not originally intended for the project) [Gary O'Neall]</li><ol><li>Make sure that the license and copyright information for a snippet is reflected in the SPDX data for the file</li><li>Track differently licensed snippets explicitely</li><li>Handle the case where code is copied and pasted through online forums etc.</li></ol><li>Signoff/multiple signoff on SPDX data</li><ol><li>Contracts with multiple parties requiring signoff by all [Kate Stewart]</li><li>Signing off on only a subset of the SPDX data (of an SPDX document in progress?)</li></ol><li>Auditor scenario: given big pile of 'copyrightable items', creating Bill of Materials [Peter Williams]</li><ol><li>Acceptable usage communicated by auditor [Peter Williams]</li><li>Intended usage communicated by the auditee [Bill Schineller]</li><li>Did the code that I shipped (the binaries) match the copyrightable items.</li><li><a href="http://spdx.org/wiki/collecting-enough-information-allow-auditor-make-recommendations-remove-or-not-component">Collecting enough information to allow auditor to make recommendations to remove or not a component</a></li></ol><li>Sanity-checking Bill of Material</li><ol><li>outbound: validate that SPDX goes hand in hand with what's being shipped [Kirsten Newcomer]</li><ol><li>Check to see if the SPDX data provided matches the files provided [Kirsten Newcomer]</li><li>Check to see if the SPDX file is internally consistent (do I have a license refs to match licenses)</li></ol><li>inbound:  validate that SPDX goes hand in hand with what's being brought in [Kirsten Newcomer]</li><ol><li>Chcek to see if the SPDX data matches the files you are shipping [Kirsten Newcomer]</li><li>Check to see if the SPDX file is internally consistent (do I have a license refs to match licenses)</li></ol><li>SPDX lint</li></ol><li>Java complications [Richard Fontana]</li><ol><li>What to do about installers that download JDK directly from sun.</li></ol><li>Tooling to assist with copyright registration for changes between versions</li><li>Conveying Encryption content (Export Control implications) of a package/file in a package [someone at collab summit]</li><li>Conveying Security Vulnerability information [Jianshen O.- Huawei]</li><li>Linking</li><ol><li>Debian has an interest in only building things that are linking license compatible</li><ol><li>If a tool is consuming SPDX data to interact with heuristics.</li></ol></ol><li>Migrating from one version of the SPDX spec to another (moving a file from SPDX 1.0 to 2.0 for example)</li><li>Extensions:</li><ol><li>Communicate data beyond what is described in spec between consenting parties w/o breaking consumers that are not in the know [Peter Williams]</li><li>Experimental improvements for new flavors data in SDPX files w/o breaking consumers that are not in the know. [Peter Williams]</li><li>License list extensions, how do you handle folks who have more licenses than SPDX [Peter Williams]</li><li>Decorating an already produces and signed SPDX dataset with extension data [Bill Schineller]</li></ol><li>SPDX-Lite:</li><ol><li>Allow a low investment SPDX producer to produce valid SPDX data</li><li>Produce a valid SPDX dataset even if data is missing for some data we would like to</li></ol><li>Equivalence classes of binaries and tracking back to the same source and source SPDX data.</li><ol><li>Consider what to do about license metafiles</li><li>COPYING files</li><li>LICENSE.* files</li><li>README.*</li><li>Think about how to handle NOTICE files and Apache</li></ol><li>Helping to meet the obligations of the licenses</li><ol><li>How to capture attribution information for binaries</li><li>Help with redistribution obligations</li></ol><li>Downstream consumers contributing patches to SPDX data to upstream.</li><li>Look at a 'pingback' (URL string similar for blogs)kind of mechanism for original providers of SPDX (to allow them to figure out where it's used) [Andrew Hsu]</li><li>Cloud</li><ol><li>Materializing a VM and making sure it's OK from a licensing mechanism</li><li>SugarCRM case, obligation by virtue of using web service interface</li></ol><li>How are we going to handle Public Domain.</li><li>Allow the NDA status of an SPDX document to be communicated in a machine readable way (not just a comment) for organizations that don't want the SPDX document to be publicly released [Mark Baushke from Juniper]</li></ol><div> </div><div><div><h2>Cross-cutting concerns:</h2></div><div><ol><li>Provenance (the need to optionally use signing to validate who said what)</li><li>Trust</li><li>Handling staleness of data</li><li>Composite licensing</li><li>Ease of sharing information</li><ol><li>Collecting tribal knowledge along the way </li></ol><li>Guarding against file bloat</li><li>Simple simple simple</li><li>Clarity</li><li>Automation/toolifiability</li><li>Regionality</li></ol></div></div></div><div><h2>Themes:</h2></div><div> </div><div>Looking at these Use Cases, there are some underlying themes:</div><div><ol><li>Root of data (closer to upstream the better)</li><li>Subsetting of copyrightable things (and their SPDX data) (<strong>Note</strong>: Subsets of copyrightable things are usually also copyrightable things)</li><li>Aggregation of copyrightable things (and their SPDX data) (<strong>Note</strong>: Aggregations of copyrightable things are usually also copyrightable things).</li></ol></div><div> </div><div> </div><p> </p>

Technical Team/Minutes/2012-04-04

2012-04-05T23:41:16Z

Knewcomer:

<p class="MsoNormal">Minutes for April 4, 2012 Face to Face meeting at Linux Collaboration Summit</p><p>Attendees:</p><p>Marshall Clow</p><p>Kate Stewart</p><p>Ed Warnicke</p><p>Jack Manbeck</p><p>Gary O’Neall</p><p>Peter Williams</p><p>Bill Schineller</p><p>Kirsten Newcomer</p><p> </p><p><strong>Discussed proposed agenda for Thursday afternoon (4/5) meeting</strong></p><ul><li>Use case discussion (Thursday)</li><li>Mandatory vs. non-mandatory / backwards compatibility</li><li>SPDX Tech web site<ul><li>Review progress; request update from volunteers, and from Steve C.</li></ul></li></ul><p> <strong>Steps needed to close on v 1.1 of the spec</strong></p><ul><li>Get Tech team to sign off, then publish to general team for final review</li><li>Open issues:<ul><li>final pass to ensure RDF and spec are in synch -- Kate</li><li>Appendix 1 will be updated to reflect what’s on the website as of date -- Kate</li><li>Review section 1 to see if it needs to be updated  -- Kirsten</li><li>Compare version 1.1 and 1.0 side by side -- Kirsten</li><li>Compare RDF terms, Spec terms, and tool implementation for 1.1 - Gary</li><li>5.3 & 5.4:<ul><li>Per discussion, these fields will be made OPTIONAL -- Kate</li><li>Peter to provide a proposal for how to present RDF examples for these fields</li></ul></li></ul></li><li>Provide guidelines to consumers for adopting 1.1<ul><li>Minimum: update Data License and Package verification code</li><li>Available OSS tools support multiple versions of the spec</li></ul></li></ul><p> <strong>Proposed governance model for SDPX Technical group</strong></p><ul><li>Post agenda one day ahead of call</li><ul><li>Kate owns and will delegate as needed</li></ul><li>Proposals to be voted on will be posted to wiki and sent to mailing list</li><ul><li>Votes sent to mailing list</li><li>Votes tabulated on wiki (with names)</li></ul><ul><li>We will use Plus one model for votes<ul><li>Plus one (+) is a yes vote</li><li>Minus (-) is a no vote</li><li>Zero (0) is a present / don’t care vote</li></ul></li></ul><li>Any objection / negative vote results in a call scheduled on the topic<ul><li>We assume that if you voted minus, you’ll participate in call</li></ul></li></ul><p><strong>Brief discussion of signing & review fields</strong></p><ul><li>Suggest using annotations on already signed files for review data</li></ul><p><strong>Discussed schedule for 2.0. Potential schedule:</strong></p><ul><li>Draft by end of 2012, with beta program<ul><li>Need tools lined up to support beta</li><li>Provide v2.0 SPDX document as an example</li><li>2.0 GA is about 1 year out</li></ul></li></ul><p><strong>Proposed To-Do list for next 12 months</strong></p><ul><li>Mailing list for users: spdx-users</li><li>Publicize IRC channel; ensure registered</li><li>Additional tools needed</li><ul><li>SPDX document for existing tools -- Gary</li><li>SPDX validator – enhance viewer</li><li>Reading packages and generating SPDX files – Ninka, Fossology<ul><li>Gary has offered to help Fossology</li></ul></li><li>License matching normalization – Kate & Daniel G.</li><li>License matcher – input text, and check to see if one of the standard licenses, leverage normalization tool</li></ul><ul><li>Existing tools now handle tag value format<ul><li>Go between tag and rdf and spreadsheet</li></ul></li></ul><li>Tooling available with<ul><li>Ubuntu – Kate & Gary</li><li>RPM</li></ul></li><li>SPDX tools available via SaaS model<ul><li>Amazon offers an option here</li><li>Gary has an instance already; UI needed</li><li>Ask LF to pay for hosting this instance for fixed domain (Kate/Jack will approach Jim when we’re ready)</li></ul></li><li>Additional documentation is needed</li><ul><li>Getting Started Guide with SPDX</li><li>YouTube video</li><li>Update tools documentation – Kirsten</li><li>Translated version of v1.1 into Japanese – Kirsten to see if I can find a volunteer to do this by June</li><ul><li>Future: identify process for getting spec and related materials translated by community volunteers</li></ul></ul></ul><p>SPDX 2.0 Use Case review & discussion: changes based on discussion captured in wiki changes</p><ul><li>NOTE: Review to continue starting with item 12.</li></ul><p> </p><p>As always, comments and corrections are most welcome!</p><p>Kirsten</p>

