https://wiki.spdx.org/index.php?action=history&feed=atom&title=General_Meeting%2FMinutes%2F2017-03-02 2026-05-07T12:33:25Z Revision history for this page on the wiki MediaWiki 1.23.13 https://wiki.spdx.org/index.php?title=General_Meeting/Minutes/2017-03-02&diff=4222&oldid=prev 2017-03-02T16:59:05Z

<p>Created page with &quot;* Attendance: 11 * Lead by Phil Odence * Minutes of Feb meeting approved == Special Presentation- Mark Charlebois / Rashmi Chitrakar, Qualcomm == * Mark from corp R&amp;D, Ras...&quot;</p> <p><b>New page</b></p><div>* Attendance: 11<br /> * Lead by Phil Odence<br /> * Minutes of Feb meeting approved <br /> <br /> <br /> == Special Presentation- Mark Charlebois / Rashmi Chitrakar, Qualcomm ==<br /> <br /> * Mark from corp R&amp;D, Rashmi from the open source group<br /> * Mark works on Dronecode<br /> ** Goal is to build with Yocto<br /> ** Want to provide good license info<br /> ** At the outset Yocto build only supported SPDX 1.0 and uses FOSSology for scanning<br /> *** Yocto is a distribution that comes with recipes for custom builds <br /> ** Motivation<br /> *** reducing scan times was key<br /> *** FOSSology was taking as much as 6 days<br /> *** Introducing LiD to address<br /> * (Deck is available)<br /> * Yocto<br /> ** has a number of build stages<br /> ** current integration was inserted after patch stage to only scan what’s patched<br /> ** but that doesn’t allow for reusability<br /> ** So, the approach was to scan upstream sources and focus scan on only patches<br /> ** Uses Yocto archiver<br /> * FOSSology integration<br /> ** Mark was not able to even get it going<br /> ** Old, did not seem well maintained<br /> * New integration<br /> ** Implements approach to <br /> ** Leverage newer SPDX capabilities <br /> *** Relationships between files<br /> *** Usage info (e.g. dynamic library)<br /> ** Allows for parallelizing across machines<br /> ** Can flag discrepancies (e.g. two different licenses declared)<br /> ** Goal<br /> *** create a federated commons of pre-scanned code<br /> *** so, everyone’s work is cut by, say, 90% (as they only need to scan their customer 10%) <br /> * LiD<br /> ** Main Features of Scanners<br /> *** They have access to FOSSology tools (Nomos, Monk)<br /> *** Evaluated using Qualcomm code for testing<br /> *** Nomos was pretty good at detecting license language (94%)<br /> *** Monk, only about 25%<br /> *** Used SPDX license list as source for license matching<br /> ** Goal<br /> *** Aiding in license compliance<br /> *** Hope was to generate SPDX<br /> * Main functions<br /> ** Scans source code to ID license language<br /> ** Natural Language Process “Bag of words” approach<br /> ** Jakarta index shows how well it matches<br /> ** Levenstein measures to determine where to start/end<br /> ** Output- color coded matches (and deviations)<br /> ** Matched about as well as Noms<br /> ** Accuracy<br /> *** Right license<br /> *** Right region<br /> ** Better than Nomos at extracting full text; Monk really fell short<br /> ** Can be tuned<br /> *** Based on LiD Scores (1-perfect)<br /> **** Scores of above .6 were pretty good, but user can adjust<br /> *** Nomos, being REGEX based is very computationally expensive.<br /> * Will be available on GitHub<br /> ** But available already<br /> <br /> *Q&amp;A<br /> ** What’s going on with Debian?<br /> ** It’s being tested on Debian, not a lot of feedback yet<br /> <br /> <br /> == Tech Team Report - Kate ==<br /> <br /> * Spec<br /> ** Have been working on reference examples<br /> *** Filling in how to do examples <br /> ** Spec being converted to docbooks for style<br /> *** Mobile-friendly<br /> ** Getting the spec up on GitHub so changes can be tracked, pull requests, etc<br /> *** Eventually we’ll move there from Bugzilla for issue tracking<br /> ** FacetoFace in Tahoe<br /> *** Jilayne did a great presentation that is available as video, Kate’s as well<br /> *** JSON format discussion<br /> * Tools<br /> ** Talked through plans at Face to Face<br /> <br /> <br /> == Outreach Team Report - Jack ==<br /> <br /> * Accepted for Google Summer of Code<br /> ** Starting to get interest<br /> * Short meeting last week<br /> ** Talked about feedback from Matt’s project surveying companies<br /> ** Need to decide if we will do a survey<br /> ** Jack says we really need to look at the Ecosystem<br /> *** Define user types and what to tell them they should do<br /> *** Need to paint a picture of what success is with SPDX<br /> *** Some feedback from site “I’m a developer, what do I do?”<br /> * Considering whether we need someone on the outreach team who is more OSS community-focused<br /> ** Perhaps looking at “SPDX lite” (wrong word) sort of approach, and easy way to get started<br /> <br /> <br /> == Legal Team Report - Jilayne/Paul ==<br /> * Good meetings at Tahoe<br /> ** 2 hour working session <br /> *** Action plan for XML conversion<br /> *** How to completely connect the dots and organize upcoming task<br /> * Today’s call will follow up<br /> * Brad Edmondson developing deck and presenting to ABA group<br /> <br /> <br /> == Attendees ==<br /> <br /> *Mark Charlebois, Qualcomm<br /> *Rashmi Chitrakar, Qualcomm<br /> * Phil Odence, Black Duck<br /> * Kate Stewart, Linux Foundation<br /> * Philippe Ombrédanne- nexB<br /> * Paul Madick, Dimension Data<br /> * Jilayne Lovejoy, ARM<br /> * Jack Manbeck, TI<br /> * Michael Herzog- nexB<br /> * Mark Gisi, Wind River <br /> * Thomas Steenbergen, HERE<br /> <br /> <br /> [[Category:General|Minutes]]<br /> [[Category:Minutes]]</div>

Podence