https://wiki.spdx.org/index.php?action=history&feed=atom&title=Technical_Team%2FMinutes%2F2013-03-19
Technical Team/Minutes/2013-03-19 - Revision history
2026-05-07T12:20:39Z
Revision history for this page on the wiki
MediaWiki 1.23.13
https://wiki.spdx.org/index.php?title=Technical_Team/Minutes/2013-03-19&diff=2342&oldid=prev
MartinMichlmayr: Convert to MediaWiki syntax
2013-03-29T11:07:20Z
<p>Convert to MediaWiki syntax</p>
<table class='diff diff-contentalign-left'>
<col class='diff-marker' />
<col class='diff-content' />
<col class='diff-marker' />
<col class='diff-content' />
<tr style='vertical-align: top;'>
<td colspan='2' style="background-color: white; color:black; text-align: center;">← Older revision</td>
<td colspan='2' style="background-color: white; color:black; text-align: center;">Revision as of 11:07, 29 March 2013</td>
</tr><tr><td colspan="2" class="diff-lineno">Line 1:</td>
<td colspan="2" class="diff-lineno">Line 1:</td></tr>
<tr><td class='diff-marker'>−</td><td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #ffe49c; vertical-align: top; white-space: pre-wrap;"><div><del class="diffchange diffchange-inline"><p><span style</del>=<del class="diffchange diffchange-inline">"font-family: Times New Roman; font-size: medium;"> </del>General Upates<del class="diffchange diffchange-inline">:</span></p><p><span style</del>=<del class="diffchange diffchange-inline">"font-family: Consolas; font-size: medium;"></del>Jack requests we walk through the website / wiki next time<del class="diffchange diffchange-inline"></span></p><p><span style="font-family: Times New Roman; font-size: medium;"> K</span><span style="font-family: Consolas; font-size: medium;">ate </del>wants to start a draft of SPDX 2.0 documentation<del class="diffchange diffchange-inline"></span></p><p><span style="font-family: Consolas; font-size: medium;"></del>Kate mentions that the UNO folks felt need for a reviewer comment at every level (e.g. File Level, not just the Doc level)<del class="diffchange diffchange-inline"></span></p><p><span style</del>=<del class="diffchange diffchange-inline">"font-family: Times New Roman; font-size: medium;"> </del>Modeling<del class="diffchange diffchange-inline">:</span></p><p><span style</del>=<del class="diffchange diffchange-inline">"font-family: Times New Roman; font-size: medium;"></del>Next steps would be to do an instance diagram.<del class="diffchange diffchange-inline"></span></p><p><span style="font-family: Consolas; font-size: medium;"></del>Kate suggests use case of Time 1.7 upstream getting consumed by Ubuntu who applies patches to it.<del class="diffchange diffchange-inline">&nbsp; </span><a href="</del>http://archive.ubuntu.com/ubuntu/pool/main/t/time/<del class="diffchange diffchange-inline">"><span style</del>=<del class="diffchange diffchange-inline">"color: #0000ff; font-family: Consolas; font-size: medium;">http://archive.ubuntu.com/ubuntu/pool/main/t/time/</span></a></p><p>&nbsp;</p><p><span style</del>=<del class="diffchange diffchange-inline">"font-family: Consolas; font-size: medium;"></del>Items for discussion about<del class="diffchange diffchange-inline">&nbsp;</del>the updated model<del class="diffchange diffchange-inline"></span></p><p><span style</del>=<del class="diffchange diffchange-inline">"font-family: Consolas; font-size: medium;"></del>Document Relationship:<del class="diffchange diffchange-inline"><span style="mso-spacerun: yes;">&nbsp; </span></del>the 'downstream' Document includes the relationship, and propose it carries the SHA-1 hash of the document it refers to.<del class="diffchange diffchange-inline"><span style="mso-spacerun: yes;">&nbsp; </span></del>And optionally the digitally signed hash...<del class="diffchange diffchange-inline"></span></p><p><span style="font-size: medium;"><span style="font-family: Consolas;"></del>Specifier: let's get concrete about this...<del class="diffchange diffchange-inline"><span style="mso-spacerun: yes;">&nbsp; </span></span></span></p><p><span style="font-family: Consolas; font-size: medium;"></del>Gary thinks Specifier is a pair of a URI plus some sort of checksum that can be used to validate what the URI refers to.<del class="diffchange diffchange-inline"></span></p><p><span style="font-family: Consolas; font-size: medium;"></del>SPDXDoc can't have a Specifier inside itself.<del class="diffchange diffchange-inline"><span style="mso-spacerun: yes;">&nbsp; </span></del>But SPDXElements / SPDXPackage / could reference a specifier.<del class="diffchange diffchange-inline"></span></p><p><span style="font-family: Consolas; font-size: medium;"></del>Bill points out that <del class="diffchange diffchange-inline">Ed's Adopted Proposal <</del>/<del class="diffchange diffchange-inline">span><a href="http:</del>/<del class="diffchange diffchange-inline">/spdx.org/wiki/proposal-</del>2012<del class="diffchange diffchange-inline">-mar</del>-06<del class="diffchange diffchange-inline">-detached-signed-spdx-files"><span style="color: #0000ff; font-family: Consolas; font-size: medium;">http://spdx.org/wiki/proposal-2012-mar</del>-06<del class="diffchange diffchange-inline">-detached-signed-spdx-files<</del>/<del class="diffchange diffchange-inline">span></a></p><p><span style="font-family: Consolas; font-size: medium;"></del>indicates influence of Maven guys who do similar.