spdx@lists.spdx.org

Re: End Of Life Tag in spdx #spdx

Armijn Hemel - Tjaldur Software Governance Solutions

hello,

I would suggest to keep this information "out of band" and not inside SPDX documents. Current information inside SPDX documents is largely static: package, license, checksum, and so on. Of course there could have been errors that need to be fixed, but overall these fields are static.

EOL information, commercial status and support status on the other hand are much more dynamic. Sometimes packages are supported for only a few hours, sometimes for decades. Very often it is also not clear when a package is EOL or supported as many authors/maintainers do not announce it. The support is sometimes also not done by the author/maintainers, but by an external entity (for example: enterprise grade Linux distributions). Does this mean it is supported, or only supported for people willing to pay for it, or .... ? It is simply not clear and it adds a lot of fuzziness.

This would make SPDX a lot more cumbersome, as not only do the documents need to be generated, but they also need to be updated all the time to avoid falling out of sync. It also mixes syntax and semantics, which is never a good idea.

armijn

Kate and Sandeep,

Our customers are also interested in this information. There are two concepts to consider:

Commercial Status:

        <enumeration value="Available"></enumeration>

        <enumeration value="Retired"></enumeration>

        <enumeration value="EOL"></enumeration>

        <enumeration value="BetaTest"></enumeration>

        <enumeration value="Pilot"></enumeration>

        <enumeration value="Abandoned"></enumeration>

Support Status:
        <enumeration value="Supported"></enumeration>
        <enumeration value="Unsupported"></enumeration>
        <enumeration value="Community"></enumeration>
Both are described in the open-source Vendor Response File (VRF) XML schema available here: https://raw.githubusercontent.com/rjb4standards/REA-Products/master/SAGVendorSchema.xsd

Thanks,

Dick Brooks

Active Member of the CISA Critical Manufacturing Sector,

Sector Coordinating Council – A Public-Private Partnership

Never trust software, always verify and report! ™

http://www.reliableenergyanalytics.com

Email: dick@...

Tel: +1 978-696-1788

From: spdx@... <spdx@...> On Behalf Of Kate Stewart
Sent: Friday, May 6, 2022 3:34 PM
To: SPDX-general <spdx@...>
Subject: Re: [spdx] End Of Life Tag in spdx #spdx

Hi Sandeep,

There is a pull request expected shortly from the Usage profile team, to add this specific field to 2.3.

When it comes in, please feel free to review and make sure it's going to suffice for your needs.

For now, with 2.2 documents, suggest you use the Package Comment field (https://spdx.github.io/spdx-spec/package-information/#720-package-comment-field) and standardize on a tag (like EndOfSupport: ) and the date.

Will that work for now?

Thanks,
Kate

On Fri, May 6, 2022 at 2:27 PM Patil, Sandeep via lists.spdx.org <sandeep.patil=philips.com@...> wrote:

Hi All,
We have requirement to specify End Of Life as part of package information in SBoM ,
Is there way current SPDX format support this ?

Regards
Sandeep

-- 
Armijn Hemel, MSc
Tjaldur Software Governance Solutions

Re: SPDXID #spdx

Gary O'Neall

#1521

Hi Sandeep,

Although the SPDX ID is internal to SPDX documents, you can refer to an SPDX ID in a different document using the SPDX Document identifier as defined in section 6.6. So the statement below is accurate but could probably be made a bit clearer.

Regards,
Gary

Show quoted text

From: spdx@... <spdx@...> On Behalf Of Patil, Sandeep via lists.spdx.org
Sent: Monday, May 16, 2022 11:44 PM
To: spdx@...
Subject: Re: [spdx] SPDXID #spdx

Hi Gary,
Thanks for reply, then SPDXID will be mostly internal ID and can not be referenced externally, Do you think this might need some change in SPDXID documentation statement ?

"Uniquely identify any element in an SPDX document which may be referenced by other elements. These may be referenced internally and externally with the addition of the SPDX document identifier."

