Technical Team/Minutes/2011-08-30 - Revision history

MartinMichlmayr: Convert to MediaWiki syntax

2013-03-06T13:18:49Z

Convert to MediaWiki syntax

Goneall at 19:58, 30 August 2011

2011-08-30T19:58:32Z

New page

Minutes 8/30/2011
 
Attendees:
<ul>
<li>Bill Schineller</li>
<li>Kirsten Newcomer</li>
<li>Branden Robinson</li>
<li>Peter Williams</li>
<li>Gary O’Neall</li>
<li>Kate Stewart</li>
<li>Jack Manbeck</li>
<li>Ed Warnicke</li></ul>
 
Agenda:
 
<ul><li>· Composite Package Requirements</li><li>· Verification Code</li><li>· Basic practices on file naming (to include or not include version)</li></ul>

 
Verification Code:
<ul><li>· Discussion on whether we should include a verification code or just have an algorithm to calculate the verification code from the data within the SPDX document<ul><li> Requirements – determine if a package has been modified – or - was this SPDX file generated against the files being looked at</li><li> Is it simpler to have a verification code than it is to calculate?<ul><li> Depends on use case</li><li> Use Case 1: In comparing an SPDX document to the files, the algorithm would need to be executed anyway – would be more work to compare to the verification code</li><li> Use Case 2: In comparing 2 SPDX documents, only need to compare verification codes – would be less work</li><li> Variation on Use Case 2: case where the SPDX file represents a binary “blob” and the file level information may be lost</li><li> Use Case 3: Verification of an SPDX file used in a “side car” scenario (where the SPDX file is not included in the archive file itself)</li><li> Can’t think of any other use cases – but leaving open the possibility for other use cases</li><li> Use Case 2 would likely be done in a scenario where Use Case 1 would also be done (or in a scenario where the SPDX is used in a “side-car” scenario)</li><li> Remove the verification code would cause the SPDX files to not be backwards compatible – would need to be a 2.0 change</li><li> Concern about losing credibility if we throw the field out this early</li><li> Proposal to change the verification code to option for backwards compatibility</li></ul></li></ul></li><li>· Fixing the algorithms<ul><li> Discussed issues with the locale</li><li> Discussed proposal to encode in UTF-8 then perform a byte sort<ul><li> Issue with UTF-8 encoding may have some options which differ for unusual characters – would result in byte sequence differences</li><li> Even if locale issues were resolved, the encoding issues would remain since the hash function is performed on the bytes.</li><li> Proposal to use common utility “iconv” to encode the text<ul><li> Concern about licensing for some tools</li><li> Concern about acceptance in the Java community</li></ul></li><li> No one on the call was comfortable providing a specific proposal/resolution</li></ul></li></ul></li><li>· Next steps: <ul><li> Fix the algorithm – continue discussion on fixing the algorithm<ul><li> Seek out an expert (or experts) on encoding issues</li><li> Review section </li><li> Revisit if the field should be removed, remain mandatory or change it as optional</li><li> Seek out expert on encoding issues</li><li> For background - review section 7 man page for locale</li></ul></li></ul></li></ul>

