|
Yocto/OE SPDX Presentation at OSLS
Craig Northway
Hi SPDX Team,
Mark Charlebois and I will be presenting at OSLS on our recent efforts to produce SPDX to support the Dronecode project. We have started work to integrate one of our internal license scanning tools, LiD, into Yocto/OE based on the existing Fossology
bitbake integration. We plan to make our license scanning tool and our Yocto/OE integration available. We'll be presenting both on our scanning tool, and what we've learnt about how to best manage and author recipes to support license scanning and SPDX generation.
You'll find details on us and our presentation here:
I am also keen on joining any relevant SPDX tooling discussions on Thursday of the summit to discuss how we can collaborate further in this space.
Thanks,
Craig
|
|
|
|
Re: Open Source Leadership Summit (formerly known as Collab Summit)
Kate Stewart
Yes. We've got Thurs(16th)11:15am-5pm reserved for SPDX. More next week.... :-) Kate
On Thu, Jan 5, 2017 at 5:54 PM, J Lovejoy <opensource@...> wrote:
--
Kate Stewart Sr. Director of Strategic Programs, The Linux Foundation Mobile: +1.512.657.3669 Email / Google Talk: kstewart@...
|
|
|
|
Re: Open Source Leadership Summit (formerly known as Collab Summit)
J Lovejoy
Hi Jack,
toggle quoted messageShow quoted text
Kate is still out, but I believe we have a room on Thursday reserved :) Jilayne
|
|
|
|
Re: Open Source Leadership Summit (formerly known as Collab Summit)
Manbeck, Jack
Jilayne,
We spoke with Kate about it on the outreach call before the end of the year. She was checking with the Linux Foundation to see what the plans were. I agree a meeting room for one day would be good.
- Jack
From: spdx-bounces@... [mailto:spdx-bounces@...]
On Behalf Of J Lovejoy
Hi All,
I should have thought to raise this on the General call today, but do we have a room or plan to have some F2F working session at this year’s Open Source Leadership Summit (formerly Collab Summit) - http://events.linuxfoundation.org/events/open-source-leadership-summit on Feb 14-16 in Lake Tahoe, CA? We usually do, but it’s a better earlier in the year, so not quite on the radar yet!
We discussed it briefly on the legal call and agreed it would be good to have a F2F, but not sure what the plan is for having something official set up. As people need to make travel plans soon, thought I’d reach out via email. I am planning on being there, FWIW.
Cheers, Jilayne
|
|
|
|
Open Source Leadership Summit (formerly known as Collab Summit)
J Lovejoy
Hi All,
I should have thought to raise this on the General call today, but do we have a room or plan to have some F2F working session at this year’s Open Source Leadership Summit (formerly Collab Summit) - http://events.linuxfoundation.org/events/open-source-leadership-summit on Feb 14-16 in Lake Tahoe, CA? We usually do, but it’s a better earlier in the year, so not quite on the radar yet! We discussed it briefly on the legal call and agreed it would be good to have a F2F, but not sure what the plan is for having something official set up. As people need to make travel plans soon, thought I’d reach out via email. I am planning on being there, FWIW. Cheers, Jilayne
|
|
|
|
January SPDX General Meeting Minutes
Philip Odence
http://wiki.spdx.org/view/General_Meeting/Minutes/2017-01-05
General Meeting/Minutes/2017-01-05 < General Meeting | Minutes Jump to: navigation, search
Contents [hide]
Special Presentation- Georgia (Zeta) Kapitsaki[edit]
Cross Functional Topics - Phil[edit]
Tech Team Report - Kate/Gary[edit]
Legal Team Report - Jilayne/Paul[edit]
Outreach Team Report - Jack[edit]
Attendees[edit]
|
|
|
|
Thursday SPDX General Meeting Reminder (with special guest)
Philip Odence
This will be a particularly interesting General Meeting. In addition to our normal team reporting, we will have two special topics: · A presentation from Georgia (Zeta) Kapitsaki on her research using SPDX at the Univ of Cyprus · Review of 2017 annual goals for SPDX by the Core Team
GENERAL MEETING