Regards
Sandeep

Re: SPDXID #spdx

Patil, Sandeep

#1520

Hi Gary,
Thanks for reply, then SPDXID will be mostly internal ID and can not be referenced externally, Do you think this might need some change in SPDXID documentation statement ?

"Uniquely identify any element in an SPDX document which may be referenced by other elements. These may be referenced internally and externally with the addition of the SPDX document identifier."

Regards
Sandeep

FYI: SPDX in the OpenSSF Mobilization Plan

VM (Vicky) Brasseur

#1519

Some of you probably know that OpenSSF met with a bunch of US Federal organizations in Washington DC last week to discuss cyber security wrt the open source software supply chain. (our own Kate and William were there!)

Prior to that meeting, the OpenSSF community prepared a “mobilization plan” to present to the Feds, detailing ten areas where they feel they can make improvements to the security of the overall ecosystem. The ninth area is “SBOMs Everywhere” and specifically calls for working with SPDX.

You can download the complete plan here: https://openssf.org/oss-security-mobilization-plan/

--V

--

VM (Vicky) Brasseur

Director, Senior Strategy Advisor

Open Source Program Office

Wipro Limited

⏰ Time Zone: Pacific/West Coast US

'The information contained in this electronic message and any attachments to this message are intended for the exclusive use of the addressee(s) and may contain proprietary, confidential or privileged information. If you are not the intended recipient, you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately and destroy all copies of this message and any attachments. WARNING: Computer viruses can be transmitted via email. The recipient should check this email and any attachments for the presence of viruses. The company accepts no liability for any damage caused by any virus transmitted by this email. www.wipro.com'

Internal to Wipro

Re: SPDXID #spdx

Gary O'Neall

#1518

Hi Sandeep – Moving the conversation over to the SPDX-tech mailing list.

Unfortunately, adding in a CPE ID or pURL would include characters disallowed in the SPDX ID.

Fortunately, there is a way to express the pURL and CPE ID in the SPDX Package using the ExternalRef property. If you add these properties, tools such as the SPDX to OSV will pick up the references and use them to uniquely identify the packages.

Here’s an example in JSON format for a CPE 2.3 ID:

"packages" : [ {

"SPDXID" : "SPDXRef-Package",

"externalRefs" : [ {

"referenceCategory" : "SECURITY",

"referenceLocator" : "cpe:2.3:a:pivotal_software:spring_framework:4.1.0:*:*:*:*:*:*:*",

"referenceType" : "cpe23Type"

}, …

See the ExternalRef subsection of the spec and the External Repository Identifiers Annex for more details.

Regards,
Gary

Show quoted text

From: spdx@... <spdx@...> On Behalf Of Patil, Sandeep via lists.spdx.org
Sent: Monday, May 16, 2022 9:06 AM
To: spdx@...
Subject: [spdx] SPDXID #spdx

Hi ,
I have query regarding SPDXID , Can this be expressed along with CPE or pURL something like

"SPDXRef-[cpe id]" or "SPDXRef-[pURL]"

Any further guidance on this will help.

Regards
Sandeep

Re: SPDX and NTIA SBOM Minimum elements #spdx

William Bartholomew (CELA)

#1517

This is how Microsoft has approached this:

https://devblogs.microsoft.com/engineering-at-microsoft/generating-software-bills-of-materials-sboms-with-spdx-at-microsoft/

The one thing I’d add is that additional identifiers would be stored in External References.

Regards,

William Bartholomew (he/him) – Let’s chat

Principal Security Strategist

Global Cybersecurity Policy – Microsoft

My working day may not be your working day. Please don’t feel obliged to reply to this e-mail outside of your normal working hours.