Technical Team/Minutes/2012-04-04

2012-04-05T01:21:23Z

Knewcomer:

<p class="MsoNormal">Minutes for April 4, 2012 Face to Face meeting at Linux Collaboration Summit</p><p>Attendees:</p><p>Marshall Clow</p><p>Kate Stewart</p><p>Ed Warnicke</p><p>Jack Manbeck</p><p>Gary O’Neall</p><p>Peter Williams</p><p>Bill Schineller</p><p>Kirsten Newcomer</p><p> </p><p><strong>Discussed proposed agenda for Thursday afternoon (4/5) meeting</strong></p><ul><li>Use case discussion (Thursday)</li><li>Mandatory vs. non-mandatory / backwards compatibility</li><li>SPDX Tech web site<ul><li>Review progress; request update from volunteers, and from Steve C.</li></ul></li></ul><p> <strong>Steps needed to close on v 1.1 of the spec</strong></p><ul><li>Get Tech team to sign off, then publish to general team for final review</li><li>Open issues:<ul><li>final pass to ensure RDF and spec are in synch -- Kate</li><li>Appendix 1 will be updated to reflect what’s on the website as of date -- Kate</li><li>Review section 1 to see if it needs to be updated  -- Kirsten</li><li>Compare version 1.1 and 1.0 side by side -- Kirsten</li><li>5.3 & 5.4:<ul><li>Per discussion, these fields will be made OPTIONAL -- Kate</li><li>Peter to provide a proposal for how to present RDF examples for these fields</li></ul></li></ul></li><li>Provide guidelines to consumers for adopting 1.1<ul><li>Minimum: update Data License and Package verification code</li><li>Available OSS tools support multiple versions of the spec</li></ul></li></ul><p> <strong>Proposed governance model for SDPX Technical group</strong></p><ul><li>Post agenda one day ahead of call</li><ul><li>Kate owns and will delegate as needed</li></ul><li>Proposals to be voted on will be posted to wiki and sent to mailing list</li><ul><li>Votes sent to mailing list</li><li>Votes tabulated on wiki (with names)</li></ul><ul><li>We will use Plus one model for votes<ul><li>Plus one (+) is a yes vote</li><li>Minus (-) is a no vote</li><li>Zero (0) is a present / don’t care vote</li></ul></li></ul><li>Any objection / negative vote results in a call scheduled on the topic<ul><li>We assume that if you voted minus, you’ll participate in call</li></ul></li></ul><p><strong>Brief discussion of signing & review fields</strong></p><ul><li>Suggest using annotations on already signed files for review data</li></ul><p><strong>Discussed schedule for 2.0. Potential schedule:</strong></p><ul><li>Draft by end of 2012, with beta program<ul><li>Need tools lined up to support beta</li><li>Provide v2.0 SPDX document as an example</li><li>2.0 GA is about 1 year out</li></ul></li></ul><p><strong>Proposed To-Do list for next 12 months</strong></p><ul><li>Mailing list for users: spdx-users</li><li>Publicize IRC channel; ensure registered</li><li>Additional tools needed</li><ul><li>SPDX document for existing tools -- Gary</li><li>SPDX validator – enhance viewer</li><li>Reading packages and generating SPDX files – Ninka, Fossology<ul><li>Gary has offered to help Fossology</li></ul></li><li>License matching normalization – Kate</li><li>License matcher – input text, and check to see if one of the standard licenses, leverage normalization tool</li></ul><ul><li>Existing tools now handle tag value format<ul><li>Go between tag and rdf and spreadsheet</li></ul></li></ul><li>Tooling available with<ul><li>Ubuntu – Kate & Gary</li><li>RPM</li></ul></li><li>SPDX tools available via SaaS model<ul><li>Amazon offers an option here</li><li>Gary has an instance already; UI needed</li><li>Ask LF to pay for hosting this instance for fixed domain (Kate/Jack will approach Jim when we’re ready)</li></ul></li><li>Additional documentation is needed</li><ul><li>Getting Started Guide with SPDX</li><li>YouTube video</li><li>Update tools documentation – Kirsten</li><li>Translated version of v1.1 into Japanese – Kirsten to see if I can find a volunteer to do this by June</li><ul><li>Future: identify process for getting spec and related materials translated by community volunteers</li></ul></ul></ul><p>SPDX 2.0 Use Case review & discussion: changes based on discussion captured in wiki changes</p><ul><li>NOTE: Review to continue starting with item 12.</li></ul><p> </p><p>As always, comments and corrections are most welcome!</p><p>Kirsten</p>

SPDX FAQ

2011-08-16T22:14:14Z

Knewcomer:

<p> </p><p><strong>FAQ Sections:</strong></p><p>Different sections of the SPDX FAQ list are maintained by different people. Suggestions for new questions or feedback on existing content for a given section should be sent to the respective maintainer:</p><p style="padding-left: 30px;">General                            - Kim Weins (<a href="mailto:Kim.Weins@openlogic.com">Kim.Weins@openlogic.com</a>)<br />Using the SPDX Spec   - Mark Gisi (<a href="mailto:Mark.Gisi@WindRiver.com">Mark.Gisi@WindRiver.com</a>)<br />Licenses                          - Jilayne Lovejoy (<a href="mailto:Jilayne.Lovejoy@openlogic.com">Jilayne.Lovejoy@openlogic.com</a>)<br />Tools                                - Kirsten Newcomer (<a href="mailto:KNewcomer@blackducksoftware.com">KNewcomer@blackducksoftware.com</a>)<br />Technical Details           - Kate Stewart (<a href="mailto:kate.stewart@att.net">Kate.Stewart@att.net</a>) </p><p><strong><span style="text-decoration: underline;">General</span></strong></p><ul><li>What is the SPDX Specification? <ul><li>The SPDX Specification enables suppliers and consumers of software that contains open source code to provide a "bill of materials" that describes the open source licenses and components that are included.  The specification defines a common file format to communicate this information.</li></ul></li></ul><ul><li>Who do you expect to use the SPDX Specification? <ul><li>The specification is designed for use by participants in the software supply chain.  Some potential use cases for the spec: <ul><li>Developers of open source projects could provide an SPDX file to users of that project</li><li>Linux distros could require upstream projects that are included in the distro to provide an SPDX file</li><li>Developers of software that includes a Linux distro or open source project could provide an SPDX file to their users or customers</li><li>In the mobile industry, chipset providers, mobile providers and carriers could exchange SPDX files as software moves through the supply chain</li></ul></li></ul></li></ul><ul><li>Am I required to use the SPDX specification? <ul><li>The SPDX organization does not and can not make it a requirement for anyone to use the SPDX specification.  However, we do encourage the use of SPDX as a way to streamline the processes needed to analyze software for open source licenses.  However, there may be companies or organizations that DO require use of the SPDX specification and the creation of SPDX files as part of contracts with their supply chain partners.  For example, a mobile handset vendor might require, as part of a contract, that it's supplier provide an SPDX file along with any software.</li></ul></li></ul><ul><li>Who created the SPDX spec? <ul><li>The specification is being created by a working group of the Linux Foundation.  Its members represent a wide spectrum of open source creators and consumers, including open source communities, Linux distros, mobile supply chain companies, software companies, makers of open source scanning tools and service providers.  The process is an open process, run much like an open source community, and the group is open for anyone that wants to participate.  Membership in the Linux Foundation is not required to participate.</li></ul><strong> </strong></li></ul><p><span style="text-decoration: underline;"><strong>Using the SPDX Spec</strong></span></p><ul><li>Is an SPDX file associated with a particular piece of software? <ul><li>Yes.  An SPDX file is associated with a specific version of a software package.  A package may consist of one or more files. When any changes are made to a particular version of software, the corresponding SPDX file will also need to be updated to reflect those changes.</li></ul></li><li>What information is included in an SPDX file? <ul><li>We refer you to the SPDX specification for complete details, but at a high level, the SPDX file contains license information about each file that is included in a particular piece of software.  For example, the information in the SPDX file indicates what license (if any) is associated with each file.  It may also include information about what open source project or component that file originated from.  </li></ul></li><li>How do I know if the information included in the SPDX file is accurate? <ul><li>There are several ways to assess the level of trust in an SPDX file. <ul><li>Each SPDX file includes a history of who created and reviewed the information -- similar to what you would see for authors of open source code.  By reviewing that information, you can make your own assessment of the level of trust you place in the creators.  </li><li>In cases where you receive the SPDX file from a supply chain partner, you may also have separate contractual arrangements whereby a supplier vouches for or guarantees the accuracy of the SPDX file. </li><li>You may choose to use software tools that can scan software and validate the accuracy of the SPDX file.</li><li>You may choose to use software tools that can scan software and validate the accuracy of the SPDX file.</li></ul></li></ul></li><li>How does one handle non open source licenses or licenses not found in the SPDX approved license list? <ul><li>When a license identified in the software package is not found in the list of approved SPDX licenses, one can add the license text to the SPDX file and define a new license label. That license label is defined only for that specific SPDX file.</li></ul></li><li>How does SPDX work with binaries? <ul><li>Binary files represent just another file type. License information (if known) should be assigned to each file regardless of its file type (e.g., binary, source, script …). </li></ul></li><li>How does one represent a file or package that is dual licensed (i.e., a license choice)? <ul><li>SPDX license information can be represented using conjunctive or disjunctive regular expressions.  For example, a file that is dual licensed under either the GPL-2.0 or MIT would be represented using the following disjunctive expression: GPL-2.0 OR MIT.  </li></ul></li><li>How does one represent a file that is licensed under two or more licenses? <ul><li>SPDX license information can be represented using conjunctive or disjunctive regular expressions.  For example, a file that is subject to the Apache-2.0, MIT and GPL-2.0 would be represented using the following conjunctive expression: Apache-2.0 AND MIT AND GPL-2.0.</li></ul></li><li>The Creator field is mandatory. If my organization does not permit me or my organization to be listed in the Creator field, is the SPDX file non-compliant? <ul><li>Although including a value for this field is mandatory, one can always choose the value: ANONYMOUS as described in section 3 of the specification. Use of the ANONYMOUS value would be compliant with the SPDX specification.</li></ul></li><li>What license is the SPDX specification document available under? <ul><li>The SPDX specification document is available under the  Creative Commons Attribution 3.0 Unported License. A copy of the license can be found in the appendix of the <span style="font-size: 10pt; line-height: 115%; font-family: "Calibri","sans-serif"; mso-fareast-font-family: Calibri; mso-bidi-font-family: 'Times New Roman'; mso-ansi-language: EN-US; mso-fareast-language: EN-US; mso-bidi-language: AR-SA;">specification</span>.</li></ul></li><li>What license is the SPDX file data under? <ul><li>The first version of the specification requires the SPDX file data to be placed under the Open Data Commons Public Domain Dedication and License 1.0 (“PDDL-1.0”).  There are plans to revisit this requirement in future revisions of the specification. See section 2 of the specification for more details.</li></ul></li><li>Can I share a collection of SPDX files I created with another party under confidential terms? <ul><li>The specification states that although it requires the SPDX data to be available under the Open Data Commons Public Domain Dedication and License 1.0 (“PDDL-1.0”), it does not prohibit one from entering into a confidentially agreement with   another party  where the agreement restricts sharing of the SPDX data. See section 2 of the specification for more details.</li></ul></li><li>Why are there two different license fields for a package (Concluded License and Declared License)? <ul><li>The Concluded License field is the license the SPDX file creator believes governs the package. The Declared License is what the authors of a project believe govern the package. Often these fields have the same value. When they are different the SPDX file creator should provide background information in the Comments on License field.</li></ul></li><li>Why does the specification include examples for both Name/Value tag and RDF/XML formats?<ul><li>Name/Value tag and RDF/XML formats are two very popular data syntax representations used within the open source community. The SPDX file creator can choose to represent the SPDX data using either format and therefore examples are provided for both.</li></ul></li><li>Can I use the SPDX trademark?<ul><li>Yes. There terms and condition can be found here: <a href="http://www.spdx.org/trademark">http://www.spdx.org/trademark</a> </li></ul></li></ul><p><strong><span style="text-decoration: underline;"> </span></strong></p><p><strong><span style="text-decoration: underline;">Licenses (i.e. the SPDX License List)</span></strong></p><ul><li>What is the SPDX License List? <ul><li>The SPDX License List is a list of well known, commonly-used, and Open Source Initiative (OSI) approved open source software licenses.  The list includes the following fields for each license: <ul><li>The full name of the license</li><li>A short identifier for use in an SPDX file</li><li>A url for where the original license can be found</li><li>Any relevant notes about the license, (such as if its been since deprecated or its relationship to other license)</li><li>The license text itself</li></ul></li></ul></li><li><span lang="EN-GB">Why does it exist?</span> <ul><li>The purpose of the SPDX License List is to provide short identifiers for popular and common licenses.  The full license text associated with each license on the SPDX License list will have a unique, permanent URL on the SPDX.org website. Being able to refer to licenses via the short form identifier lessens the SPDX file size and allows for unambiguous license identification.</li></ul></li><li><span lang="EN-GB">How do I identify licenses not on the SPDX License List?</span> <ul><li>The SPDX specification includes a way to identify and include open source licenses that are not on the SPDX License List.  In this case, a short form identifier for the license is created and the full text of the license included in the SPDX file.</li></ul></li><li>Why are some licenses I've heard of included on the list and some not? <ul><li>The primary purpose of the list is to provide a short form identifier for common or popular open source software licenses.  To create this list, the SPDX legal work group included all the OSI approved licenses and any other license members of the work group had experience with "in the wild."  All versions (even if since deprecated) of these licenses were also included.  It was always contemplated that the list would grow over time, so the initial goal was to provide a sensible starting point such that the most commonly found licenses would have a short identifier.</li></ul></li><li>How to request adding a license to SPDX License List?</li><li>What if I find a license or license variation that is not on the SPDX License List - how do I identify that license?</li></ul><p> </p><p><span style="text-decoration: underline;"><strong>Tools</strong></span></p><ul><li>Are there tools available that can help me create, validate or read an SPDX file?</li></ul><blockquote><ul><li>The SPDX Group has developed some open source tools to assist with creation, viewing and validation of SPDX documents. The tools are intended to:<br />•    Reduce the effort of creating, consuming and validating SPDX Documents<br />•    Provide a translation from the technical document (e.g. RDF/XML or tag-value format) to a more readable format<br />•    Provide a mechanism for validating SPDX documents<br />•    Enable contributions and review of the tool implementation by the broader technical community through open source licensing</li><li>In addition, we expect that additional open
source and proprietary tools will be created to help with these tasks. </li><li>See the <a title="Tools" href="http://spdx.org/tools">Tools page</a> for more information and to download documentation.</li></ul></blockquote>

General Meeting/Minutes/2011-08-11

2011-08-16T14:02:02Z

Knewcomer:

<p>Attendance: 16+</p><p>NOTE: I believe many folks joined whose names I did not capture. Let me know if your name is not here, and I'll be happy to add it. </p><p>     <br /><strong>Technical Team Report - Kate<br /></strong></p>
<ul><li>New draft of spec posted as of 8/10; no field changes, just editorial</li><li>Open issue on data license; need agreement between spec and RDF</li><li>Deadline for feedback by early am 8/15</li><li>Tools updated</li><li>New example available</li></ul>