@@ Line 1: / Line 1: @@
-<p><span style="font-family: Times New Roman; font-size: small;">Minutes 8/30/2011</span></p>
+== Attendees ==
-<p><span style="font-family: Times New Roman; font-size: small;"> </span></p>
-<p><span style="font-family: Times New Roman; font-size: small;">Attendees:</span></p>
-<ul>
-<li><span style="font-family: Times New Roman; font-size: small;">Bill Schineller</span></li>
-<li><span style="font-family: Times New Roman; font-size: small;">Kirsten Newcomer</span></li>
-<li><span style="font-family: Times New Roman; font-size: small;">Branden Robinson</span></li>
-<li><span style="font-family: Times New Roman; font-size: small;">Peter Williams</span></li>
-<li><span style="font-family: Times New Roman; font-size: small;">Gary O’Neall</span></li>
-<li><span style="font-family: Times New Roman; font-size: small;">Kate Stewart</span></li>
-<li><span style="font-family: Times New Roman; font-size: small;">Jack Manbeck</span></li>
-<li><span style="font-family: Times New Roman; font-size: small;">Ed Warnicke</span></li></ul>
-<p><span style="font-family: Times New Roman; font-size: small;"> </span></p>
-<p><span style="font-family: Times New Roman; font-size: small;">Agenda:</span></p>
-<p><span style="font-family: Times New Roman; font-size: small;"> </span></p>
-<ul><li><span style="font-size: small;">·</span>         <span style="font-family: Times New Roman; font-size: small;">Composite Package Requirements</span></li><li><span style="font-size: small;">·</span>         <span style="font-family: Times New Roman; font-size: small;">Verification Code</span></li><li><span style="font-size: small;">·</span>         <span style="font-family: Times New Roman; font-size: small;">Basic practices on file naming (to include or not include version)</span></li></ul>
-<p><span style="font-family: Times New Roman; font-size: small;"> </span></p>
+== Agenda ==
-<p><span style="font-family: Times New Roman; font-size: small;">Verification Code:</span></p>
-<ul><li><span style="font-size: small;">·</span>         <span style="font-family: Times New Roman; font-size: small;">Discussion on whether we should include a verification code or just have an algorithm to calculate the verification code from the data within the SPDX document</span><ul><li>   <span style="font-family: Times New Roman; font-size: small;">Requirements – determine if a package has been modified – or -  was this SPDX file generated against the files being looked at</span></li><li>   <span style="font-family: Times New Roman; font-size: small;">Is it simpler to have a verification code than it is to calculate?</span><ul><li>  <span style="font-family: Times New Roman; font-size: small;">Depends on use case</span></li><li>  <span style="font-family: Times New Roman; font-size: small;">Use Case 1: In comparing an SPDX document to the files, the algorithm would need to be executed anyway – would be more work to compare to the verification code</span></li><li>  <span style="font-family: Times New Roman; font-size: small;">Use Case 2: In comparing 2 SPDX documents, only need to compare verification codes – would be less work</span></li><li>  <span style="font-family: Times New Roman; font-size: small;">Variation on Use Case 2: case where the SPDX file represents a binary “blob” and the file level information may be lost</span></li><li>  <span style="font-family: Times New Roman; font-size: small;">Use Case 3: Verification of an SPDX file used in a “side car” scenario (where the SPDX file is not included in the archive file itself)</span></li><li>  <span style="font-family: Times New Roman; font-size: small;">Can’t think of any other use cases – but leaving open the possibility for other use cases</span></li><li>  <span style="font-family: Times New Roman; font-size: small;">Use Case 2 would likely be done in a scenario where Use Case 1 would also be done (or in a scenario where the SPDX is used in a “side-car” scenario)</span></li><li>   <span style="font-family: Times New Roman; font-size: small;">Remove the verification code would cause the SPDX files to not be backwards compatible – would need to be a 2.0 change</span></li><li>   <span style="font-family: Times New Roman; font-size: small;">Concern about losing credibility if we throw the field out this early</span></li><li>   <span style="font-family: Times New Roman; font-size: small;">Proposal to change the verification code to option for backwards compatibility</span></li></ul></li></ul></li><li><span style="font-size: small;">·</span>         <span style="font-family: Times New Roman; font-size: small;">Fixing the algorithms</span><ul><li>   <span style="font-family: Times New Roman; font-size: small;">Discussed issues with the locale</span></li><li>   <span style="font-family: Times New Roman; font-size: small;">Discussed proposal to encode in UTF-8 then perform a byte sort</span><ul><li>  <span style="font-family: Times New Roman; font-size: small;">Issue with UTF-8 encoding may have some options which differ for unusual characters – would result in byte sequence differences</span></li><li>  <span style="font-family: Times New Roman; font-size: small;">Even if locale issues were resolved, the encoding issues would remain since the hash function is performed on the bytes.</span></li><li>   <span style="font-family: Times New Roman; font-size: small;">Proposal to use common utility “iconv” to encode the text</span><ul><li>  <span style="font-family: Times New Roman; font-size: small;">Concern about licensing for some tools</span></li><li>  <span style="font-family: Times New Roman; font-size: small;">Concern about acceptance in the Java community</span></li></ul></li><li>   <span style="font-family: Times New Roman; font-size: small;">No one on the call was comfortable providing a specific proposal/resolution</span></li></ul></li></ul></li><li><span style="font-size: small;">·</span>         <span style="font-family: Times New Roman; font-size: small;">Next steps: </span><ul><li>   <span style="font-family: Times New Roman; font-size: small;">Fix the algorithm – continue discussion on fixing the algorithm</span><ul><li>  <span style="font-family: Times New Roman; font-size: small;">Seek out an expert (or experts) on encoding issues</span></li><li>  <span style="font-family: Times New Roman; font-size: small;">Review section </span></li><li>   <span style="font-family: Times New Roman; font-size: small;">Revisit if the field should be removed, remain mandatory or change it as optional</span></li><li>   <span style="font-family: Times New Roman; font-size: small;">Seek out expert on encoding issues</span></li><li>   <span style="font-family: Times New Roman; font-size: small;">For background - review section 7 man page for locale</span></li></ul></li></ul></li></ul>
+* Composite Package Requirements