https://wiki.spdx.org/index.php?action=history&feed=atom&title=Technical_Team%2FMinutes%2F2014-10-07 2026-05-07T12:14:37Z Revision history for this page on the wiki MediaWiki 1.23.13 https://wiki.spdx.org/index.php?title=Technical_Team/Minutes/2014-10-07&diff=3374&oldid=prev 2014-10-08T01:38:48Z

<p>Created page with &quot;October 10, 2014 == Attendees == * Gary O&#039;Neall * Bill Schineller * Kate Stewart * Jack Manbeck * Scott Sterling == Agenda == * Schedule for 2.0 * External document references...&quot;</p> <p><b>New page</b></p><div>October 10, 2014<br /> == Attendees ==<br /> * Gary O'Neall<br /> * Bill Schineller<br /> * Kate Stewart<br /> * Jack Manbeck<br /> * Scott Sterling<br /> == Agenda ==<br /> * Schedule for 2.0<br /> * External document references<br /> * Support for multiple checksum types<br /> == Schedule for 2.0 ==<br /> * Key Dates:<br /> ** November 14: SPDX 2.0 Draft complete, distributed for internal review/comment (internal to business, legal and technical committees)<br /> ** Dec 1. Deadline for feedback<br /> ** Dec. 1-17 incorporate feedback<br /> ** Dec. 18 SPDX 2.0 release candidate for tools implementation and release to general mailing list<br /> ** Dec 19th: Tool Implementation Kickoff<br /> ** Feb. 18-20 Collab Summit - Tools implemented, Plug-and-Play event to test tool interoperability<br /> *** compare SPDX 2.0 output of different tools for compatibility/consistency<br /> *** supply chain example. Upstream SPDX consumed by downstream SPDX.<br /> * Won't make the current plan of LInuxCon Europe (which is next week)<br /> * Draft ready for Linux Open in December - either the first or 15th<br /> ** Kate will be offline 3 weeks last part of Nov through Dec 1<br /> ** Kate will publish draft before going offline - November 14th<br /> ** Dec 1. - deadline for feedback<br /> ** First 1/2 December gather feedback<br /> ** Target December 18th for release candidate 1 (RC1) - ready for tools implementation<br /> * Remaining work - Kate will publish a list<br /> ** Would like to get additional checksums<br /> ** License identifiers in the code as an appendix<br /> ** License Expressions Syntax<br /> *** Jack will publish a draft for this section<br /> * Tools to be implemented by LinuxCon<br /> ** Tools demo including use cases - supply chain examples<br /> ** Bake-off/Plug-n-play/interoperability tests between tools<br /> * Migration from 1.0 to 2.0<br /> ** Should the business team take on the migration collateral?<br /> ** Highlights of 2.0 on the 18th<br /> ** Migration details and &quot;what's new in SPDX 2.0&quot; papers should be published soon after the 18th.<br /> == External document references==<br /> * Reviewed email proposal<br /> * Kate will do a more detailed review and email any changes<br /> * Gary will update the proposal to include an SPDX default namespace for those without their own creator website<br /> * We agreed not to implement the storage of SPDX documents now<br /> ** We will discuss this at LinuxCon<br /> ** we will add a page to describe the use of the document URIs to the SPDX web page that may be referenced from the default spdx namespace<br /> == Additional Checksum Types ==<br /> * Bruno proposed additional types<br /> ** SHA-256<br /> * cardinality would be changed to 1 or more (from 1)<br /> * Do we also allow for other types to be used in the verification code (in addition to using the checksum types for the file checksums)?<br /> * Mandatory sha1, others are optional<br /> * Verification code would also be a mandatory sha1 with optional other <br /> * Should we change the mandatory from sha1 to sha256?<br /> ** sha1 has been proven vulnerable<br /> ** sha1 would be compatible with 1.2<br /> ** vulnerability would not be too severe for our use cases<br /> [[Category:Technical|Minutes]]<br /> [[Category:Minutes]]</div>

Goneall