<p><strong>Business Team Report - Kim</strong></p>
<ul><li>GA <br /><ul><li>Press release shaping up; Kim reviewed list of names to be included</li><li>JimZ will mention in Keynote, Phil O. & Esteban R. have speaking slot</li><li>BOF session not yet on website; Thursday, 8/18 at 5:15 pm</li><li>SPDX booth staffing in progress; John Ellis working schedule; 1 pg handout will be available</li></ul></li><li>SPDX Website update<ul><li>Don't believe we'll be ready to cutover from sandbox to live site in time for launch</li><li>Kim will update Home page on live site in prep for launch</li><li>Kate will ensure spec is up to date on live site</li></ul></li><li>FAQs<ul><li>Asked all volunteers to get their contributions in by end of day Tuesday</li></ul></li></ul>

<p><strong>Legal Team Report - Rockett<br /></strong></p>
<ul><li>Circulated draft of revised trademark & compliance statements<br /><ul><li>Deep discussion on this topic resulted in additional proposed changes</li><li>"Policing" policy concerns raised; recommendation is to follow LF policy of community notification</li><li>Concerns about requiring attribution/compliance statement inside SPDX file requiring change to spec</li><li>Decided that no attribution statement will be included in SPDX file at this time; we will revisit post 1.0 GA</li><li>Rockett has the action item to send final wording to Kate</li></ul></li><li>Data license discussion<ul><li>Some team members concerned that use of PDDL, even with language about side-agreement re confidentially may affect adoption of spec by those who are working with packages that contain proprietary code</li><li>Other team members believe that allowing data licenses other than PDDL will affect adoption by open source community</li><li>Noted that Karen Copenhaver discussed this use with the author of PDDL and we have agreement that this use is compliant with intent of license; current wording provided by Karen C. after review with author</li><li>Decided that v1.0 will stipulate PDDL as only license for data</li></ul></li></ul><p><strong>Open Action Items</strong></p>
<ul><li>MartinM- Report back on # of people on respective mailing lists. ONGOING</li><li>Kim -- share Biz Team proposed process for adding licenses to SPDX list more broadly</li><li>Michael H. -- Posting BOM info</li></ul>

<p class="p1"><strong>Attendees</strong></p><ul class="ul1"><li class="li2">Kirsten Newcomer, Black Duck Software</li><li class="li2">Kamak Hassin, Protecode</li><li class="li2">Kim Weins, OpenLogic</li><li class="li2">Peter Williams, Open Logic</li><li class="li2">Gary O'Neall, Source Auditor</li><li>Martin Michlmayr, HP</li><li>Kate Stewart, Canonical</li><li>Jilayne Lovejoy, OpenLogic</li><li>Esteban Rockett, Motorola</li><li>Phil Koltun, Linux Foundation</li><li>Tom Incorvia, Microfocus</li><li>Adam , Cisco</li><li>Mark Gisi, Wind River</li><li>Branden Robinson, Cisco</li><li>Jack Manbeck, TI</li><li>Steve Cropper, Cisco</li></ul>

Technical Team/Minutes/2011-08-02

2011-08-02T20:10:50Z

Knewcomer:

<p><p style="font-family: Arial, Helvetica, sans-serif; margin-top: 5px; margin-right: 0px; margin-bottom: 10px; margin-left: 0px; font-size: 12px; color: #666666; line-height: 18px; font-weight: normal; padding: 0px;">Minutes 7/28/2011</p><p style="font-family: Arial, Helvetica, sans-serif; margin-top: 5px; margin-right: 0px; margin-bottom: 10px; margin-left: 0px; font-size: 12px; color: #666666; line-height: 18px; font-weight: normal; padding: 0px;">Attendees:</p><ul style="color: #4d4d4d; font-family: Arial, Helvetica, sans-serif; list-style-type: disc; margin-top: 0px; margin-right: 0px; margin-bottom: 10px; margin-left: 20px; font-size: 12px; padding: 0px;"><li style="margin-top: 0px; margin-right: 0px; margin-bottom: 5px; margin-left: 0px;">Kirsten Newcomer</li><li style="margin-top: 0px; margin-right: 0px; margin-bottom: 5px; margin-left: 0px;">Nicholas Loke</li><li style="margin-top: 0px; margin-right: 0px; margin-bottom: 5px; margin-left: 0px;">Peter Williams</li><li style="margin-top: 0px; margin-right: 0px; margin-bottom: 5px; margin-left: 0px;">Kate Stewart</li><li style="margin-top: 0px; margin-right: 0px; margin-bottom: 5px; margin-left: 0px;">Steve Cropper</li><li style="margin-top: 0px; margin-right: 0px; margin-bottom: 5px; margin-left: 0px;">Jack Manbeck</li><li style="margin-top: 0px; margin-right: 0px; margin-bottom: 5px; margin-left: 0px;">Marshall Clow</li></ul><p style="font-family: Arial, Helvetica, sans-serif; margin-top: 5px; margin-right: 0px; margin-bottom: 10px; margin-left: 0px; font-size: 12px; color: #666666; line-height: 18px; font-weight: normal; padding: 0px;">Agenda:</p><ul style="color: #4d4d4d; font-family: Arial, Helvetica, sans-serif; list-style-type: disc; margin-top: 0px; margin-right: 0px; margin-bottom: 10px; margin-left: 20px; font-size: 12px; padding: 0px;"><li style="margin-top: 0px; margin-right: 0px; margin-bottom: 5px; margin-left: 0px;">Discussion of Supplier related fields</li><li style="margin-top: 0px; margin-right: 0px; margin-bottom: 5px; margin-left: 0px;">Review of recent updates to the Spec</li><li style="margin-top: 0px; margin-right: 0px; margin-bottom: 5px; margin-left: 0px;">Open Action Items (see list at end of minutes)</li></ul><p style="font-family: Arial, Helvetica, sans-serif; margin-top: 5px; margin-right: 0px; margin-bottom: 10px; margin-left: 0px; font-size: 12px; color: #666666; line-height: 18px; font-weight: normal; padding: 0px;">Supplier fields discussion</p><ul style="list-style-type: disc; margin-top: 0px; margin-right: 0px; margin-bottom: 10px; margin-left: 20px; padding: 0px;"><li style="color: #4d4d4d; font-family: Arial, Helvetica, sans-serif; font-size: 12px; margin-top: 0px; margin-right: 0px; margin-bottom: 5px; margin-left: 0px;">Kate has updated the working version of the spec with the two fields discussed last week<ul style="color: #4d4d4d; font-family: Arial, Helvetica, sans-serif; font-size: 12px;"><li style="margin-top: 0px; margin-right: 0px; margin-bottom: 5px; margin-left: 0px;">Package Supplier</li><li style="margin-top: 0px; margin-right: 0px; margin-bottom: 5px; margin-left: 0px;">Package Originator</li></ul></li><li style="color: #4d4d4d; font-family: Arial, Helvetica, sans-serif; font-size: 12px; margin-top: 0px; margin-right: 0px; margin-bottom: 5px; margin-left: 0px;">Today's discussion started with some email threads on intended use of </li><li style="color: #4d4d4d; font-family: Arial, Helvetica, sans-serif; font-size: 12px; margin-top: 0px; margin-right: 0px; margin-bottom: 5px; margin-left: 0px;">We seem to have a common understanding of what info should be used to fill in the Package Supplier field</li><li style="color: #4d4d4d; font-family: Arial, Helvetica, sans-serif; font-size: 12px; margin-top: 0px; margin-right: 0px; margin-bottom: 5px; margin-left: 0px;">We're still working toward a common understanding for the Package Originator field<ul><li style="color: #4d4d4d; font-family: Arial, Helvetica, sans-serif; font-size: 12px; margin-top: 0px; margin-right: 0px; margin-bottom: 5px; margin-left: 0px;">We discussed a few possibilities. For example, is the data in the Package Originator field<ul style="color: #4d4d4d; font-family: Arial, Helvetica, sans-serif; font-size: 12px;"><li style="margin-top: 0px; margin-right: 0px; margin-bottom: 5px; margin-left: 0px;">the copyright holder?</li><li style="margin-top: 0px; margin-right: 0px; margin-bottom: 5px; margin-left: 0px;">the place where the Supplier got the code?</li></ul></li><li><span style="color: #4d4d4d; font-family: Arial, Helvetica, sans-serif;"><span style="font-size: 12px;">We discussed the desire to capture the chain of custody in the SPDX document; Kate noted that was part of the original intent of the Reviewer field</span></span></li><li><span style="color: #4d4d4d; font-family: Arial, Helvetica, sans-serif;"><span style="font-size: 12px;">We noted that there is an overlap between the goal of capturing chain of custody and the need for hierarchy in the SPDX document; hierarchy will be discussed post 1.0</span></span></li></ul></li><li style="color: #4d4d4d; font-family: Arial, Helvetica, sans-serif; font-size: 12px; margin-top: 0px; margin-right: 0px; margin-bottom: 5px; margin-left: 0px;">Concluded: we need to make an extra effort to document the thinking behind these fields and provide usage guidelines</li></ul><p><span style="color: #4d4d4d; font-family: Arial, Helvetica, sans-serif;"><span style="font-size: 12px;">Additional updates to Spec</span></span></p></p><ul style="list-style-type: disc; margin-top: 0px; margin-right: 0px; margin-bottom: 10px; margin-left: 20px; padding: 0px;"><li><span style="color: #4d4d4d; font-family: Arial, Helvetica, sans-serif;"><span style="font-size: 12px;">Kate walked the team through some additional updates that have been made to the spec as well as some planned changes based on feedback</span></span></li><li style="margin-top: 0px; margin-right: 0px; margin-bottom: 5px; margin-left: 0px;"><span style="color: #4d4d4d; font-family: Arial, Helvetica, sans-serif;"><span style="font-size: 12px;">Key changes include:</span></span><br /><ul style="list-style-type: disc; margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 20px; padding: 0px;"><li style="color: #4d4d4d; font-family: Arial, Helvetica, sans-serif; font-size: 12px; margin-top: 0px; margin-right: 0px; margin-bottom: 5px; margin-left: 0px;">Clean up of RDF section (typos, spelling)</li><li style="color: #4d4d4d; font-family: Arial, Helvetica, sans-serif; font-size: 12px; margin-top: 0px; margin-right: 0px; margin-bottom: 5px; margin-left: 0px;">Proposed changes to certain field names for tag/value</li><li style="color: #4d4d4d; font-family: Arial, Helvetica, sans-serif; font-size: 12px; margin-top: 0px; margin-right: 0px; margin-bottom: 5px; margin-left: 0px;">Section 1.7: Conformance statement will point to trademark statement that is being worked by legal team and will be posted to web. This is not yet finalized.</li><li style="color: #4d4d4d; font-family: Arial, Helvetica, sans-serif; font-size: 12px; margin-top: 0px; margin-right: 0px; margin-bottom: 5px; margin-left: 0px;">Section 2.2: SPDX data will still be delivered under PDDL-1.0. Confidentiality field has been dropped.<ul style="color: #4d4d4d; font-family: Arial, Helvetica, sans-serif; font-size: 12px;"><li style="margin-top: 0px; margin-right: 0px; margin-bottom: 5px; margin-left: 0px;">Acknowledged that this could be an issue for using SPDX with commercial/proprietary code and plan to discuss commercial code use case post-1.0 GA</li></ul></li><li><span style="color: #4d4d4d; font-family: Arial, Helvetica, sans-serif;"><span style="font-size: 12px;">Recommend that info be added on where to provide feedback</span></span></li></ul></li></ul><p><p style="font-family: Arial, Helvetica, sans-serif; margin-top: 5px; margin-right: 0px; margin-bottom: 10px; margin-left: 0px; font-size: 12px; color: #666666; line-height: 18px; font-weight: normal; padding: 0px;"><strong>Open Action Items</strong></p></p><ul style="list-style-type: disc; margin-top: 0px; margin-right: 0px; margin-bottom: 10px; margin-left: 20px; padding: 0px;"><li style="color: #4d4d4d; font-family: Arial, Helvetica, sans-serif; font-size: 12px;"><span style="color: #666666; line-height: 18px;">Everyone: Bug list review</span><ul style="color: #4d4d4d; font-family: Arial, Helvetica, sans-serif; font-size: 12px;"><li style="margin-top: 0px; margin-right: 0px; margin-bottom: 5px; margin-left: 0px;">review for any open P1s assigned to you</li><li style="margin-top: 0px; margin-right: 0px; margin-bottom: 5px; margin-left: 0px;">review closed bugs to be sure we're in agreement</li></ul></li><li><span style="color: #4d4d4d; font-family: Arial, Helvetica, sans-serif;"><span style="font-size: 12px;">Start developing Guidelines for Implementation/Use and/or Best Practices </span></span><ul><li><span style="color: #4d4d4d; font-family: Arial, Helvetica, sans-serif;"><span style="font-size: 12px;">Everyone: Review current FAQ as starting point. You can find it here: <br /></span></span><span style="color: #4d4d4d; font-family: Arial, Helvetica, sans-serif; font-size: 12px;">http://spdx.org/spec/guidelines</span></li><li><span style="color: #4d4d4d; font-family: Arial, Helvetica, sans-serif;"><span style="font-size: 12px;">If you've volunteered to update/add to a certain section, please add your name here. :-)</span></span></li></ul></li><li><span style="color: #4d4d4d; font-family: Arial, Helvetica, sans-serif;"><span style="font-size: 12px;">Kirsten: Provide website location for 2 items so can be referenced in Spec</span></span><ul><li><span style="color: #4d4d4d; font-family: Arial, Helvetica, sans-serif;"><span style="font-size: 12px;">Process for requesting licenses be added to SPDX license list. </span></span></li><li><span style="color: #4d4d4d; font-family: Arial, Helvetica, sans-serif;"><span style="font-size: 12px;">SPDX trademark terms.</span></span><ul><li><span style="color: #4d4d4d; font-family: Arial, Helvetica, sans-serif;"><span style="font-size: 12px;">I've added placehoder text for a links here: http://spdx.org/spec </span></span></li><li><span style="color: #4d4d4d; font-family: Arial, Helvetica, sans-serif;"><span style="font-size: 12px;">I don't have the privs to create a new child page and will send a note to Martin </span></span></li></ul></li></ul></li><li><span style="color: #4d4d4d; font-family: Arial, Helvetica, sans-serif;"><span style="font-size: 12px;">Everyone: Please review the spec with the goal of approving final version next week if possible</span></span></li></ul><p><p style="font-family: Arial, Helvetica, sans-serif; margin-top: 5px; margin-right: 0px; margin-bottom: 10px; margin-left: 0px; font-size: 12px; color: #666666; line-height: 18px; font-weight: normal; padding: 0px;">Corrections, additions welcome.</p></p>

Technical Team/Minutes/2011-07-28

2011-08-02T19:29:02Z

Knewcomer:

<p>Minutes 7/28/2011</p>

<p>Attendees:</p><ul><li>Kirsten Newcomer</li><li>Branden Robinson</li><li>Peter Williams</li><li>Kate Stewart</li><li>Steve Cropper</li><li>Jack Manbeck</li></ul>

<p>Agenda:</p>

<ul><li>Discuss proposal from Steve Cropper for Supplier related fields</li><li>Review open bugs</li></ul><p>The team had a good discussion about the new proposed Supplier fields, including discussion of:</p><ul><li>Optional vs. Mandatory</li><li>Reasons for including in GA of 1.0 rather than waiting</li><li>Overlap with need for handling package hierarchies</li><li>Affect on tools<ul><li>suggested that tools could be udpated after GA date</li></ul></li><li>Use cases, including<ul><li>open source package maintained by loose coalition where no individual has clear ownership</li><li>open source package where original copyright owner has died</li><li>package shared between supply chain partners</li><li>Discussed providing special options as we do for certain other fields such as NOASSERTION, NONE, and possibly ORPHANED</li></ul></li></ul><p>Spec update</p><ul><li>waiting for trademark info from Rockett</li><li>waiting for input from Karen C. on confidentiality </li></ul><p>Bug review</p><p>We ran out of time to review the bug list, but ask that everyone</p><ul><li>review for any open P1s assigned to them</li><li>review closed bugs to be sure we're in agreement </li></ul><p>Corrections, additions welcome.</p>

Technical Team/Minutes/2011-07-28

2011-08-02T15:04:44Z

Knewcomer:

<p>Minutes 7/26/2011</p>

<p>Attendees:</p><ul><li>Kirsten Newcomer</li><li>Branden Robinson</li><li>Peter Williams</li><li>Kate Stewart</li><li>Steve Cropper</li><li>Jack Manbeck</li></ul>

<p>Agenda:</p>

<ul><li>Discuss proposal from Steve Cropper for Supplier related fields</li><li>Review open bugs</li></ul><p>The team had a good discussion about the new proposed Supplier fields, including discussion of:</p><ul><li>Optional vs. Mandatory</li><li>Reasons for including in GA of 1.0 rather than waiting</li><li>Overlap with need for handling package hierarchies</li><li>Affect on tools<ul><li>suggested that tools could be udpated after GA date</li></ul></li><li>Use cases, including<ul><li>open source package maintained by loose coalition where no individual has clear ownership</li><li>open source package where original copyright owner has died</li><li>package shared between supply chain partners</li><li>Discussed providing special options as we do for certain other fields such as NOASSERTION, NONE, and possibly ORPHANED</li></ul></li></ul><p>Spec update</p><ul><li>waiting for trademark info from Rockett</li><li>waiting for input from Karen C. on confidentiality </li></ul><p>Bug review</p><p>We ran out of time to review the bug list, but ask that everyone</p><ul><li>review for any open P1s assigned to them</li><li>review closed bugs to be sure we're in agreement </li></ul><p>Corrections, additions welcome.</p>

Old/Website Refresh/SPDX web site mind maps

2011-07-06T19:48:09Z

Knewcomer:

<p>The website refresh team has put together a proposed information map for the SPDX web site refresh initiative. </p><p>We've decided to capture this using FreeMind, a free tool for creating mind maps. You can find information about Free Mind here: http://freemind.sourceforge.net/wiki/index.php/Main_Page</p><p>Below, you'll find two PDF versions of the mind map we've created.</p><p>Version 1 shows the SPDX Home Page with 9 proposed child pages that would be available from the Home page. Many of those child pages have additional children. Open it up, and take a look!</p><p>Version 2 shows the same mind map, but with one more level displayed. This final level, in small, black, italic text, is used to indicate child nodes that, on the actual web site, would be links to another node. The text tells you which node the link points to. </p><p>Note: The mind map does not show page layout or graphics placeholders, but is simply intended to show the flow of information and likely links.</p><p>Feedback on this proposed map is most welcome. </p><p>If you'd like to provide your feedback in FreeMind, send me an email (knewcomer@blackducksoftware.com) and I'll send the .mm version of the mind map, since I can't post it here. </p><p><strong>Next steps:</strong></p><ul><li>Collect Feedback</li><li>Implement in sandbox</li></ul><p><strong>First feedback session</strong> is being hosted by the Business team on Thursday, July 7th. We'll be happy to host additional sessions upon request.</p><p><strong>Volunteers Needed! </strong>Once we have something close-to-consensus, we'll proceed to implement in the SPDX web site sandbox that Martin Michlmayr was kind enough to create. We're looking for volunteers who might know Drupal or are willing to learn to help with the implementation. We're also looking for volunteers to create content that might not already be present on ths site. If you're interested in helping, please send email to knewcomer@blackducksoftware.com.</p>

File:Spdx-web-mind-map-july-7-linktext.pdf

2011-07-06T19:41:25Z

Knewcomer:

SPDX website mind map with links

File:Spdx-web-mind-map-july-7.pdf

2011-07-06T19:41:01Z

Knewcomer:

SPDX website mind map

General Meeting/Minutes/2011-06-16

2011-06-23T19:57:57Z

Knewcomer:

<p>Attendance: 11<br />Minutes for 20110602 approved<br />     <br /><strong>Technical Team Report - Kate<br /></strong></p><ul><li>Tools: Updating tools as needed</li><li>Spec: Working minor changes to June 5 version of the spec</li><li>Spec: Have had interesting discussions with Cisco about mapping SPDX to their current process. Expect that new fields and possibly new models will come out of this discussion</li><li>Beta feedback: Looking for place to collect/present feedback. Would like to be sure we capture feedback even for items we've resolved. Kim plans to create wiki page.</li></ul>

<p><strong>Business Team Report - Kim</strong></p>
<ul><li>Beta program:<br /><ul><li>HP/WindRiver & OL/Antelink continue to make progress</li><li>Motorola/TI progress is not yet clear</li><li>There's been some confusion over license fields at package level. A wiki discussion on this topic can be found here: http://spdx.org/wiki/license-field-discussion</li></ul></li><li>GA Launch:<ul><li>Continue to work to get ready for launch at LinuxCon NA in mid-August</li></ul></li></ul>

<p><strong>Legal Team Report - In absentia<br /></strong></p>
<ul><li>All legal team members are at a separate face-to-face meeting and unable to attend this meeting</li></ul>

<p><strong>Cross Functional Issues – Discussion</strong></p>
<ul><li>Website update- Kirsten
<ul><li>Working on mind-maps for proposed flow; plan to present more generally in next few weeks</li><li>Logistical question from Kim: should we remove or archive older content? <br /><ul><li>Both options are available; deleting won't create orphaned pages</li><li>Will likely decide on case-by-case basis</li></ul></li></ul></li><li>Package License fields - Postponed until next meeting since legal team not present this week</li></ul>

<p><strong>Open Action Items</strong></p>
<ul><li>MartinM- Report back on # of people on respective mailing lists. ONGOING</li><li>Kim -- share Biz Team proposed process for adding licenses to SPDX list more broadly</li><li>Michael H. -- provide info on existing BOM standards that should be useful for future consideration</li><li>Legal/Biz Teams- Review and update Master Schedule</li><li>?? -- volunteers needed to review and update the FAQ: <a title="http://spdx.org/wiki/draft-spdx-faq" href="wiki/draft-spdx-faq">http://spdx.org/wiki/draft-spdx-faq</a></li></ul><p class="p1"><strong>Attendees</strong></p>
<ul class="ul1"><li class="li2">Kirsten Newcomer, Black Duck Software</li><li class="li2">Kim Weins, OpenLogic</li><li class="li2">Peter Williams, OpenLogic</li><li class="li2">Bill Schineller, Black Duck Software</li><li class="li2">Gary O'Neall, Source Auditor</li><li>Martin Michlmayr, HP</li><li>Kate Stewart, Canonical</li><li>Brandon Robinson, Cisco</li><li>Tom Incorvia, Microfocus</li><li>Phil Koltun, Linux Foundation</li><li>Juergan Weigert, SuSE</li></ul>

Technical Team

2011-06-21T15:30:15Z

Knewcomer:

<p>This is the working area for the technical team. This team has primary responsibility for drafting the specification and developing documentation, templates, samples and tools.</p>

<p>You can sign up for the <a href="https://fossbazaar.org/mailman/listinfo/spdx-tech">mailing list here</a>.</p>

<p>You can register concerns, comment or issues with the spec in <a title="Report SPDX issue" href="http://bugs.linux-foundation.org/enter_bug.cgi?product=spdx">our issue tracking system</a>. To see a list of all outstanding issues see <a href="http://bugs.linux-foundation.org/buglist.cgi?query_format=specific&order=relevance+desc&bug_status=__open__&product=spdx&content=">our issues list</a></p>

<p>The technical team meets weekly on Tuesdays at 16:00 GMT (8:00AM Pacific Time, 11:00 AM Eastern Time).</p>

<p>Toll-free dial-in number (U.S. and Canada): (877) 435-0230</p>

<p>International dial-in number: (253) 336-6732</p>

<p>Conference code: 7833942033.</p>

<p>URL: <a href="http://blackducksoftware.na6.acrobat.com/spdxrdf/">http://blackducksoftware.na6.acrobat.com/spdxrdf/</a></p><p>-------------------------------------------------------------------------------</p><p style="padding-left: 30px;">The Technical team is contributing to the draft FAQ, which you can find here: <a href="http://spdx.org/wiki/draft-spdx-faq" target="_self">Draft SPDX use FAQ</a></p>

Technical Team

2011-06-21T15:29:42Z

Knewcomer:

<p>This is the working area for the technical team. This team has primary responsibility for drafting the specification and developing documentation, templates, samples and tools.</p>

<p>You can sign up for the <a href="https://fossbazaar.org/mailman/listinfo/spdx-tech">mailing list here</a>.</p>

<p>You can register concerns, comment or issues with the spec in <a title="Report SPDX issue" href="http://bugs.linux-foundation.org/enter_bug.cgi?product=spdx">our issue tracking system</a>. To see a list of all outstanding issues see <a href="http://bugs.linux-foundation.org/buglist.cgi?query_format=specific&order=relevance+desc&bug_status=__open__&product=spdx&content=">our issues list</a></p>

<p>The technical team meets weekly on Tuesdays at 16:00 GMT (8:00AM Pacific Time, 11:00 AM Eastern Time).</p>

<p>Toll-free dial-in number (U.S. and Canada): (877) 435-0230</p>

<p>International dial-in number: (253) 336-6732</p>

<p>Conference code: 7833942033.</p>

<p>URL: <a href="http://blackducksoftware.na6.acrobat.com/spdxrdf/">http://blackducksoftware.na6.acrobat.com/spdxrdf/</a></p><p>-------------------------------------------------------------------------------</p><p style="padding-left: 30px;">The Technical team is contributing to the draft FAQ, which you can find here:</p><p style="padding-left: 30px;"><a href="http://spdx.org/wiki/draft-spdx-faq" target="_self">Draft SPDX use FAQ</a></p>

Technical Team

2011-06-21T15:28:19Z

Knewcomer:

<p>This is the working area for the technical team. This team has primary responsibility for drafting the specification and developing documentation, templates, samples and tools.</p>

<p>You can sign up for the <a href="https://fossbazaar.org/mailman/listinfo/spdx-tech">mailing list here</a>.</p>

<p>You can register concerns, comment or issues with the spec in <a title="Report SPDX issue" href="http://bugs.linux-foundation.org/enter_bug.cgi?product=spdx">our issue tracking system</a>. To see a list of all outstanding issues see <a href="http://bugs.linux-foundation.org/buglist.cgi?query_format=specific&order=relevance+desc&bug_status=__open__&product=spdx&content=">our issues list</a></p>

<p>The technical team meets weekly on Tuesdays at 16:00 GMT (8:00AM Pacific Time, 11:00 AM Eastern Time).</p>

<p>Toll-free dial-in number (U.S. and Canada): (877) 435-0230</p>

<p>International dial-in number: (253) 336-6732</p>

<p>Conference code: 7833942033.</p>

<p>URL: <a href="http://blackducksoftware.na6.acrobat.com/spdxrdf/">http://blackducksoftware.na6.acrobat.com/spdxrdf/</a></p><p>-------------------------------------------------------------------------------</p><p><a href="http://spdx.org/wiki/draft-spdx-faq" target="_self">Draft SPDX use FAQ</a></p>

General Meeting/Minutes/2011-06-02

2011-06-03T20:05:59Z

Knewcomer:

<p style="text-align: left;">Attendance: 13<br />Minutes for 20110519 approved<br />     <br /><strong>Technical Team Report - Gary</strong></p><ul style="text-align: left;"><li>Tools: have received good feedback; addressed a few technical issues; available for beta use</li><li>Spec: final polishing has been largely completed; waiting for one more review from legal which is expected by Friday am PT</li></ul><p style="text-align: left;"><strong>Business Team Report - Kim</strong></p><ul style="text-align: left;"><li>3 beta teams are working; target for beta completion & feedback is end of June; request that all teams work toward this date<br /><ul><li>HP/WindRiver & OL/Antelink are in progress</li><li>Kickoff for Motorola/TI still to be scheduled, but there's been activity. Rockett will work with Gary to get kickoff scheduled</li></ul></li><li>Website refresh subteam has been created. Details on this working group can be found here: <br /><ul><li>http://spdx.org/wiki/website-refresh</li></ul></li><li>GA launch process is next big thing to focus on<ul><li>Planned for LinuxCon in Vancouver</li><li>Phil O. has a speaking slot</li><li>Goal include press release and mention in keynote</li></ul></li></ul><p style="text-align: left;"><strong>Legal Team Report - Rockett</strong></p><ul style="text-align: left;"><li>Last scrub on 5/16 spec in progress. Final comments due by Friday am PT time, 6/3</li><li>Recommend Open Data Commons PDDL license for SPDX MetaData (http://www.opendatacommons.org/licenses/pddl/); will send link to broader group for final sign-off</li><li>License templatizing is the next big focus</li><li>Also noted that we'll need a process for adding licenses to SPDX list very soon; Kim says Biz Team has a proposal for a process and she'll plan to share more broadly</li></ul><p style="text-align: left;"><strong>Cross Functional Issues – Discussion</strong></p><ul><li>Website update- Steve<ul><li>Sandbox for testing new website structure in place</li><li>Team plans to create storyboards for 3-4 personas using mind map tools</li><li>wiki pages for working grou now available http://spdx.org/wiki/website-refresh</li></ul></li><li>Questions/recommendations for presenting data for binaries and archives such as jar files -- Kim<ul><li>There's been recent email about how to represent data for binaries that are combinations of OSS, 3rd party, and proprietary code in SPDX documents</li><li>Issue has also come up for OL/Antelink beta partners; OL/Antelink have decided to use compound licensing for jar files when needed; should we recommend the same approach for binaries?</li><li>There was a lively discussion on this topic with input from Steve Cropper, Kim Weins, Michael Herzog, Kate Stewart</li><li>Main conclusion: Recommendations for how to handle these use cases need to be added to the draft FAQ <br /><ul><li>Draft FAQ is available here: http://spdx.org/wiki/draft-spdx-faq</li><li>FAQ should address questions about proprietary and 3rd party as well as OSS licenses</li><li>Kim added a number of topics to the FAQ; need volunteers to provide additional info on these topics</li></ul></li><li>A side issue regarding how best to connect package and SPDX document was also discussed</li><li>The topic of package hierarchy also came up<br /><ul><li>Michael H. noted that the SPDX team made a conscious choice not to tackle this for v1 of the specification</li><li>v1 spec is intended to address lower level or sub-assembly items and a BOM is not yet represented in the spec</li><li>Recommended that a section on items specifically deferred be added to the FAQ so that new users have visibility into these decisions</li><li>Michael also volunteered to pull together info on well traveled routes for BOMs that we might want to leverage    </li></ul></li></ul></li></ul><p style="text-align: left;"><br /><strong>Open Action Items</strong></p><ul><li>MartinM- Report back on # of people on respective mailing lists. ONGOING</li><li>Kim -- share Biz Team proposed process for adding licenses to SPDX list more broadly</li><li>Michael H. -- provide info on existing BOM standards that should be useful for future consideration</li><li>Legal/Biz Teams- Review and update Master Schedule</li><li>?? -- volunteers needed to review and update the FAQ: http://spdx.org/wiki/draft-spdx-faq</li></ul><p style="text-align: left;"><strong>Closed Action Items</strong></p><ul><li>Kirsten- Notify Kim of need to clean up business section of website.</li><li>MartinM- Get master list of website pages to Kate</li></ul><p class="p1" style="text-align: left;"><strong>Attendees</strong></p><ul class="ul1"><li class="li2" style="text-align: left;">Kirsten Newcomer, Black Duck Software</li><li class="li2" style="text-align: left;">Kamal Hassin, Protecode</li><li class="li2" style="text-align: left;">Kim Weins, OpenLogic</li><li class="li2" style="text-align: left;">Esteban Rockett, Motorola</li><li class="li2" style="text-align: left;">Gary O'Neall, Source Auditor</li><li class="li2" style="text-align: left;">Michael Herzog, NexB</li><li style="text-align: left;">Martin Michlmayr, HP</li><li style="text-align: left;">Kate Stewart, Canonical</li><li style="text-align: left;">Peter Williams, OpenLogic</li><li style="text-align: left;">Jillayne Lovejoy, OpenLogic</li><li style="text-align: left;">Brandon Robinson, Cisco</li><li style="text-align: left;">Steve Cropper, Cisco</li><li style="text-align: left;">Tom Incorvia, Microfocus</li></ul>

Website Team/Minutes/2011-05-18

2011-06-02T16:51:23Z

Knewcomer:

<p>Attendees:</p><p>Steve Cropper, Pierre LaPointe, Kirsten Newcomer</p><p><strong>Topics</strong>:</p><p>Discuss feedback from Biz Team on initial set of mockups.</p><p>Based on detailed input and number of questions about where links on mockups would take you, we determined that a sandbox website would server better for presenting ideas and collecting feedback. This approach also allows us to understand what's technically possible using the web site tools available to us.</p><p>We also decided that storyboards or user scenarios would be helpful, and identified the following personas: </p><ul><li>Persona1: New to SPDX </li><li>Persona2: Already using SPDX and have questions </li><li>Persona3: Workgroup member </li><li>Persona4: Press </li></ul>
<p>We agreed to use Mindmap as the format: http://freemind.sourceforge.net/wiki/index.php/Main_Page</p><p>Once we have an initial set of story boards, the web team will review to look for common patterns, refine the scenarios and then share more broadly and/or implement in sandbox for feedback loop.</p><p>We came up with the following set of questions to use for collecting feedback:</p><ul><li>Is the current organization sufficient?</li><li>Are there elements missing?</li><li>Would they like some guidance on structure?</li><li>How easy is it to find what you need? (new vs. returning)</li><li>Do you think the collaboration area will need periodic reorganization?</li></ul><p>Feedback collected to date is available here: http://www.spdx.org/wiki/collected-feedback</p><p><strong>New Action Items:</strong></p><ul><li>Storyboard for persona1: New to SPDX (include returning scenario) -- Steve</li><li>Storyboard for persona2: Already using SPDX and have questions (include returning scenario) -- Kirsten</li><li>Storyboard for persona3: Workgroup member (include returning scenario) -- Pierre</li><li>Storyboard for persona4: Press (include returning scenario) -- ask Phil / Kim to help</li></ul><p><strong>Open Action Items:</strong></p><ul><li>Collect feedback from the Legal team on the Legal Team area -- Michael from NexB</li><li>Talk to Phil Odence about getting feedback on the area for the General Meeting -- Kirsten</li><li>Talk with Kim about getting feedback from the Business team on the Business Team area -- no owner</li><li>Schedule a regular check-in call -- Kirsten</li></ul><p><strong>Completed Action Items:</strong></p>
<ul><li>Initial mock-up for a new spdx.org Home page created and reviewed with Biz Team -- Kirsten</li><li>Contact Martin M. to find out about analytics for the existing web pages; scheduled for 5/25  -- Pierre</li><li>Collect feedback from the Technical team on the Technical Team area -- Kirsten</li></ul>

Old/Website Refresh/Collected Feedback

2011-06-02T16:45:10Z

Knewcomer:

<p>We've organized the feedback collected to date by the following categories:</p><ul><li>Information Architecture</li><li>Visual</li><li>Navigation</li><li>Technology</li></ul><p><strong>Information Architecture</strong></p><ul><li>Hard to figure out who, what, when</li><li>Not organized for different users</li><li>Proposed usage categories: Participate, Learn, Use</li><li>Mockup feedback/question: Where does LEARN button take you?<ul><li>Perhaps to About SPDX? </li><li>Learn sub-topics should include: History, Overview, Using the spec, 3 minute webinar</li></ul></li><li>Mockup feedback/question: Developing the Spec link: where does this take you? <br /><ul><li>Perhaps this link is replaced by Participation link/button.</li></ul></li><li>Mockup feedback/question: Outreach support link: what should be here? Who's the user?</li><li>Mockup feedback/question: Where does PARTICIPATE button take you? <br /><ul><li>To Participation pages</li></ul></li><li>Mockup feedback/question: Provide one-to-one mapping of big buttons to top level links</li><li>build for both business user and engineer</li><li>identify types of tasks </li><li>buttons for returning users</li></ul><p><strong>Visual</strong></p>
<ul><li>too much text</li><li>add graphics, perhaps recorded video</li><li>need big buttons to draw attention to main areas/flow</li><li>reformat existing blue bar to have more links and bigger text</li><li>Compare what we're doing with other sites<ul><li>Focus on Linux Foundation site rather than doing a lot of research across many sites since LF is sponsor</li></ul></li></ul>
<p><strong>Navigation</strong></p>
<ul><li>drop down menus (navigable) for top buttons allow users to learn
more about what's available without having to navigate to another
section first</li><li>provide multiple navigation paths to same content</li></ul>
<p><strong>Technology</strong></p>
<ul><li>Suggest wiki be used for collaboration pages but not other pages</li><li>Stick with Linux Foundation technology and standards</li><li>What permissions control is appropriate for working areas?</li></ul><p> </p>

Website Team/Minutes/2011-05-18

2011-06-02T16:32:48Z

Knewcomer:

<p>Attendees:</p><p>Steve Cropper, Pierre LaPointe, Kirsten Newcomer</p><p><strong>Topics</strong>:</p><p>Discuss feedback from Biz Team on initial set of mockups.</p><p>Based on detailed input and number of questions about where links on mockups would take you, we determined that a sandbox website would server better for presenting ideas and collecting feedback. This approach also allows us to understand what's technically possible using the web site tools available to us.</p><p>We also decided that storyboards or user scenarios would be helpful. We agreed to use Mindmap as the format. <br />http://freemind.sourceforge.net/wiki/index.php/Main_Page</p><p>Once we have an initial set of story boards, the web team will review to look for common patterns, refine the scenarios and then share more broadly and/or implement in sandbox for feedback loop.</p><p>We came up with the following set of questions to use for collecting feedback:</p><ul><li>Is the current organization sufficient?</li><li>Are there elements missing?</li><li>Would they like some guidance on structure?</li><li>How easy is it to find what you need? (new vs. returning)</li><li>Do you think the collaboration area will need periodic reorganization?</li></ul><p>Feedback collected to date is available here: .....</p><p><strong>Completed Action Items:</strong></p>
<ul><li>Initial mock-up for a new spdx.org Home page created and reviewed with Biz Team</li><li>Contact Martin M. to find out about analytics for the existing web pages  (meeting scheduled)</li></ul><p><strong>Open Action Items:</strong></p><ul><li>Collect feedback from the Legal team on the Legal Team area -- Michael from NexB</li><li>Collect feedback from the Technical team on the Technical Team area -- Kirsten</li><li>Talk to Phil Odence about getting feedback on the area for the General Meeting -- Kirsten</li><li>Talk with Kim about getting feedback from the Business team on the Business Team area -- no owner</li><li>Schedule a regular check-in call -- Kirsten</li></ul>

Old/Website Refresh

2011-06-02T16:21:15Z

Knewcomer:

<p>This is the working area for the Website Refresh team. </p>

<p>The web team meets weekly on Wednesdays at 19:00 GMT (12:00 Noon Pacific Time, 3:00 PM Eastern Time).</p>
<p>Toll-free dial-in number (U.S. and Canada): (877) 435-0230</p>
<p>International dial-in number: (253) 336-6732</p>
<p>Conference code: 7438902829.</p>
<p>URL: http://blackducksoftware.adobeconnect.com/r59605444/</p><p><strong>Goals & Assumptions</strong></p><p>This team has been formed to review current website content and
navigation with an eye towards readiness for SPDX specification GA. </p><p>Based on initial feedback, the team is currently focused on a top-down view, with an emphasis on new visitors. </p><p>We've also asked individual work teams to take a first pass at consolidating their Participation wikis. </p><p>The team will use a sandbox web-site to test out ideas asking for feedback from the broader group as we go. </p><p>http://sandbox.spdx.org/</p><p> </p>

Old/Website Refresh/SPDX Home page mockups (first attempt)

2011-06-02T16:20:03Z

Knewcomer:

<p>2011-05-03: Strawman mockups for priming the pump. <br /><br />SPDXweb1.png shows a proposed new layout for the home page<br />SPDXweb2.png shows proposed drop down items for the main links on the home page<br /><br />Mockups for additioinal pages you navigate to by the big buttons won't be done until we have some initial feedback on these mockups.<br />    Learn<br />    Use<br />    Participate</p><p>2011-05-12: Reviewed mockups with Biz Team. Great discussion, lots of input. Decided that best approach going forward will be to use a sandbox website to test out ideas so that folks can actually navigate links and explore.</p><p>Sandbox can be found here: http://sandbox.spdx.org/</p><p> </p>

Old/Website Refresh/SPDX Home page mockups (first attempt)

2011-06-02T16:19:23Z

Knewcomer:

File:Spdxweb2-2.png

2011-06-02T16:18:42Z

Knewcomer:

Proposed Home page dropdown navigation