https://wiki.spdx.org/index.php?action=history&feed=atom&title=General_Meeting%2FMinutes%2F2016-07-07 2026-05-07T15:28:16Z Revision history for this page on the wiki MediaWiki 1.23.13 https://wiki.spdx.org/index.php?title=General_Meeting/Minutes/2016-07-07&diff=3906&oldid=prev 2016-07-07T15:45:02Z

<p>Created page with &quot;* Attendance: 13 * Lead by Phil Odence * Minutes of June meeting approved == Special Guest - Sam Ellis, ARM == * Sam works in ARM’s Cambridge HQ ** SW Engineer/Mgr ** No...&quot;</p> <p><b>New page</b></p><div>* Attendance: 13<br /> * Lead by Phil Odence<br /> * Minutes of June meeting approved<br /> <br /> <br /> == Special Guest - Sam Ellis, ARM ==<br /> <br /> * Sam works in ARM’s Cambridge HQ<br /> ** SW Engineer/Mgr<br /> ** No legal training<br /> ** Has gotten involved just as part as his job<br /> ** Now acts as bridge between dev and legal teams<br /> * They use a license scanning tool<br /> ** That’s the implementation of SPDX<br /> ** Keen on the license list for name consistency<br /> ** And using SPDX basis of repository of data about open source in products<br /> * Dev process<br /> ** Similar to most<br /> ** Are careful to separate out open source archive<br /> *** Basis of license scanning<br /> *** Develop an SPDX tag format report for each product<br /> * Legal Approval Process<br /> ** They use a custom tool internally<br /> ** When open source comes into the company, they assess risk<br /> ** Recently put a new system in place<br /> *** Asks the type of questions that SPDX captures<br /> **** Package name, licenses, copyright notices, where downloaded, etc.<br /> *** Goal is to to eventually import/export SPDX for this purposes<br /> ** Tracks OSS use cases<br /> * Two systems using<br /> ** Approval process<br /> ** Data from the build<br /> ** Will eventually try to compare to ensure sync<br /> *** Can be hard to maintain, particularly when removing stuff.<br /> * Sam’s projects use and exceptionally large amount of OSS<br /> ** Need to explain to customers<br /> ** Ideally would like to auto-gen the list of licenses they publish<br /> *** Practical Problem: They don’t want to declare all<br /> **** For example, disjunctive license, may only want declare one<br /> * Would like to ship SPDX<br /> ** Need to work out how much to declare<br /> ** They get a lot of queries<br /> *** Concern is does providing more info, generate more queries<br /> ** * Certainly they feel that SPDX is the right format<br /> * Observations<br /> ** Tag file is large - 130 MB for one product<br /> *** Too large to ship, but could include on website<br /> *** Too much info to be comprehensible<br /> ** People who need to use, don’t have the tools<br /> *** Need something that can open and filter/summarize<br /> * Learning<br /> ** In the past have developed one big SPDX file<br /> ** Probably a mistake, should have broken it down<br /> * Discussion<br /> ** Tooling- perhaps the convertor to spreadsheet<br /> ** Supply chain partners are really interested in use cases, not just what’s in product<br /> ** Any sharing SPDX docs within company yet? - No, not yet.<br /> <br /> <br /> == Tech Team Report - Kate/Gary ==<br /> <br /> * Spec<br /> ** 2.1 draft is out for review<br /> *** open until the end of the month<br /> *** assuming no show stoppers, that should be it<br /> * Tooling<br /> ** Started updating for 2.1 last week<br /> ** External references implementation taking more time than anticipated<br /> ** Tooling first pass should be ready with 2.1 release timeframe<br /> ** Gary is keen for feedback on our tools and any issues in implementing other tools<br /> <br /> == Outreach Team Report - Jack ==<br /> <br /> * Website<br /> ** Very close to wrapping up<br /> ** Looking at final review next week<br /> <br /> <br /> == Legal Team Report - Jilayne ==<br /> <br /> * XML templates<br /> ** Review continuing<br /> ** Call today will checkpoint where we are and remaining work<br /> * 2.5 list release<br /> ** Should be live in the next day or two<br /> ** Not too many new licenses<br /> <br /> <br /> == Cross Functional Topics - Phil ==<br /> <br /> * Guest stars<br /> ** Always looking for more<br /> * LinuxCon<br /> ** Looks light nothing official <br /> <br /> <br /> <br /> == Attendees ==<br /> <br /> * Phil Odence, Black Duck<br /> * Kate Stewart, Linux Foundation<br /> * Jilayne Lovejoy, ARM<br /> * Scott Sterling, Palamida<br /> * Robin Gandhi, UNO<br /> * Jack Manbeck, TI<br /> * Yev Bronshteyn, Black Duck<br /> * Gary O’Neill, SourceAuditor <br /> * Mark Gisi, Wind River <br /> * Dave Marr, Qualcomm<br /> * Matt Germonprez, UNO<br /> * Michael Herzog- nexB<br /> * Sam Ellis, ARM<br /> <br /> <br /> [[Category:General|Minutes]]<br /> [[Category:Minutes]]</div>

Podence