Meeting Time: Thurs, Jan 5, 8am PDT / 10 am CDT / 11am EDT / 15:00 UTC. http://www.timeanddate.com/worldclock/converter.html
Join the call: https://www.uberconference.com/katestewart Optional dial in number: 877-297-7470 Alternate number: 512-910-4433 No PIN needed
Administrative Agenda Attendance Minutes Approval http://wiki.spdx.org/view/General_Meeting/Minutes/2016-12-01
Special Presentation– Georgia (Zeta) Kapitsaki License compatibilities and relevant tool in the framework of SPDX
Cross Functional Issues – Phil/All Annual Goals · Roll out github-maintainable XML license templates · Define and approach to creating notice files from an SPDX doc · Develop a web-based license match tool · Implement tool to score a project’s licensing quality · Gain Apache/Eclipse Foundation adoption · Sponsor a Google Summer of Code Project · Conduct a supply chain management survey · Build “whole product” around the spec—what is required for adoption · Deploy existing SPDX group tools on web · Develop a github plug-in to generate an SPDX doc
Technical Team Report – Kate/Gary
Legal Team Report – Jilayne/Paul
Business Team Report – Jack
Topic: License compatibilities and relevant tool in the framework of SPDX Licensing decisions for new Open Source Software are not always straightforward. However, the license that accompanies the software is important as it largely affects its subsequent distribution and reuse. License information for software products is captured - among other data - in the Software Package Data Exchange (SPDX) files. I will talk briefly about our research work and our tool for the validation of SPDX files regarding proper license use. Software packages described in SPDX format are examined in order to detect license violations that may occur when a product combines different software sources that carry different and potentially contradicting licenses. The SPDX License Validation Tool (SLVT) gives the opportunity to check the compatibility of one or more SPDX files.
Brief biography: Assistant Professor at the Department of Computer Science of the University of Cyprus (UCY) and faculty member of the Software Engineering and Internet Technologies (SEIT) laboratory in UCY. She received her PhD from the National Technical University of Athens, Greece (2009). Her research interests include: software engineering, service-oriented computing, open source software reuse and privacy enhancing technologies. She has published over 40 papers in international conferences and journals, has participated in conference organisation (e.g. ICSR 2016) and has served as a TPC member and referee in repudiated journals and conferences. She has been involved in EU FP6 and FP7 projects and has worked as a software engineer in the industry.
|
|
|
|
FW: Minutes from SPDX Dec General Meeting
Philip Odence
http://wiki.spdx.org/view/General_Meeting/Minutes/2016-12-01
General Meeting/Minutes/2016-12-01 < General Meeting | Minutes Jump to: navigation, search
Contents [hide]
Tech Team Report - Kate/Gary[edit]
Legal Team Report - Jilayne/Paul[edit]
Outreach Team Report - Jack[edit]
Cross Functional Topics - Phil[edit] Attendees[edit]
|
|
|
|
Thursday SPDX General Meeting
Philip Odence
Special Discussion, 2017 Goals- Please bring your thoughts about goals for next year. After each update, team leads will facilitate some brainstorming on this subject. The Core Team will finalize and announce formal goal at the January 5 General Meeting.
GENERAL MEETING
Meeting Time: Thurs, Dec 1, 8am PDT / 10 am CDT / 11am EDT / 15:00 UTC. http://www.timeanddate.com/worldclock/converter.html
Join the call: https://www.uberconference.com/katestewart Optional dial in number: 877-297-7470 Alternate number: 512-910-4433 No PIN needed
Administrative Agenda Attendance Minutes Approval http://wiki.spdx.org/view/General_Meeting/Minutes/2016-11-03
Technical Team Report – Kate/Gary
Legal Team Report – Jilayne/Paul
Business Team Report – Jack
Cross Functional Issues – Phil
|
|
|
|
Minutes from November SPDX General Meeting
Philip Odence
Thanks again to Lei from Fujitsu for an interesting presentation!
