< General Meeting‎ | Minutes

·         Attendance: 15

·         Lead by Phil Odence

·         Minutes of Dec meeting approved 

Contents

 [hide] 

·         1 Guest Presentation, JC Herz

·         2 Tech Team Report - Kate/Gary

·         3 Legal Team Report - Jilayne

·         4 Outreach Team Report

·         5 Attendees

·         Background

·         Years of working with companies and DOD in open source

·         The Issues/concerns

·         License issues- SPDX handles well

·         Concerns about security close on the heels

·         Compliance is an additional step- Jumping through the hoops to document

·         SEVA Software Evidence Archive

·         Elements

·         Serves S-BOM function

·         Augments with content that needs to travel with software

·         Therefore allowing compliance work to be automated

·         Freeing up valuable resources to do what they are supposed to do

·         Can apply to a single component or a full application, so SEVA doesn’t distinguish

·         Format Issue

·         Customers required XML, beyond SEVA JSON

·         To be useable by a highly secure facility, data has to be hardened for which XML is better suited

·         Can be constrained and format can be verified (and extended)

·         SPDX and SEVA Overlap

·         License Info

·         For the most part SPDX handles beautifully

·         Government also needs to distinguish government open source

·         A little more information about state of software (e.g. pre-release)

·         Security extra needs

·         Some concern about spurious vulnerabilities

·         Answer is to extend a BoM to include patch info, etc

·         End of life indicator

·         They take SPDX familiar thing and provide some extensibility

·         How to name “supplier”?

·         Working with Kate 

·         OSS organization for example

·         A bank’s black list

·         Vulnerabilities

·         Key requirement for vulnerabilities info in SBOM, although just a link might make more sense

·         Reason is “audit” function. What you knew when. So needs a time stamp.

·         Bureaucratic are not going to change in favor of something that makes more sense for developers 

·         Concerns that this will get worse over time

·         Other Side - Logistics

·         Moving and shipping of SW/chain of custody- Where did it come from exactly

·         Not something OSS community has had to worry about

·         Bad mirror issue, for example.

·         Signed? Timestamp? Delivery date and time for software.

·         Something like FedEx analogy

·         Package URL helps identify

·         Q&A

·         What can SPDX group do?

·         JC thinks that they should open source SEVA

·         Could contribute to LinuxF perhaps

·         Understand and need to balance needs of OSS consumers and dev communities

·         Don’t want to burden them

·         Automate

·         Challenge- How to distinguish enterprise quality OSS vs. pet projects

·         Tools

·         Starting to plan for GSoC submissions with Gary/Kate

·         Steve has been trained on releasing License list, so Gary now has backup

·         Steve has been working on some new tools for summarizing the SPDX_license_ids based on a new SPDX go library - currently its just supporting TV, but he hopes to add in the other formats

·         Specification

·         Gary & James have been working through SeVA XML and working through how it can be added.

·         License List

·         V3.4 out before Christmas

·         Big success to not have to scramble through holidays

·         Release notes in the GitHub repo

·         Instructions for requesting now live in Repo as well

·         Leverage GSOC work has been automated.

·         New frontier- Getting open hardware licenses on list

·         Expanding definition of what goes on the list

·         None this month

·         Phil Odence, Black Duck/Synopsys

·         Kate Stewart, Linux Foundation

·         Jilayne Lovejoy

·         Steve Winslow, LF

·         Alexios Zavras, Intel

·         Luis Villa, Tidelift

·         Jams Neushal, Neushul Solutions

·         Matthew Crawford, ARM

·         Kevin Nelson, Optim Tech UHG

·         Dennis Clark, NexB

·         Thomas Steenbergen, HERE

·         Bradlee Edmondson, Harvard

·         Gary O’Neall, SourceAuditor

·         Nicholas Toussaint, Orange

·         JC Herz, Ionchannel

Apologies for the extra email, but someone kindly pointed out an error on my part. The correct time for the General Meeting is 16:00 UTC.

