https://wiki.spdx.org/index.php?action=history&feed=atom&title=Technical_Team%2FMinutes%2F2014-03-04 2026-05-07T15:27:28Z Revision history for this page on the wiki MediaWiki 1.23.13 https://wiki.spdx.org/index.php?title=Technical_Team/Minutes/2014-03-04&diff=3088&oldid=prev 2014-03-11T17:32:11Z

<p>Created page with &quot;March 4, 2014 == Attendees == * Gary O’Neall * Bill Schineller * Mark Gisi * Scott Sterling * Jack Manbeck * Kirsten Newcomer == Agenda == * Review instance diagrams * SPDX ...&quot;</p> <p><b>New page</b></p><div>March 4, 2014<br /> == Attendees ==<br /> * Gary O’Neall<br /> * Bill Schineller<br /> * Mark Gisi<br /> * Scott Sterling<br /> * Jack Manbeck<br /> * Kirsten Newcomer<br /> == Agenda ==<br /> * Review instance diagrams<br /> * SPDX 2.0 next steps and discussion<br /> == Instance Diagrams ==<br /> * Walking trhough spdx-2-0-jar-supply-chain.pdf<br /> * Discussion on git repo - agree that SPDX refers to a specific &quot;snapshot&quot; or &quot;commit level&quot; and not a more general reference<br /> * Patch use case - spdx_2 is a description of the changes<br /> * binary / maven use case - maven url may point to a collection of files, not just a single jar<br /> * distribution - distribute a tarball - artifactof needs to be extended to describe the relationship<br /> * application which uses open source described by SPDX - <br /> * Discussion on the references to other SPDX docs - are the references to the doc, the element within the doc or both? <br /> ** Both<br /> ** Need to define the namespace<br /> ** Need to include the concept of dynamic libraries where the artifacts are not copied, but the licensing is impacted by the reference - would be good to have an instance<br /> * What's missing from the current model:<br /> ** SCM - may need more detail than in the current model<br /> ** Patch - additions/deletions of artifacts<br /> ** Relationships <br /> *** do we need user defined relationships?<br /> *** Does the relationship itself need more of a model?<br /> * Walking trhough spdx-2-0-jar-supply-chain-DocSharing.pdf<br /> ** Diagram describes just what needs to be delivered to fully describe the delivered software from the right side of the previous diagram<br /> ** Dotted lines are optional - would not need it if the docs were signed and available<br /> * Discussion on what SPDX document are included<br /> ** do we need to include SPDX docs for files which are not distributed (but are used in creating the files which are distributed)?<br /> ** Patch documents which show deltas?<br /> ** URL references for docs - does that imply the document is accessible on the internet?<br /> *** If it is internal, the doc should be included, if external it may go stale<br /> ** Will the model support exclusions in the relationship?<br /> * Next Steps<br /> ** Compare to current model - Gary<br /> ** Try using protoge to model the properties for SPDX 2.0 - Bill<br /> ** Start plugging the new properties into the current model - Gary<br /> [[Category:Technical|Minutes]]<br /> [[Category:Minutes]]</div>

Goneall