General Meeting/Minutes/2016-11-03 < General Meeting | Minutes Jump to: navigation, search • Attendance: 12 • Lead by Phil Odence • Minutes of Sept meeting approved (Oct meeting was cancelled due to LinuxCon Europe)
Contents [hide] 1 Special Guest - Lei Mao Hui, Fujitsu 2 Tech Team Report - Kate/Gary 3 Legal Team Report - Jilayne/Paul 4 Outreach Team Report - Jack 5 Cross Functional Topics - Phil 6 Attendees Special Guest - Lei Mao Hui, Fujitsu[edit] • Lei • Working for Fujitu • Developing on house Distro • Spoke at ALS and Linux Conference about experience with SPDXX • Reason Fujitsu needs SPDX • Want an SPDX file for all their packages • Customers ofter require license info • Released under GPL3, but includes software under other license as well. Many! • MIT, BSD, GPL2, etc. • SPDX is good for this purpose • So they added into production Development • Yocto SPDX • Lucky for them that Yocto supports SPDX • But the activity on Yocto SPDX has been slow • Found some issues when using • Only supports SPDX 1.1 • Doesn’t do a great job even with that • Is complex to use; takes a long time • May introduce license conflicts • In the end you can download the SPDX • Fujitsu’s contributions to Yocto SPDX • So they did some work to improve: • Created a patch to upgrade to SPDX 1.2 • Unfortunately was never accepted into Yocto • Would like to upgrade to SPDX 2.0 • And to improve performance • Has been working on some of the SPDX open source tools • including DoSocks developed by UNO • Lei has been continuing to submit improvements to Yocto • Improved performance • Currently discussing more improvements with Yocto • Will be continuing to improve and to upgrade to SPDX 2.1 • Question • Has yocto been receptive? • Yocto has not been active or focused on SPDX. • Some people have been interested • Not sure why they are not interested • Kate will help and follow up Tech Team Report - Kate/Gary[edit] • Spec • SPDX 2.1 is now released and official • Starting to focus on use cases and tooling • last call was a joint call with the Legal Team • Templetazation focus • Agreed on interfaces between teams • Tooling • Incorporated results from the bake off • Overall, everyone at the bake off got good feedback, leading to improvement of all tools • XML Format • Legal Team has been working on new format for license templates • Makes it easier for multiple contributors • Working now on making it consumable for external tools • Really good progress • Should have draft standards in the next month or two.
Legal Team Report - Jilayne/Paul[edit] • Joint Call with Tech Team • Worked on syncing tag names to be consistent with spec • Went really well • License List • Business as usual with new licenses • More license requests for licenses in other languages • Probably need to have a discussion about how to handle consistently
Outreach Team Report - Jack[edit] • Website • New site is up • Jack’s in process of posting new stuff • Next agenda • Working on new docs, templates, etc • Mostly to help explain aspects of how to use • Trying to assemble list of topics and then prioritize • Very open to ideas
Cross Functional Topics - Phil[edit] • Future topic - Will be a discussion of license in different languages • Legal Team will come forward with a strawman. A few months out. • Guest stars • Always looking for more
Attendees[edit] • Phil Odence, Black Duck • Lei Mao Hui, Fujitsu • Kate Stewart, Linux Foundation • Jilayne Lovejoy, ARM • Yev Bronshteyn, Black Duck • Scott Sterling, Palamida • Paul Madick, Dimension Data • Gary O’Neill, SourceAuditor • Tarek Jamal, ARM • Mark Gisi, Wind River • Jack Manbeck, TI • Alexios Zavras, Intel • NewPP limit report CPU time usage: 0.009 seconds Real time usage: 0.010 seconds Preprocessor visited node count: 23/1000000 Preprocessor generated node count: 28/1000000 Post‐expand include size: 0/2097152 bytes Template argument size: 0/2097152 bytes Highest expansion depth: 2/40 Expensive parser function count: 0/100 Saved in parser cache with key spdx_mwiki:pcache:idhash:1065-0!*!*!!en!*!* and timestamp 20161103153915 and revision id 4059
|
|
|
|
SPDX General Meeting Late Reminder
Philip Odence
The call is kicking off now. The highlight will be a presentation from Lei at Fujitsu. Please join us. Sorry for the late reminder
|
|
|
|
Re: SPDX Bake off to compare tools generating code for the SPDX 2.1 specification on October 6, 2016.
Sam Ellis <Sam.Ellis@...>
Hi,
Whilst preparing for SPDX bakeoff I noticed a few issues with my interpretation of the specification that may be worth discussion.
Firstly a number of fields in tag files contain arbitrary text enclosed within <text>...</text> tags. I found examples where the text I am including within these tags does itself contain HTML/XML tags from the source document. The inclusion of non-SPDX tags within the <text> tags makes it hard to spot the end of the </text>. This raises the question of whether the text within <text> tags ought to be escaped in some way? I did not find anything on this point in the SPDX specification (apologies if I missed anything).
Secondly, I noticed that in the tag field PackageLicenseInfoFromFiles I am including license exceptions, for example:
PackageLicenseInfoFromFiles: Classpath-exception-2.0
However, I think my use is incorrect. The spec says a license identifier is needed here, and a license exception identifier is not a license identifier. I cannot alternatively use "license WITH exception" here because this is an expression not a license identifier. This raises the question, how should exceptions be represented in PackageLicenseInfoFromFiles, if at all?