Meeting Time: Thurs, Jan 3, 8am PT / 10 am CT / 11am ET / 16:00 UTC. 

Re-reminding now that most folks are back from the holidays.

Hello, all. Wishing the best to you for the holidays. As many will have time off between now and the New Year.

A new direction from SPDX is to expand into handling security information in addition to license and copyrights. JCC Herz will be talking about this in in the Jan 3 meeting. JC is the COO of Ion Channel, a software supply chain assurance and software logistics platform. JC co-wrote open source acquisition policy for the Defense Department in the mid-2000’s to curtail vendor-driven FUD about OSS, and has worked in large-scale enterprises to accelerate and enable verification, audit and continuous assurance of OSS for mission critical applications. 

Here's what she’ll be talking about-

“Evolving SPDX for Open Source Security: Lessons Learned from the Software Evidence Archive (SEVA)”

In the early days of enterprise OSS use, corporate concern tended to stem from licensing status, and SPDX operationalizes and automates risk management in that domain. As concerns around OSS have shifted towards security and supply chain risk, there are enterprise workflows for security approval, audit and compliance that require more and different details to augment transitive dependencies and licensing - some of which are not immediately obvious to developer communities outside the bureaucracies where these workflows exist. In the development of the SEVA (Software Evidence Archive), Ion Channel needed to augment the content of a standard SBOM with security, audit and compliance fields to satisfy the security, audit and compliance requirements of large IT bureaucracies in an an automated fashion. Because of large and escalating regulatory requirements for security, audit and compliance, these workflows are not going away. To that end, Ion Channel seeks to support SPDX with an open source XML implementation that includes these fields, so that large regulated customers can more easily adopt, maintain and update OSS applications and components. 

GENERAL MEETING

Meeting Time: Thurs, Jan 3, 8am PDT / 10 am CDT / 11am EDT / 15:00 UTC. http://www.timeanddate.com/worldclock/converter.html

Conf call dial-in:

New dial in number: 415-881-1586

No PIN needed

The weblink for screenshare will stay the same at: 
http://uberconference.com/SPDXTeam

Administrative Agenda

Attendance

Minutes Approval: https://wiki.spdx.org/view/General_Meeting/Minutes/2018-12-06

Guest Speaker  – JC Herz

Technical Team Report – Kate/Gary

Legal Team Report – Jilayne/Paul

Outreach Team Report – Jack

Any Cross Functional Issues –All

L. Philip Odence
General Manager, Black Duck On-Demand
Synopsys Software Integrity Group
800 District Avenue, Suite 101, Burlington, MA 01803-5061
Note new work #: W: +1.781.313.6801; M: +1.781.258.9502

www.blackducksoftware.com  

Re-reminding now that most folks are back from the holidays.

Hello, all. Wishing the best to you for the holidays. As many will have time off between now and the New Year.

A new direction from SPDX is to expand into handling security information in addition to license and copyrights. JCC Herz will be talking about this in in the Jan 3 meeting. JC is the COO of Ion Channel, a software supply chain assurance and software logistics platform. JC co-wrote open source acquisition policy for the Defense Department in the mid-2000’s to curtail vendor-driven FUD about OSS, and has worked in large-scale enterprises to accelerate and enable verification, audit and continuous assurance of OSS for mission critical applications. 

Here's what she’ll be talking about-

“Evolving SPDX for Open Source Security: Lessons Learned from the Software Evidence Archive (SEVA)”

In the early days of enterprise OSS use, corporate concern tended to stem from licensing status, and SPDX operationalizes and automates risk management in that domain. As concerns around OSS have shifted towards security and supply chain risk, there are enterprise workflows for security approval, audit and compliance that require more and different details to augment transitive dependencies and licensing - some of which are not immediately obvious to developer communities outside the bureaucracies where these workflows exist. In the development of the SEVA (Software Evidence Archive), Ion Channel needed to augment the content of a standard SBOM with security, audit and compliance fields to satisfy the security, audit and compliance requirements of large IT bureaucracies in an an automated fashion. Because of large and escalating regulatory requirements for security, audit and compliance, these workflows are not going away. To that end, Ion Channel seeks to support SPDX with an open source XML implementation that includes these fields, so that large regulated customers can more easily adopt, maintain and update OSS applications and components. 

