2020-07-28¶

Archived page

Read-only copy of the SPDX wiki. The wiki is no longer active; its content has moved to https://github.com/spdx. Last edited 2020-07-28 by Goneall.

July 28, 2020

Attendees¶

Kate Stewart
Thomas Steenbergen
Rose Judge
Nisha Kumar
William Bartholomew
Steve Winslow
Gary O’Neall
Jim Hutchison
Peter Shin

Topics: SPDX 3.0 Base Profile

SPDX 3.0 Base Profile¶

Continuing discussion from last week on the model
relationship Model as it relates to container
There will be a large number of external references
Potential issue of sharability across different deployment
Keep the SBOM with the artifact – so there will be a lot of external document references
Snippets simplification proposal
Do we relax the guiding principles for using external definitions (e.g. pointer model)?
- Proposal to relax guiding principle to review existing standards but only adopt those that do not overly complicate the SPDX standard
Overview of Template for profiles
Discussion on how we represent the mandatory/optional requirements
Only change for an existing field is to make the field mandatory
Should we allow any arbitrary additional tools?
Allows for easy extension
Most tools will ignore what they don’t understand
Possible issue with allowing proprietary extensions which may not be helpful to the open standard
Validation may break
Different design principle from 2.0 where extensions are only in annotations and comments
Proposal to allow adding new profiles and new fields in point release
- General agreement
Appendix should be added to describe how the fields should be added
Model update – replaced string field of PackageName with “FromFile”
General agreement the update made sense – but is different from 2.0
Agreed on a different name – packageFile
Checksum would be in the file and can be removed from the Package as a property
Relationship model for containers (continued)
Do we support the decomposition of SBOM’s as described by Nisha
- General agreement and support
- Suggestion to add external reference location information to find the external documents

Next Week¶

Continue discussion on container SBOM relationships
Aug 11 Legal profile

Categories: Technical