I appreciate your thoughts on these issues.
From: spdx-tech-bounces@... [mailto:spdx-tech-bounces@...]
On Behalf Of Kate Stewart
Hi, The SPDX tech team will be hosting an SPDX Tools BakeOff at LinuxCon Europe on 6 October 2016. Participation can be remote by phone or in person. The Bake-off (also known by some as a Plugfest) will focus on comparing SPDX Documents generated with SPDX specification 2.1 features along with answering any questions people may have about the new revision. For more information on how to participate, please read Background info for the SPDX 2.1 Bake-off in LinuxCon Europe. If you have questions, please send email to spdx-tech@... Thanks on behalf of the SPDX tech team, Gary & Kate
|
|
|
|
Re: SPDX Bake off to compare tools generating code for the SPDX 2.1 specification on October 6, 2016.
Kate Stewart
Hi Bradley, On Thu, Sep 22, 2016 at 5:30 PM, Bradley M. Kuhn <bkuhn@...> wrote: Kate, There are no licensing requirements for tools themselves to participate in the bake-off, the only requirement is that they are able to produce (and ideally consume) valid SPDX files. We're pleased that FOSSology is going to participate for the first time in one of our bake-off's in Berlin, which is a tool I believe you use already. We've also got listed the community supported tools as well as the commercial tools we know about on our web site, if you want to see the possible participants. All tools (even if they are not listed on the site) are welcome. Hope this helps, Kate
|
|
|
|
SPDX Bake off to compare tools generating code for the SPDX 2.1 specification on October 6, 2016.
Kate Stewart
Hi, The SPDX tech team will be hosting an SPDX Tools BakeOff at LinuxCon Europe on 6 October 2016. Participation can be remote by phone or in person. The Bake-off (also known by some as a Plugfest) will focus on comparing SPDX Documents generated with SPDX specification 2.1 features along with answering any questions people may have about the new revision. For more information on how to participate, please read Background info for the SPDX 2.1 Bake-off in LinuxCon Europe. If you have questions, please send email to spdx-tech@... Thanks on behalf of the SPDX tech team, Gary & Kate
|
|
|
|
Re: SPDX RDF visualization
STAIR, MICHAEL A
Thank you for the suggestions Yev, I will give them a try!
Mike
From: Yev Bronshteyn <ybronshteyn@...>
A slight correction to the above – the sparql query in my previous email may be too simplistic in that it does not include files that are inside of packages (as package contents are not necessarily described with relationships).
This should produce the graph of both relationships and file contents:
prefix spdx: <http://spdx.org/rdf/terms#>
construct { ?sub ?pred ?obj . ?sub2 spdx:hasFile ?file} where { ?sub spdx:relationship ?rel . ?rel spdx:relationshipType ?pred . ?rel spdx:relatedSpdxElement ?obj . ?sub2 spdx:hasFile ?file .
} From: <spdx-bounces@...> on behalf of Yev Bronshteyn <ybronshteyn@...>
Hi, Michael,
I don’t know much about RDF graphing tools, but here’s a trick to make any tool you already have produce a better graph.
You can use this sparql query to reduce an SPDX document to an RDF where every relationship is reduced to a single triple:
prefix spdx: <http://spdx.org/rdf/terms#>
construct { ?sub ?pred ?obj } where { ?sub spdx:relationship ?rel . ?rel spdx:relationshipType ?pred . ?rel spdx:relatedSpdxElement ?obj . }
Here’s how you can apply this query with Apache Jena:
1. Load your spdx document into Jena’s triple store: tdbloader --loc=data mydoc.rdf
In the example above, “data” is an empty directory where you have write access (where Jena will build its datastore) and mydoc.rdf is your SPDX document.
2. Apply the query, which in this example is loaded into “relConcat.sparql”. Pipe the results into a file.
The resulting RDF should be a much more straightforward graph of all the relationsips.
From: <spdx-bounces@...> on behalf of "STAIR, MICHAEL A" <ms1784@...>
Hello,
I was wondering if anyone can suggest a tool to visually in a graph (ideally interactive) SPDX RDF files, specifically to follow relationships? I am currently using gruff (http://franz.com/agraph/gruff/) , but it’s a little tedious. Thanks.
Mike _____________________________
|
|
|
|
Re: SPDX RDF visualization
Yev Bronshteyn
A slight correction to the above – the sparql query in my previous email may be too simplistic in that it does not include files that are inside of packages (as package contents are not necessarily described with relationships).
