Technical Team/Minutes/2014-02-04

From SPDX Wiki
Jump to: navigation, search

Feb 4, 2014

Attendees

  • Gary O’Neall
  • Bill Schineller
  • Jack Manbeck
  • Michael Herzog
  • Mark Gishi
  • Scott Sterling

Agenda

  • Review instance diagrams
  • POM plugin efforts

Instance Diagram Review

  • No updates since last meeting
  • Plans for future instance diagrams:
    • a 'distro' with a kernel + packages (e.g. Android)
    • a java e.g. Hibernate scenario
      • spdx of sources of whole github repo,
      • spdx of binary jars (finer grained artifacts) they publish to maven (refer back to sources spdx)
      • spdx of an application that uses jars (refers back to spdx's of binaries)

Apache Maven/ POM Plugin efforts

  • Effort underway to create a Maven plugin which creates an SPDX file from a Maven POM file
  • Reviewed issues from Maven mailing list
  • Issue with using POM license info
    • not always filled in
    • not always accurate
  • Feedback from Maven community is it would only be valuable if the code was scanned
    • Discussed targeting the code originators and the value to the originators
  • suggestion to use the SPDX standard license short names in the POM file
  • Plugin currently uses the standard SPDX license URL's and there is some indication that Apache will use those URLs
  • where in a Maven repo would .spdx file(s) best land?
    • one per GAV?
    • one per GAVCP C=Classifier e.g. binary vs. sources.jar P=Packaging e.g. war or jar
      • apache-servicemix-web-3.2.3.war <- the binary
      • apache-servicemix-web-3.2.3.war.md5 <- md5 of the binary
      • apache-servicemix-web-3.2.3.war.sha1 <- sha1 of the binary
      • apache-servicemix-web-3.2.3.war.spdx <- SPDX of the binary
      • apache-servicemix-web-3.2.3.war.asc
      • apache-servicemix-web-3.2.3.war.asc.md5
      • apache-servicemix-web-3.2.3.war.asc.sha1


      • apache-servicemix-web-3.2.3-sources.jar
      • apache-servicemix-web-3.2.3-sources.jar.md5
      • apache-servicemix-web-3.2.3-sources.jar.sha1
      • apache-servicemix-web-3.2.3.war.spdx <- SPDX of the sources (SCANNED)

Next Week

Next Week - Bill and Gary will not be on the call. Will check with Kate to see if we should have a call next week.