GENERAL MEETING

Meeting Time: Thurs, Jan 3, 8am PDT / 10 am CDT / 11am EDT / 15:00 UTC. http://www.timeanddate.com/worldclock/converter.html

Conf call dial-in:

New dial in number: 415-881-1586

No PIN needed

The weblink for screenshare will stay the same at: 
http://uberconference.com/SPDXTeam

Administrative Agenda

Attendance

Minutes Approval: https://wiki.spdx.org/view/General_Meeting/Minutes/2018-12-06

Guest Speaker  – JC Herz

Technical Team Report – Kate/Gary

Legal Team Report – Jilayne/Paul

Outreach Team Report – Jack

Any Cross Functional Issues –All

L. Philip Odence
General Manager, Black Duck On-Demand
Synopsys Software Integrity Group
800 District Avenue, Suite 101, Burlington, MA 01803-5061
Note new work #: W: +1.781.313.6801; M: +1.781.258.9502

www.blackducksoftware.com  

Hello, all. Wishing the best to you for the holidays. As many will have time off between now and the New Year.

A new direction from SPDX is to expand into handling security information in addition to license and copyrights. JCC Herz will be talking about this in in the Jan 3 meeting. JC is the COO of Ion Channel, a software supply chain assurance and software logistics platform. JC co-wrote open source acquisition policy for the Defense Department in the mid-2000’s to curtail vendor-driven FUD about OSS, and has worked in large-scale enterprises to accelerate and enable verification, audit and continuous assurance of OSS for mission critical applications. 

Here's what she’ll be talking about-

“Evolving SPDX for Open Source Security: Lessons Learned from the Software Evidence Archive (SEVA)”

In the early days of enterprise OSS use, corporate concern tended to stem from licensing status, and SPDX operationalizes and automates risk management in that domain. As concerns around OSS have shifted towards security and supply chain risk, there are enterprise workflows for security approval, audit and compliance that require more and different details to augment transitive dependencies and licensing - some of which are not immediately obvious to developer communities outside the bureaucracies where these workflows exist. In the development of the SEVA (Software Evidence Archive), Ion Channel needed to augment the content of a standard SBOM with security, audit and compliance fields to satisfy the security, audit and compliance requirements of large IT bureaucracies in an an automated fashion. Because of large and escalating regulatory requirements for security, audit and compliance, these workflows are not going away. To that end, Ion Channel seeks to support SPDX with an open source XML implementation that includes these fields, so that large regulated customers can more easily adopt, maintain and update OSS applications and components. 

GENERAL MEETING

Meeting Time: Thurs, Jan 3, 8am PDT / 10 am CDT / 11am EDT / 15:00 UTC. http://www.timeanddate.com/worldclock/converter.html

Conf call dial-in:

New dial in number: 415-881-1586

No PIN needed

The weblink for screenshare will stay the same at: 
http://uberconference.com/SPDXTeam

Administrative Agenda

Attendance

Minutes Approval: https://wiki.spdx.org/view/General_Meeting/Minutes/2018-12-06

Guest Speaker  – JC Herz

Technical Team Report – Kate/Gary

Legal Team Report – Jilayne/Paul

Outreach Team Report – Jack

Any Cross Functional Issues –All

L. Philip Odence
General Manager, Black Duck On-Demand
Synopsys Software Integrity Group
800 District Avenue, Suite 101, Burlington, MA 01803-5061
Note new work #: W: +1.781.313.6801; M: +1.781.258.9502

www.blackducksoftware.com  

Meeting minutes from this month’s general meeting have been published at https://wiki.spdx.org/view/General_Meeting/Minutes/2018-12-06

Regards,
Gary

-------------------------------------------------

Gary O'Neall

Principal Consultant

Source Auditor Inc.

Mobile: 408.805.0586

Email: gary@...

https://wiki.spdx.org/view/General_Meeting/Minutes/2018-11-01 

< General Meeting‎ | Minutes

·         Attendance: 6

·         Lead by Phil Odence

·         Minutes of Oct meeting approved 

Contents

 [hide] 

·         1 Tech Team Report - Kate/Gary

·         2 Legal Team Report - Jilayne

·         3 Outreach Team Report - All

·         4 Attendees

·         Spec

·         Ceva discussions

·         Looking at fields that we might incorporate

·         Security

·         Evidence

·         Idea is to bring in as a separate section

·         Good Progress

·         Some discussions with NTIA Group as well

·         SWID

·         May start using the security mailing list soon

·         Tooling

·         Multiple formats

·         Challenges solves

·         XML, JSON, YAML, Tag value, RDF

·         Attention back to updating tooling with spec

·         Some concern about file sizes with certain packages/formats

·         May simply be an issue of LOTS of files

·         Generating License List 

·         Didn’t work perfectly

·         Giving another run

·         Updating tooling for license submittal/editing

·         A few bugs need to be worked around

·         There’s a fair backlog of issues to work through

·         Ongoing process

·         3.1 Is out

·         Started new practice of release notes

·         Tooling and new request system has to be nailed down

·         People are going through multiple paths/processes

·         Need to standardize

·         Tooling is close

·         Need a few more text fields

·         All submissions seem to come from Gary

·         License inclusion guidelines

·         Inbound request regarding open hardware languages

·         Already included open data license

·         May need to revisit inclusion guidelines

·         OSI discussion about naming issues with SPDX

·         Need to find opportunity for better collaboration 

·         Seems to be a lot more use of SPDX in the wild than we are aware of

·         How do we run down and catalog?

·         Wonder if it’s time for another poll

·         Last poll results: https://spdx.org/sites/cpstandard/files/pages/files/spdx_survey_results_may_2013.zip

·         Phil Odence, Black Duck/Synopsys

·         Kate Stewart, Linux Foundation

·         Gary O’Neall, SourceAuditor

·         Andrew Katz, Orcro

·         Jilayne Lovejoy

·         Steve Winslow, LF

No guest presentation this month, so anticipate a shorter meeting.

(I’m open to ideas for guest presentations.)

GENERAL MEETING

Meeting Time: Thurs, Nov 1, 8am PDT / 10 am CDT / 11am EDT / 15:00 UTC. http://www.timeanddate.com/worldclock/converter.html

Conf call dial-in:

New dial in number: 415-881-1586

No PIN needed

The weblink for screenshare will stay the same at: 
http://uberconference.com/SPDXTeam

Administrative Agenda

Attendance

Minutes Approval: https://wiki.spdx.org/view/General_Meeting/Minutes/2018-10-04

Technical Team Report – Kate/Gary

Legal Team Report – Jilayne/Paul

Outreach Team Report – Jack

Any Cross Functional Issues –All

L. Philip Odence
General Manager, Black Duck On-Demand
Synopsys Software Integrity Group
800 District Avenue, Suite 101, Burlington, MA 01803-5061
Note new work #: W: +1.781.313.6801; M: +1.781.258.9502

www.blackducksoftware.com  

https://wiki.spdx.org/view/General_Meeting/Minutes/2018-10-04

< General Meeting‎ | Minutes

·         Attendance: 8

·         Lead by Phil Odence

·         Minutes of Sept meeting approved 

Contents

 [hide] 

·         1 Tech Team Report - Kate/Gary

·         2 Legal Team Report - Jilayne

·         3 Outreach Team Report - Jack

·         4 Attendees

·         Spec

·         Focus on multiple formats

·         How do deal with XML, JSON, YAML

·         Proposal to link to software heritage identifies

·         SW heritage- presentation came out recently on how code should be ID’ed in repos

·         Seems to make sense to extend references to point to

·         General agreement on last tech call

·         Tooling

·         Got integrated on line tools up

·         License submittal

·         XML editor

·         Beta quality, ready to go. http://spdxtools.sourceauditor.com

·         GSOC has worked very well

·         Should thank Google

·         Post on Website

·         Could use some social media

·         Topic for Outreach 

·         May want to point projects to FSF software reuse site which advocates SPDX

·         Would be a good credibility builder

·         The link is on the site, but not easy to find

·         Other Groups

·         NTIA- Government group defining a BoM standard

·         Prototype work in health care

·         Fingers crossed that they will use SPDX

·         SWID

·         Active discussion

·         Mapping fields between SPDX an SW

·         Other groups may be able to use our use cases

·         They are wrestling with what is a components

·         Also, how a company can keep their own supplementary license list

·         Can do via a SPDX doc that is just licenses and make external reference to

·         Steve W will help out

·         New license backlog

·         Trying to clear out for next release

·         Looking forward to new tooling

·         Could use testing help

·         Need some Python help on the tools

·         Mostly fixing up formatting stuff

·         Little activity

·         Regrouping

·         Phil Odence, Black Duck/Synopsys

·         Kate Stewart, Linux Foundation

·         Gary O’Neall, SourceAuditor

·         Matthew Crawford, ARM

·         Jilayne Lovejoy, ARM

·         Jack Manbeck, TI

·         Steve Winslow, LF

·         Mark Atwood, Amazon

 No guest presentation this month, so anticipate a shorter meeting.

(I’m open to ideas for guest presentations.)

GENERAL MEETING

Meeting Time: Thurs, Oct 4, 8am PDT / 10 am CDT / 11am EDT / 15:00 UTC. http://www.timeanddate.com/worldclock/converter.html

Conf call dial-in:

New dial in number: 415-881-1586

No PIN needed

The weblink for screenshare will stay the same at: 
http://uberconference.com/SPDXTeam

Administrative Agenda

Attendance

Minutes Approval: https://wiki.spdx.org/view/General_Meeting/Minutes/2018-09-06

Technical Team Report – Kate/Gary

Legal Team Report – Jilayne/Paul

Outreach Team Report – Jack

Any Cross Functional Issues –All

L. Philip Odence
General Manager, Black Duck On-Demand
Synopsys Software Integrity Group
800 District Avenue, Suite 101, Burlington, MA 01803-5061
Note new work #: W: +1.781.313.6801; M: +1.781.258.9502

www.blackducksoftware.com  

This month’s guest speaker is Mark Gisi.  Many of you know Mark from his big contributions over the years to SPDX and OpenChaiun. He has a really interesting topic to share.

I’m disappointed that I have a conflict. One of the other SPDX Core Team Members will host.

Phil Odence

Abstract

-----------

The union of SPDX data and a blockchain ledger is a match made in heaven. This union enables us to provide both *accountability* and *access* to SPDX data for manufactured products that are comprised on software components contributed by dozens of suppliers. We will present a use case of how we track SPDX data (along with source code and notices)  across the manufacturing supply chain of a device running the Zephyr operating system runtime.

Bio

----

Mark Gisi, Directory of Intellectual Property and Open Source at Wind River Systems, has been managing Open Source policies and programs for the past 12 years. Mark contributes to the Linux Foundation’s SPDX project, OpenChain Project and the Hyperledger Project’s SParts (Software Parts) lab initiative. Mark holds a MS degree in Computer Science and a BS degree in Mathematics.