This should produce the graph of both relationships and file contents:
prefix spdx: <http://spdx.org/rdf/terms#>
construct { ?sub ?pred ?obj . ?sub2 spdx:hasFile ?file} where { ?sub spdx:relationship ?rel . ?rel spdx:relationshipType ?pred . ?rel spdx:relatedSpdxElement ?obj . ?sub2 spdx:hasFile ?file .
} From: <spdx-bounces@...> on behalf of Yev Bronshteyn <ybronshteyn@...>
Hi, Michael,
I don’t know much about RDF graphing tools, but here’s a trick to make any tool you already have produce a better graph.
You can use this sparql query to reduce an SPDX document to an RDF where every relationship is reduced to a single triple:
prefix spdx: <http://spdx.org/rdf/terms#>
construct { ?sub ?pred ?obj } where { ?sub spdx:relationship ?rel . ?rel spdx:relationshipType ?pred . ?rel spdx:relatedSpdxElement ?obj . }
Here’s how you can apply this query with Apache Jena:
1. Load your spdx document into Jena’s triple store: tdbloader --loc=data mydoc.rdf
In the example above, “data” is an empty directory where you have write access (where Jena will build its datastore) and mydoc.rdf is your SPDX document.
2. Apply the query, which in this example is loaded into “relConcat.sparql”. Pipe the results into a file.
The resulting RDF should be a much more straightforward graph of all the relationsips.
From: <spdx-bounces@...> on behalf of "STAIR, MICHAEL A" <ms1784@...>
Hello,
I was wondering if anyone can suggest a tool to visually in a graph (ideally interactive) SPDX RDF files, specifically to follow relationships? I am currently using gruff (http://franz.com/agraph/gruff/) , but it’s a little tedious. Thanks.
Mike _____________________________
|
|
|
|
Re: SPDX RDF visualization
Yev Bronshteyn
Hi, Michael,
I don’t know much about RDF graphing tools, but here’s a trick to make any tool you already have produce a better graph.
You can use this sparql query to reduce an SPDX document to an RDF where every relationship is reduced to a single triple:
prefix spdx: <http://spdx.org/rdf/terms#>
construct { ?sub ?pred ?obj } where { ?sub spdx:relationship ?rel . ?rel spdx:relationshipType ?pred . ?rel spdx:relatedSpdxElement ?obj . }
Here’s how you can apply this query with Apache Jena:
1. Load your spdx document into Jena’s triple store: tdbloader --loc=data mydoc.rdf
In the example above, “data” is an empty directory where you have write access (where Jena will build its datastore) and mydoc.rdf is your SPDX document.
2. Apply the query, which in this example is loaded into “relConcat.sparql”. Pipe the results into a file.
The resulting RDF should be a much more straightforward graph of all the relationsips.
From: <spdx-bounces@...> on behalf of "STAIR, MICHAEL A" <ms1784@...>
Hello,
I was wondering if anyone can suggest a tool to visually in a graph (ideally interactive) SPDX RDF files, specifically to follow relationships? I am currently using gruff (http://franz.com/agraph/gruff/) , but it’s a little tedious. Thanks.
Mike _____________________________
|
|
|
|
SPDX RDF visualization
STAIR, MICHAEL A
Hello,
I was wondering if anyone can suggest a tool to visually in a graph (ideally interactive) SPDX RDF files, specifically to follow relationships? I am currently using gruff (http://franz.com/agraph/gruff/) , but it’s a little tedious. Thanks.
Mike _____________________________
|
|
|
|
Canceled: SPDX General Meeting
Philip Odence
Cancelling the October meeting as it conflicts with LinuxCon Europe.
We will have a special presentation for the November meeting on OpenChain.
*******
Join the call: https://www.uberconference.com/katestewart Optional dial in number: 877-297-7470 Alternate number: 512-910-4433 No PIN needed
|
|
|
|
Re: SPDX Tool Contributions
Gary O'Neall
Hi Michael,
Glad to hear of your interest in contributing to the tools. We can discuss on the next tech call, but feel free to contribute issues and pull requests on GitHub. The only request is on the pull requests to include a statement that you contributions are made available under the Apache 2.0 license. Thanks, Gary On September 1, 2016 12:17:58 PM CDT, "STAIR, MICHAEL A" <ms1784@...> wrote:
-- Sent from my Android phone with K-9 Mail. Please excuse my brevity.
|
|
|