<del class="diffchange diffchange-inline"></span></p><p><span style="font-family: Consolas; font-size: medium;"></del>Perhaps our Spec / Best Practices can point to how we recommend people publish their public keys...<del class="diffchange diffchange-inline"></span></p><p><a href="</del>https://docs.sonatype.org/display/Repository/How+To+Generate+PGP+Signatures+With+Maven<del class="diffchange diffchange-inline">"><span style="color: #0000ff; font-family: Consolas; font-size: medium;">https://docs.sonatype.org/display/Repository/How+To+Generate+PGP+Signatures+With+Maven</span></a></p><p>&nbsp;</p><p class="MsoPlainText" style="margin: 0in 0in 0pt;"><span style="font-family: Consolas; font-size: medium;"></del>Here's an excerpt from that post talking about digital signatures:<del class="diffchange diffchange-inline"></span></p><p><span style="font-family: Consolas; font-size: medium;">-----------</span></p><p><span style="font-family: Consolas; font-size: medium;"></del>Distribute Your Public Key<del class="diffchange diffchange-inline"></span></p><p><span style="font-family: Consolas; font-size: medium;"></del>Since other people need your public key to verify your files, you have to distribute your public key to a key server:<del class="diffchange diffchange-inline"></span></p><p><span style="font-family: Consolas; font-size: medium;"></del>$ gpg --keyserver hkp://pool.sks-keyservers.net --send-keys C6EED57A Here I distributed my public key to hkp://pool.sks-keyservers.net, use<del class="diffchange diffchange-inline"><span style="mso-spacerun: yes;">&nbsp; </span></del>--keyserver along with a key server address, and use --send-keys along with a keyid. You can get your keyid by listing the public keys.<del class="diffchange diffchange-inline"></span></p><p><span style="font-family: Consolas; font-size: medium;"></del>Note<del class="diffchange diffchange-inline"></span></p><p><span style="font-family: Consolas; font-size: medium;"></del>Public keys are synced among key servers, but it may take a while.<del class="diffchange diffchange-inline"></span></p><p><span style="font-family: Consolas; font-size: medium;"></del>Now other people can import your public key from the key server to their local machines:<del class="diffchange diffchange-inline"></span></p><p><span style="font-family: Consolas; font-size: medium;"></del>$ gpg --keyserver hkp://pool.sks-keyservers.net --recv-keys C6EED57A<del class="diffchange diffchange-inline"></span></p><p><span style="font-family</del>: <del class="diffchange diffchange-inline">Consolas; font-size</del>: <del class="diffchange diffchange-inline">medium;">-----------</span></p><p>&nbsp;</p></del></div></td><td class='diff-marker'>+</td><td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div>=<ins class="diffchange diffchange-inline">= </ins>General Upates =<ins class="diffchange diffchange-inline">=</ins></div></td></tr>
<tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div> </div></td></tr>
<tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div>Jack requests we walk through the website / wiki next time</div></td></tr>
<tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div> </div></td></tr>
<tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div><ins class="diffchange diffchange-inline">Kate </ins>wants to start a draft of SPDX 2.0 documentation</div></td></tr>
<tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div> </div></td></tr>
<tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div>Kate mentions that the UNO folks felt need for a reviewer comment at every level (e.g. File Level, not just the Doc level)</div></td></tr>
<tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div> </div></td></tr>
<tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div><ins class="diffchange diffchange-inline">=</ins>= Modeling =<ins class="diffchange diffchange-inline">=</ins></div></td></tr>
<tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div> </div></td></tr>
<tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div>Next steps would be to do an instance diagram.</div></td></tr>
<tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div> </div></td></tr>
<tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div>Kate suggests use case of Time 1.7 upstream getting consumed by Ubuntu who applies patches to it. http://archive.ubuntu.com/ubuntu/pool/main/t/time/</div></td></tr>
<tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div> </div></td></tr>
<tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div>== Items for discussion about the updated model =<ins class="diffchange diffchange-inline">=</ins></div></td></tr>
<tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div> </div></td></tr>
<tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div>Document Relationship: the 'downstream' Document includes the relationship, and propose it carries the SHA-1 hash of the document it refers to. And optionally the digitally signed hash...</div></td></tr>
<tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div> </div></td></tr>
<tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div>Specifier: let's get concrete about this...</div></td></tr>
<tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div> </div></td></tr>
<tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div>Gary thinks Specifier is a pair of a URI plus some sort of checksum that can be used to validate what the URI refers to.</div></td></tr>
<tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div> </div></td></tr>
<tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div>SPDXDoc can't have a Specifier inside itself. But SPDXElements / SPDXPackage / could reference a specifier.</div></td></tr>
<tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div> </div></td></tr>
<tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div>Bill points out that <ins class="diffchange diffchange-inline">[[Technical_Team</ins>/<ins class="diffchange diffchange-inline">Proposals</ins>/2012-06-06/<ins class="diffchange diffchange-inline">Detached_Signed_SPDX_Files|Ed's Adopted Proposal]] </ins>indicates influence of Maven guys who do similar.</div></td></tr>
<tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div> </div></td></tr>
<tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div>Perhaps our Spec / Best Practices can point to how we recommend people publish their public keys...</div></td></tr>
<tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div> </div></td></tr>
<tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div>https://docs.sonatype.org/display/Repository/How+To+Generate+PGP+Signatures+With+Maven</div></td></tr>
<tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div> </div></td></tr>
<tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div>Here's an excerpt from that post talking about digital signatures:</div></td></tr>
<tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div> </div></td></tr>
<tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div><ins class="diffchange diffchange-inline">''</ins>Distribute Your Public Key</div></td></tr>
<tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div> </div></td></tr>
<tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div>Since other people need your public key to verify your files, you have to distribute your public key to a key server:</div></td></tr>
<tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div> </div></td></tr>
<tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div><ins class="diffchange diffchange-inline">    </ins>$ gpg --keyserver hkp://pool.sks-keyservers.net --send-keys C6EED57A</div></td></tr>
<tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div>Here I distributed my public key to hkp://pool.sks-keyservers.net, use --keyserver along with a key server address, and use --send-keys along with a keyid. You can get your keyid by listing the public keys.</div></td></tr>
<tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div> </div></td></tr>
<tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div>Note</div></td></tr>
<tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div> </div></td></tr>
<tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div>Public keys are synced among key servers, but it may take a while.</div></td></tr>
<tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div> </div></td></tr>
<tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div>Now other people can import your public key from the key server to their local machines:</div></td></tr>
<tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div> </div></td></tr>
<tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div><ins class="diffchange diffchange-inline">    </ins>$ gpg --keyserver hkp://pool.sks-keyservers.net --recv-keys C6EED57A</div></td></tr>
<tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div><ins class="diffchange diffchange-inline">''</ins></div></td></tr>
<tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div> </div></td></tr>
<tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div><ins class="diffchange diffchange-inline">[[Category</ins>:<ins class="diffchange diffchange-inline">Technical|Minutes]]</ins></div></td></tr>
<tr><td colspan="2"> </td><td class='diff-marker'>+</td><td style="color:black; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div><ins class="diffchange diffchange-inline">[[Category</ins>:<ins class="diffchange diffchange-inline">Minutes]]</ins></div></td></tr>
<!-- diff cache key spdx_mediawiki:diff:version:1.11a:oldid:2341:newid:2342 -->