GENERAL MEETING

Meeting Time: Thurs, Sept 6, 8am PDT / 10 am CDT / 11am EDT / 15:00 UTC. http://www.timeanddate.com/worldclock/converter.html

Conf call dial-in:

New dial in number: 415-881-1586

No PIN needed

The weblink for screenshare will stay the same at: 
http://uberconference.com/SPDXTeam

Administrative Agenda

Attendance

Minutes Approval: https://wiki.spdx.org/view/General_Meeting/Minutes/2018-08-02

Guest Presentation – Mark

Technical Team Report – Kate/Gary

Legal Team Report – Jilayne/Paul

Outreach Team Report – Jack

Any Cross Functional Issues –All

https://wiki.spdx.org/view/General_Meeting/Minutes/2018-08-02

< General Meeting‎ | Minutes

·         Attendance: 12

·         Lead by Phil Odence

·         Minutes of July meeting approved 

Contents

 [hide] 

·         1 Guest Presentation, - Supporting Continuous Integration, Ndip Tanyi

·         2 Tech Team Report - Kate/Gary

·         3 Legal Team Report - Jilayne/Paul

·         4 Outreach Team Report - Jack

·         5 Attendees

·         Idea- Automatically generating SPDX docs as part of CI process

·         Scope

·         Focused on Travis CI, NPM and Python

·         Demo

·         Add an install and SPDX build script to build script

·         And some statements to push the SPDX docs to the repo

·         Future extensions

·         Pushing to GItHub as a commit

·         Other CI systems

·         Has been designed generically enough to be extensible to other languages and environments

·         Tooling

·         Mostly GSoC work

·         License XML Editor

·         Gary posting new version today  http://spdxtools.sourceauditor.com

·         If you want to test, make it clear that these are tests, to make clear in the pull requests

·         Spec work

·         Working for consistency in external identifiers

·         Interest coming up from security community

·         SWID

·         NTIA conference that featured SPDX

·         Working in interop and SPDX standardization

·         Looking at spinning up a security subgroup

·         Interest from US House and Senate in a SW BoM and SPDX is on the docket

·         NIST and other organizations are involved in the background 

·         3.2 is out

·         Some clean up of old issues in process

·         Request to that legal folks try out Tushar’s tool

·         Exceptions

·         The term is imperfect as it handles some items that are not “exceptions” per se

·         Patent grants, for example

·         Considering changing the term to be more neutral and inclusive

·         “Modifiers” maybe? 

·         Will send an email to a wide audience get people thinking about it and set up a special meeting

·         Website

·         Making more sense of the License List and Documents section

·         Shane Coughlin, from Open Chain, is getting involved

·         Outreach to companies

·         New time for Outreach calls is 7pm EDT

·         (Shane is in Japan)

·         OSS Summit

·         Backoff on the Tuesday

·         And a session on Consuming SPDX

·         Phil Odence, Black Duck/Synopsys

·         Ndip Tanyi, Alberta University

·         Tushar Mittal, GSoC Student

·         Gary O’Neall, SourceAuditor

·         Yash Nisar, GSoC Student

·         Jack Manbeck, TI

·         Steve Winslow, LF

·         Jilayne Lovejoy, ARM

·         Paul Madick, Dimension Data

·         Mike Dolan, Linux Foundation

·         Matije Suklje, Liferay

·         Mark Atwood, Amazon

This month’s guest speaker is one of our Google Summer of Code Students, Ndip Tanyi.  Originally from Cameroon where he did his undergraduate. He is currently enrolled in a masters degree in computer science at Alberta University. He is passionate about computer code and innovation as a whole.

Ndip will be speaking about his project, a build tool for SPDX file generation. The idea is to create plug-ins to support generating valid SPDX docs in continuous integration environments.

GENERAL MEETING

Meeting Time: Thurs, Aug, 8am PDT / 10 am CDT / 11am EDT / 15:00 UTC. http://www.timeanddate.com/worldclock/converter.html

Conf call dial-in:

New dial in number: 415-881-1586

No PIN needed

The weblink for screenshare will stay the same at: 
http://uberconference.com/SPDXTeam

Administrative Agenda

Attendance

Minutes Approval: https://wiki.spdx.org/view/General_Meeting/Minutes/2018-07-11

Guest Presentation – Ndip

Technical Team Report – Kate/Gary

Legal Team Report – Jilayne/Paul

Outreach Team Report – Jack

Cross Functional Issues –All