The SPDX implementers meeting is tomorrow, June 15th (8am PDT/11am EDT/5pm CEST - https://meet.jit.si/SPDXImplementersMeeting). Here’s the agenda: Approve meeting minutes from the last call. 2.3

Hello SPDX Implementers, Last week’s meeting minutes are available to review:https://github.com/spdx/meetings/pull/185. Please take a look and let me know if there’s anything that needs

Thank you, Rose. Much appreciated. Thanks, Dick Brooks Active Member of the CISA Critical Manufacturing Sector, Sector Coordinating Council – A Public-Private Partnership Never

Hi Dick, For future reference, the meeting is link is: https://meet.jit.si/SPDXImplementersMeeting To subscribe to the meeting invite please do so

Rose, Please resend the Wednesday invitation. It’s not on my calendar. Thanks, Dick Brooks Active Member of the CISA Critical Manufacturing Sector, Sector Coordinating Council –

Hello SPDX Implementers, The second SPDX implementers meeting is tomorrow, June 1st (8am PDT/11am EDT/5pm CEST). Here’s the agenda: Approve meeting minutes from the last call. Please add your

Hello SPDX Implementers, As discussed in the inaugural call today, the SPDX Implementers meeting will take placeevery other Wednesday at 8am PDT/11am EDT/5pm CEST moving forward. I have updated

SPDX Implementers Meeting When: Wednesday, June 1, 2022 8:00am to 9:00am (UTC-07:00) America/Los Angeles Repeats: Every 2 weeks on

Hi folks, The first SPDX implementers meeting is scheduled for tomorrow. Here’s the agenda for the kick-off call: Introductions Procedure for meeting minutes/approval of minutes Confirm that

Thanks Dick – I’ll take you up on the testing 😊 Gary

Excellent – Thanks, Gary. Just let me know when you’re ready to do some testing. Thanks, Dick Brooks Active Member of the CISA Critical Manufacturing Sector, Sector Coordinating

Yep – that would be me 😊 I’ll update the validation tool once the PR’s are merged and the 2.3 version is a bit more stable. Best, Gary

Gary, I’m happy to do some V 2.3 testing whenever you’re ready. Just let me know. Thanks, Rose. Appreciate your quick turn-around. Thanks, Dick Brooks Active Member of the

Thanks, Rose. Thanks, Dick Brooks Active Member of the CISA Critical Manufacturing Sector, Sector Coordinating Council – A Public-Private Partnership Never trust software, always

I’ll defer to @Gary O'Neall on this but I suspect he’s working on it. From:spdx-implementers@... <spdx-implementers@...> on behalf of Dick Brooks via lists.spdx.org

Yes, this was fixed with a PR I opened that was recently merged for 2.2.2. If you look at the latest github branch, you can see thechanges reflected. I suspect the spec has not been updated yet with

One last item. Is anyone working on updates to the online validation tool to address these changes? If so I would like to submit some candidate SBOM’s in V 2.3 for testing. Thanks,

Thanks, Rose. Attribute Value Required No Cardinality 1..* Should we also change Cardinality to 0..* instead of 1..* to show that this item in optional? Thanks, Dick Brooks

Correct -- PackageLicenseConcluded, PackageLicenseDeclared, PackageCopyrightText will all be optional for 2.3 once the PR is merged. As for package checksum, it is currently optional in the 2.2

Thanks, Rose. Much appreciate the quick response. Just to confirm, all of these fields shown below will be optional after the changes – correct? PackageLicenseConcluded: