Skip to content

Technical Team/Minutes/2020-08-18

Archived page

Read-only copy of the SPDX wiki. The wiki is no longer active; its content has moved to https://github.com/spdx. Last edited 2020-08-18 by Goneall.

August 18, 2020

Attendees

  • Kate Stewart
  • Thomas Steenbergen
  • John Horan
  • Gary O’Neall
  • Peter Shin
  • Philippe Ombredanne

Topics:

  • Google Summer of Code
  • Legal profile – continuing discussion
  • Gitlab support of SPDX

GSoC

  • Philip’s project should be able to present next General meeting – Kate will arrange
  • Philippe will meet with Philip and check on progress
  • Communicating between tools
  • Example: How well was the match to the license – would be helpful for a tool to tool relationship
  • Issue – loss of information detail
  • Snippets don’t really work – will capture the line range, but isn’t always correct
  • Should it be simplified or include a lot of detail?
  • Thomas: I found this license in this file at this line number
  • Would like to communicate scanning results from Scancode to SW360
  • Would help with audits and detecting errors/bugs
  • All on the call it would be useful
  • Kate created a Google doc to track the license scanning tooling profile: https://docs.google.com/document/d/1p24qf2uNk5b1rU0m_Tvj2cD-lioFaaeJKh9PmnPbhwo/edit
  • Kate also added a dependency tree profiles: https://docs.google.com/document/d/1IfcSlrDou-8KLqkLr568DKGaQiHXmt_EFsZRfcf0Ej8/edit
  • Kate also created a Google doc for the vulnerabilities profile: https://docs.google.com/document/d/11S8FTG5zSwmH-o_Conp9-mkzWyOuxC_KXx3VNHlhbws/edit
  • Will also create an issue
  • Question on how to represent a source file: I have a question on how to handle declared license. If it's a short reference to a license, for example, how should SPDX or tool handle "See the license file" snippet. Should the SPDX handle it as a declared and none?
  • Thomas, Gary and Philippe think it would be declared, but the discussion in legal was interpreted as “None” or “LicenseRef-“ with the text found in the file
  • Discussion on having a primary license for a package
  • Philippe will propose an extension to the license expression
  • Introduce “PLUS” operator with the same semantics as AND except the expression to the left of the operator is the primary license for the package

Gitlab

  • Gitlab jobs do not support SPDX
  • Issue logged at https://gitlab.com/gitlab-org/gitlab/-/issues/218521
  • Thomas requested support and comments on the issue in support of SPDX
  • Steve is active with Gitlab and should be able to help
  • Kate will add some pointers in the issue

DCO signoff on SPDX Spec

  • Currently not enabled for the spec
  • Agreed we will enable the DCO BOT
  • Will be turn on Sept. 1
  • Kate will send out an email
  • Thomas will submit a PR

Next Week

  • Vulnerabilities Profile

Categories: Technical