Re: Import and export function of SPDX
Soeren_Rabenstein@...
Dear Michel
I find your idea utmost interesting and would like to discuss it in further (sorry that I did not react earlier. Due to my recent transfer to EU with major expansion of job responsibilities, I hardly find time to read mails from this list anymore :()
But I think a better forum for this project would be the FSFE legal network.
Mit freundlichen Grüßen / Kind regards
Sören Rabenstein
____________________________________________________________
ASUS Computer GmbH
Sören Rabenstein, LL.M.
Legal Affairs Center
Harkortstr. 21-23, 40880 Ratingen
Tel.: (+49) 2102 5609 317
Fax.: (+49) 2102 5609 309
soeren_rabenstein@...
____________________________________________________________
-----Ursprüngliche Nachricht-----
Von: spdx-bounces@... [mailto:spdx-bounces@...] Im Auftrag von RUFFIN, MICHEL (MICHEL)
Gesendet: Mittwoch, 13. Juni 2012 14:45
An: Gary O'Neall; 'Peter Williams'
Cc: spdx-tech@...; spdx@...
Betreff: RE: Import and export function of SPDX
Gary, I think in my previous mail I expressed our use case:
1) getting information from our suppliers on FOSS included in their products in order to respect license obligations and to provide this to our customers
2) automate the work of ALU for accepting this FOSS in our products
3) being able to provide the same information to our customers.
I think it is covered by actual use cases, if not I can do a new one.
Now I would like to attract your attention on a document that I sent few months ago to this mailing list and also to the FSF legal network group. Which are the clauses that we put in the contracts with our suppliers and their rationnal. The goal is to standardize these clauses and I receive no feedback from anybody on this.
This should illustrate the use case. And I understand that I should use the FSF legal network to discuss this. But I am very surprised that there is no reaction/interest in this. It has been a huge ALU effort to shape these conditions in order to reach acceptance to these conditions by most companies.
Michel.Ruffin@..., PhD
Software Coordination Manager, Bell Labs, Corporate CTO Dpt Distinguished Member of Technical Staff Tel +33 (0) 6 75 25 21 94 Alcatel-Lucent International, Centre de Villarceaux Route De Villejust, 91620 Nozay, France
toggle quoted message
Show quoted text
I find your idea utmost interesting and would like to discuss it in further (sorry that I did not react earlier. Due to my recent transfer to EU with major expansion of job responsibilities, I hardly find time to read mails from this list anymore :()
But I think a better forum for this project would be the FSFE legal network.
Mit freundlichen Grüßen / Kind regards
Sören Rabenstein
____________________________________________________________
ASUS Computer GmbH
Sören Rabenstein, LL.M.
Legal Affairs Center
Harkortstr. 21-23, 40880 Ratingen
Tel.: (+49) 2102 5609 317
Fax.: (+49) 2102 5609 309
soeren_rabenstein@...
____________________________________________________________
-----Ursprüngliche Nachricht-----
Von: spdx-bounces@... [mailto:spdx-bounces@...] Im Auftrag von RUFFIN, MICHEL (MICHEL)
Gesendet: Mittwoch, 13. Juni 2012 14:45
An: Gary O'Neall; 'Peter Williams'
Cc: spdx-tech@...; spdx@...
Betreff: RE: Import and export function of SPDX
Gary, I think in my previous mail I expressed our use case:
1) getting information from our suppliers on FOSS included in their products in order to respect license obligations and to provide this to our customers
2) automate the work of ALU for accepting this FOSS in our products
3) being able to provide the same information to our customers.
I think it is covered by actual use cases, if not I can do a new one.
Now I would like to attract your attention on a document that I sent few months ago to this mailing list and also to the FSF legal network group. Which are the clauses that we put in the contracts with our suppliers and their rationnal. The goal is to standardize these clauses and I receive no feedback from anybody on this.
This should illustrate the use case. And I understand that I should use the FSF legal network to discuss this. But I am very surprised that there is no reaction/interest in this. It has been a huge ALU effort to shape these conditions in order to reach acceptance to these conditions by most companies.
Michel.Ruffin@..., PhD
Software Coordination Manager, Bell Labs, Corporate CTO Dpt Distinguished Member of Technical Staff Tel +33 (0) 6 75 25 21 94 Alcatel-Lucent International, Centre de Villarceaux Route De Villejust, 91620 Nozay, France
-----Message d'origine-----
De : Gary O'Neall [mailto:gary@...]
Envoyé : mardi 12 juin 2012 19:29
À : 'Peter Williams'; RUFFIN, MICHEL (MICHEL)
Cc : spdx-tech@...; spdx@...