</table>
MartinMichlmayr
https://wiki.spdx.org/index.php?title=Technical_Team/Minutes/2013-03-19&diff=2341&oldid=prev
Goneall at 19:47, 26 March 2013
2013-03-26T19:47:59Z
<p></p>
<p><b>New page</b></p><div><p><span style="font-family: Times New Roman; font-size: medium;"> General Upates:</span></p><p><span style="font-family: Consolas; font-size: medium;">Jack requests we walk through the website / wiki next time</span></p><p><span style="font-family: Times New Roman; font-size: medium;"> K</span><span style="font-family: Consolas; font-size: medium;">ate wants to start a draft of SPDX 2.0 documentation</span></p><p><span style="font-family: Consolas; font-size: medium;">Kate mentions that the UNO folks felt need for a reviewer comment at every level (e.g. File Level, not just the Doc level)</span></p><p><span style="font-family: Times New Roman; font-size: medium;"> Modeling:</span></p><p><span style="font-family: Times New Roman; font-size: medium;">Next steps would be to do an instance diagram.</span></p><p><span style="font-family: Consolas; font-size: medium;">Kate suggests use case of Time 1.7 upstream getting consumed by Ubuntu who applies patches to it.&nbsp; </span><a href="http://archive.ubuntu.com/ubuntu/pool/main/t/time/"><span style="color: #0000ff; font-family: Consolas; font-size: medium;">http://archive.ubuntu.com/ubuntu/pool/main/t/time/</span></a></p><p>&nbsp;</p><p><span style="font-family: Consolas; font-size: medium;">Items for discussion about&nbsp;the updated model</span></p><p><span style="font-family: Consolas; font-size: medium;">Document Relationship:<span style="mso-spacerun: yes;">&nbsp; </span>the 'downstream' Document includes the relationship, and propose it carries the SHA-1 hash of the document it refers to.<span style="mso-spacerun: yes;">&nbsp; </span>And optionally the digitally signed hash...</span></p><p><span style="font-size: medium;"><span style="font-family: Consolas;">Specifier: let's get concrete about this...<span style="mso-spacerun: yes;">&nbsp; </span></span></span></p><p><span style="font-family: Consolas; font-size: medium;">Gary thinks Specifier is a pair of a URI plus some sort of checksum that can be used to validate what the URI refers to.</span></p><p><span style="font-family: Consolas; font-size: medium;">SPDXDoc can't have a Specifier inside itself.<span style="mso-spacerun: yes;">&nbsp; </span>But SPDXElements / SPDXPackage / could reference a specifier.</span></p><p><span style="font-family: Consolas; font-size: medium;">Bill points out that Ed's Adopted Proposal </span><a href="http://spdx.org/wiki/proposal-2012-mar-06-detached-signed-spdx-files"><span style="color: #0000ff; font-family: Consolas; font-size: medium;">http://spdx.org/wiki/proposal-2012-mar-06-detached-signed-spdx-files</span></a></p><p><span style="font-family: Consolas; font-size: medium;">indicates influence of Maven guys who do similar.</span></p><p><span style="font-family: Consolas; font-size: medium;">Perhaps our Spec / Best Practices can point to how we recommend people publish their public keys...</span></p><p><a href="https://docs.sonatype.org/display/Repository/How+To+Generate+PGP+Signatures+With+Maven"><span style="color: #0000ff; font-family: Consolas; font-size: medium;">https://docs.sonatype.org/display/Repository/How+To+Generate+PGP+Signatures+With+Maven</span></a></p><p>&nbsp;</p><p class="MsoPlainText" style="margin: 0in 0in 0pt;"><span style="font-family: Consolas; font-size: medium;">Here's an excerpt from that post talking about digital signatures:</span></p><p><span style="font-family: Consolas; font-size: medium;">-----------</span></p><p><span style="font-family: Consolas; font-size: medium;">Distribute Your Public Key</span></p><p><span style="font-family: Consolas; font-size: medium;">Since other people need your public key to verify your files, you have to distribute your public key to a key server:</span></p><p><span style="font-family: Consolas; font-size: medium;">$ gpg --keyserver hkp://pool.sks-keyservers.net --send-keys C6EED57A Here I distributed my public key to hkp://pool.sks-keyservers.net, use<span style="mso-spacerun: yes;">&nbsp; </span>--keyserver along with a key server address, and use --send-keys along with a keyid. You can get your keyid by listing the public keys.</span></p><p><span style="font-family: Consolas; font-size: medium;">Note</span></p><p><span style="font-family: Consolas; font-size: medium;">Public keys are synced among key servers, but it may take a while.</span></p><p><span style="font-family: Consolas; font-size: medium;">Now other people can import your public key from the key server to their local machines:</span></p><p><span style="font-family: Consolas; font-size: medium;">$ gpg --keyserver hkp://pool.sks-keyservers.net --recv-keys C6EED57A</span></p><p><span style="font-family: Consolas; font-size: medium;">-----------</span></p><p>&nbsp;</p></div>
Goneall