2019-12-05¶

Archived page

Read-only copy of the SPDX wiki. The wiki is no longer active; its content has moved to https://github.com/spdx. Last edited 2019-12-05 by Podence.

Tech Team Report - Kate/Gary¶

SPDX 2.2
moving on pull requests being merged/included.
Tools for generating Multiple formats being tested (help welcome).
SPDX 3.0
Identifying a common base (based on some of NTIA framing work) with specific profiles (licensing, security, pedigree, provenance, export)
SPDX 2.2 would be a base+licensing profile.
Related Groups
OMG including part of the SPDX models, people regarding as a point to add security information.
NTIA phase 1 documents are published at https://www.ntia.gov/sbom (SPDX is a recognized format there).
NTIA phase 2 workgroups are forming, and there will be one on "formats & tooling” (which will feature SPDX tools ;-) ) those interested in participating in discussions on tooling and how to use tools are welcome to subscribe at: https://lists.linuxfoundation.org/mailman/listinfo/ntia-sbom-formats

Fairly quiet this Q, lighter participation
3.8 release will be light on new licenses
Reviewing and updating license inclusion guidelines
Should end up with broader inclusion at some level
- particularly for non-OSS licenses that include making source available
Good legal/tech team collaboration on 3.0
- One key topic is the license for the docs
- Currently CC0
- This has raised some concerns
- Dredging up historic rationale

Categories: General, Minutes