Objet : RE: Import and export function of SPDX
I believe the current SPDX tools will treat both RDF and Tag/Value in the
same manner - the documents will be readable by the tools but it will fail a
validation (missing required field). For the command line tools, the
conversions or pretty printing will still work but you will get warning.
In terms of making the fields optional - I can see this as a valuable change
for some of the use cases where that information is not available. There is
need to make sure the components described in the SPDX file match the actual
file artifacts, but that need can be filled by the per-file information.
Michel - Which use case best describes your use of SPDX
(http://spdx.org/wiki/spdx-20-use-cases). If there isn't a good
representation of your use case(s), could you provide a brief description?
I want to make sure we cover this when working on SPDX 2.0.
Thanks,
Gary
-----Original Message-----
From: spdx-tech-bounces@...
[mailto:spdx-tech-bounces@...] On Behalf Of Peter Williams
Sent: Tuesday, June 12, 2012 9:27 AM
To: RUFFIN, MICHEL (MICHEL)
Cc: spdx-tech@...; spdx@...
Subject: Re: Import and export function of SPDX
On Tue Jun 12 06:02:03 2012, RUFFIN, MICHEL (MICHEL) wrote:
filing a bug[1] so that we don't forget to look into the issue for the next
version.
As for your immediate issues of not having data for those fields, if you are
using RDF i'd just skip them altogether in the SPDX file. While your file
will technically be invalid all reasonable SPDX consumers will not have a
problem with that information being absent unless they need it to accomplish
their goal. (In which case they cannot use your SPDX files, anyway.) If you
are using the tag-value format skipping the fields altogether will, i think,
prove problematic due to that format's stricter syntactic constraints. (Kate
or Gary, can you confirm this?)
[1]:
https://bugs.linuxfoundation.org/enter_bug.cgi?product=SPDX&component=Spec
Peter
PS: I am cc-ing the technical working group because it's participants are
best suited to answer these sorts of issues.
_______________________________________________
Spdx-tech mailing list
Spdx-tech@...
https://lists.spdx.org/mailman/listinfo/spdx-tech
De : Gary O'Neall [mailto:gary@...]
Envoyé : mardi 12 juin 2012 19:29
À : 'Peter Williams'; RUFFIN, MICHEL (MICHEL)
Cc : spdx-tech@...; spdx@...
Objet : RE: Import and export function of SPDX
I believe the current SPDX tools will treat both RDF and Tag/Value in the
same manner - the documents will be readable by the tools but it will fail a
validation (missing required field). For the command line tools, the
conversions or pretty printing will still work but you will get warning.
In terms of making the fields optional - I can see this as a valuable change
for some of the use cases where that information is not available. There is
need to make sure the components described in the SPDX file match the actual
file artifacts, but that need can be filled by the per-file information.
Michel - Which use case best describes your use of SPDX
(http://spdx.org/wiki/spdx-20-use-cases). If there isn't a good
representation of your use case(s), could you provide a brief description?
I want to make sure we cover this when working on SPDX 2.0.
Thanks,
Gary
-----Original Message-----
From: spdx-tech-bounces@...
[mailto:spdx-tech-bounces@...] On Behalf Of Peter Williams
Sent: Tuesday, June 12, 2012 9:27 AM
To: RUFFIN, MICHEL (MICHEL)
Cc: spdx-tech@...; spdx@...
Subject: Re: Import and export function of SPDX
On Tue Jun 12 06:02:03 2012, RUFFIN, MICHEL (MICHEL) wrote:
We have an issue with 2 fields that do not exist in our database.: theI think making those fields optional would be advantageous. Would you mind
name of the archive file and the checksum. In the SPDX standard they
are mandatory and I do not see why would it be possibly to make them
optional?
filing a bug[1] so that we don't forget to look into the issue for the next
version.
As for your immediate issues of not having data for those fields, if you are
using RDF i'd just skip them altogether in the SPDX file. While your file
will technically be invalid all reasonable SPDX consumers will not have a
problem with that information being absent unless they need it to accomplish
their goal. (In which case they cannot use your SPDX files, anyway.) If you
are using the tag-value format skipping the fields altogether will, i think,
prove problematic due to that format's stricter syntactic constraints. (Kate
or Gary, can you confirm this?)
[1]:
https://bugs.linuxfoundation.org/enter_bug.cgi?product=SPDX&component=Spec
Peter
PS: I am cc-ing the technical working group because it's participants are
best suited to answer these sorts of issues.
_______________________________________________
Spdx-tech mailing list
Spdx-tech@...
https://lists.spdx.org/mailman/listinfo/spdx-tech