https://wiki.spdx.org/index.php?action=history&feed=atom&title=General_Meeting%2FMinutes%2F2015-07-02 2026-05-07T17:37:05Z Revision history for this page on the wiki MediaWiki 1.23.13 https://wiki.spdx.org/index.php?title=General_Meeting/Minutes/2015-07-02&diff=3629&oldid=prev 2015-07-02T15:48:07Z

<p>Created page with &quot;* Attendance: 15 * Lead by Phil Odence * Minutes of May meeting approved == UNO - Matt Germonprez == * Tools ** DoSOCS - evolved from Yacto tool *** Generalized to create ...&quot;</p> <p><b>New page</b></p><div>* Attendance: 15<br /> * Lead by Phil Odence<br /> <br /> * Minutes of May meeting approved<br /> <br /> == UNO - Matt Germonprez ==<br /> <br /> * Tools<br /> ** DoSOCS - evolved from Yacto tool<br /> *** Generalized to create ways of generating SPDX docs from various dev processes<br /> *** Resulted DoSOCS- Ways to scan packages and repos (now source, but in theory binary) to generate SPDX<br /> **** Main use case is generating SPDX 2.0 docs<br /> **** Store in a relational database - trick was mapping obj-oriented SPDX to rel database<br /> **** Very generic. Even on the back end; developed with FOSSology, but could plug in commercial scanners<br /> **** Future- intake of SPDX<br /> **** Idea is that this will eventually pull in all tools Git, Yacto, etc<br /> **** And, can be tied into Jenkins<br /> **** Ultimately will support an enterprise process to maintain a inventory of SPDX docs that come out of their processes<br /> *** Also exploring production of security vulnerability info<br /> **** Looking for where vulnerability info could be stored.<br /> **** Need a spot for CPE (and other common ID standards)<br /> **** Which would allow for vulnerability info<br /> **** Tech team has been pursuing this idea<br /> **** Group needs to address the mission creep issue<br /> ** Git Scanner<br /> *** Analyzes branch and contributes SPDX doc<br /> ** Eclipse Plug In<br /> <br /> <br /> == Tech Team Report - Kate &amp; Gary ==<br /> <br /> * Proposal for wording on Snippets <br /> ** Up as a Googledoc and available for review<br /> * Also one for None/No Assertion<br /> * Some discussion of best practices as well<br /> ** Looking for folks to sign up on the wiki page to write up parts<br /> * Kicked of discussion Bake Off and what examples to use<br /> * BillS writing up proposal for including external component identifiers (GAV, CPE, others)<br /> ** General agreement with concept<br /> * Tools<br /> ** Discussion has been going for a couple months about mapping/reconciling various sources of tools (SPDX group, UNO)<br /> ** Bakeoff at LinuxCon NA (Monday, 8-noon)<br /> *** Will have 2-3 examples<br /> **** Candidates are examples on best practices page<br /> *** Tool providers will provide SPDX docs <br /> *** Should learn a lot from comparisons<br /> <br /> == Legal Team Report - Paul ==<br /> <br /> * Putting together rev License List (2.1) including exceptions<br /> ** Lots of new exceptions<br /> * Mark Gisi is leading exploration of standard headers<br /> <br /> <br /> == Biz Team Report - Jack ==<br /> <br /> * Working on new guidance pages<br /> ** Phil and Jack have been prototyping<br /> * LinuxCon<br /> ** Back off Monday<br /> ** Aiming for BoF on Tuesday<br /> ** SPDX talk from Gary (Tues am)<br /> ** Mark will be giving a more general talk that will relate to SPDX (Tues pm)<br /> <br /> <br /> == Cross Functional Topics - Phil ==<br /> <br /> * Continually looking for presenters for General Meeting<br /> <br /> <br /> <br /> == Attendees ==<br /> <br /> * Phil Odence, Black Duck<br /> * Mike Dolan, Linux Foundation<br /> * Mark Gisi, Wind River<br /> * Scott Sterling, Palamida<br /> * Gary O’Neill, SourceA<br /> * Kate Stewart, LF<br /> * Hassib Khanafer, Protecode<br /> * Paul Maddick, HP<br /> * Scott Lamons<br /> * Jack Manbeck, TI<br /> * Matt Germonprez, UNO<br /> * Tom Gurney, UNO<br /> * Uday Shankar, UNO<br /> * Michael H- nexB<br /> * Kirsten Newcomer, Black Duck<br /> <br /> <br /> <br /> [[Category:General|Minutes]]<br /> [[Category:Minutes]]</div>

Podence