2014-02-04¶

Archived page

Read-only copy of the SPDX wiki. The wiki is no longer active; its content has moved to https://github.com/spdx. Last edited 2014-02-05 by Goneall.

Feb 4, 2014

Attendees¶

No updates since last meeting
Plans for future instance diagrams:
a 'distro' with a kernel + packages (e.g. Android)
a java e.g. Hibernate scenario
- spdx of sources of whole github repo,
- spdx of binary jars (finer grained artifacts) they publish to maven (refer back to sources spdx)
- spdx of an application that uses jars (refers back to spdx's of binaries)

Effort underway to create a Maven plugin which creates an SPDX file from a Maven POM file
Reviewed issues from Maven mailing list
Issue with using POM license info
not always filled in
not always accurate
Feedback from Maven community is it would only be valuable if the code was scanned
Discussed targeting the code originators and the value to the originators
suggestion to use the SPDX standard license short names in the POM file
Plugin currently uses the standard SPDX license URL's and there is some indication that Apache will use those URLs
where in a Maven repo would .spdx file(s) best land?
one per GAV?
one per GAVCP C=Classifier e.g. binary vs. sources.jar P=Packaging e.g. war or jar

Apache Maven guys: anyone have connections with them to influence SPDX adoption?
Here's a list of contributors to Maven https://www.ohloh.net/p/maven2/contributors?sort=latest_commit&time_span=12+months
Maven License Plugin project we might join forces with? http://code.mycila.com/license-maven-plugin/
Other organizations originating or assembling code will face similar issues as the Maven/POM - could use this as a good test case

Next Week - Bill and Gary will not be on the call. Will check with Kate to see if we should have a call next week.

Categories: Minutes, Technical