Hello! Some of us in the community have come together to revive development on the spdx-sbom-generator (https://github.com/opensbom-generator/spdx-sbom-generator). The scope of the project is to gener

Dear all, We had a very productive Canonicalisation Committee meeting today, in which we explored the many aspects of CPEs and discussed their representation in the SPDX Canonical Serialisation. There

Hot off the press! Link to blog post of this here: https://communityblog.fedoraproject.org/important-changes-to-software-license-information-in-fedora-packages-spdx-and-more/ Thanks for the support on

William, I typed in the SBOM example from the model diagram. I then modified it to move the element of type SBOM from the beginning to the array of elements. Neither the original nor the modified JSON

Reminder: SPDX tech team meeting When: 08/09/2022 11:00am to 12:30pm (UTC-05:00) America/Chicago Where: https://zoom.us/j/663426859 Organizer: Kate Stewart kstewart@... View Event Description: https:/

At Monday's Build Profile meeting, we looked at SLSA Provenance v0.2 as prior art for the build profile schema. As promised, here is a list of the known issues with v0.2 that can hopefully be improved

Reminder: SPDX tech team meeting When: 08/02/2022 11:00am to 12:30pm (UTC-05:00) America/Chicago Where: https://zoom.us/j/663426859 Organizer: Kate Stewart kstewart@... View Event Description: https:/

This PR has the model I proposed at the end of today’s meeting: https://github.com/spdx/spdx-3-model/pull/25 From the PR description: This is the model I proposed at the end of the meeting. Notable ch

Hello Everyone, I’m pleased to report that the IETF has agreed to establish a work group to focus on the development of standards to provide software consumers with greater visibility into software tr

Greetings all, The SPDX spec version 2.3 is now available for review at https://spdx.github.io/spdx-spec/v2.3-RC1/. A summary of the changes can be found in the SPEC Annex I. If you identify any issue

I’m making some changes to the CI/CD to allow us to automatically publish side by side versions of the docs and to centralize that build and publishing process (so it’s not spread across the branches)

On July 18 I emailed an example JSON array (not map) "spdx document" (transfer unit) containing six elements created by "Acme": two files one package one relationship between files and package one ide

Proposed rules (and alternatives): If you are transferring a single element and no additional context needs to be transferred, just transfer the single element. Root of serialization is a single eleme

Reminder: SPDX tech team meeting When: 07/26/2022 11:00am to 12:30pm (UTC-05:00) America/Chicago Where: https://zoom.us/j/663426859 Organizer: Kate Stewart kstewart@... View Event Description: https:/

Last week I took an action item to describe what serialized data for the v3 logical model could look like, in order to clarify discussion of the types shown in the model. The thing to remember about v

We discussed whether elements should be serialized as maps or arrays, and I provided an example map serialization for discussion. The two serialization formats are equivalent, in that they deserialize

(cross-posting to tech and legal team, as I suspect others may be interested) Hi SPDX-tech team, I just wanted to confirm my understanding of the various formats we now have for the SPDX specification

Dear all, Brandon Lum won't be able to attend today's Tech Team meeting, so he asked me to show to the wider group the concepts that we have been discussing in the recent Builds Profile meetings. It w

The online SPDX validator is not responding. Please help. Thanks, Dick Brooks Active Member of the CISA Critical Manufacturing Sector, Sector Coordinating Council – A Public-Private Partnership Never

Dear all, I come bearing good news - we now have a website! https://spdx.github.io/canonical-serialisation/ Changes to the site are automatically published by a continuous integration system when a pu