Show quoted text

From: spdx@... <spdx@...> On Behalf Of Dick Brooks via lists.spdx.org
Sent: Monday, May 16, 2022 9:24 AM
To: spdx@...
Subject: [EXTERNAL] Re: [spdx] SPDX and NTIA SBOM Minimum elements #spdx

NTIA Framing document has the mapping you seek: see page 13

https://www.ntia.gov/files/ntia/publications/ntia_sbom_framing_2nd_edition_20211021.pdf

However the “EO 14028 NTIA min element list is a little different from the framing document list (see attached)

Thanks,

Dick Brooks

Active Member of the CISA Critical Manufacturing Sector,

Sector Coordinating Council – A Public-Private Partnership

Never trust software, always verify and report! ™

http://www.reliableenergyanalytics.com

Email: dick@...

Tel: +1 978-696-1788

From: spdx@... <spdx@...> On Behalf Of Patil, Sandeep via lists.spdx.org
Sent: Monday, May 16, 2022 12:10 PM
To: spdx@...
Subject: [spdx] SPDX and NTIA SBOM Minimum elements #spdx

Hi ,
Is there any document reference which can be used to see mapping between SPDX tags and NTIA Minimum elements ?
Some element names can be easily confused , something like "Author of SBOM Data" in NTIA Minimum elements and "Creator" tag in SPDX are those same ?

Regards
Sandeep

Re: SPDX and NTIA SBOM Minimum elements #spdx

Dick Brooks

#1516

You’re welcome.

You will most likely need SPDX V2.3 if you have any “FILE” components that need to specify version info. The new PackagePurpose field supports the version info for “FILE” artifacts.

Thanks,

Dick Brooks

Active Member of the CISA Critical Manufacturing Sector,

Sector Coordinating Council – A Public-Private Partnership

Never trust software, always verify and report! ™

http://www.reliableenergyanalytics.com

Email: dick@...

Tel: +1 978-696-1788

Show quoted text

From: spdx@... <spdx@...> On Behalf Of Patil, Sandeep via lists.spdx.org
Sent: Monday, May 16, 2022 12:31 PM
To: spdx@...
Subject: Re: [spdx] SPDX and NTIA SBOM Minimum elements #spdx

Thanks you Dick, This is useful

From: spdx@... <spdx@...> On Behalf Of Dick Brooks via lists.spdx.org
Sent: Monday, May 16, 2022 9:54 PM
To: spdx@...
Subject: Re: [spdx] SPDX and NTIA SBOM Minimum elements #spdx

You don't often get email from dick=reliableenergyanalytics.com@.... Learn why this is important

Caution: This e-mail originated from outside of Philips, be careful for phishing.

NTIA Framing document has the mapping you seek: see page 13

https://www.ntia.gov/files/ntia/publications/ntia_sbom_framing_2nd_edition_20211021.pdf

However the “EO 14028 NTIA min element list is a little different from the framing document list (see attached)

Thanks,

Dick Brooks

Active Member of the CISA Critical Manufacturing Sector,

Sector Coordinating Council – A Public-Private Partnership

Never trust software, always verify and report! ™

http://www.reliableenergyanalytics.com

Email: dick@...

Tel: +1 978-696-1788

From: spdx@... <spdx@...> On Behalf Of Patil, Sandeep via lists.spdx.org
Sent: Monday, May 16, 2022 12:10 PM
To: spdx@...
Subject: [spdx] SPDX and NTIA SBOM Minimum elements #spdx

Hi ,
Is there any document reference which can be used to see mapping between SPDX tags and NTIA Minimum elements ?
Some element names can be easily confused , something like "Author of SBOM Data" in NTIA Minimum elements and "Creator" tag in SPDX are those same ?

Regards
Sandeep

The information contained in this message may be confidential and legally protected under applicable law. The message is intended solely for the addressee(s). If you are not the intended recipient, you are hereby notified that any use, forwarding, dissemination, or reproduction of this message is strictly prohibited and may be unlawful. If you are not the intended recipient, please contact the sender by return e-mail and destroy all copies of the original message.

Re: SPDX and NTIA SBOM Minimum elements #spdx

Patil, Sandeep

#1515

Thanks you Dick, This is useful

Show quoted text

From: spdx@... <spdx@...> On Behalf Of Dick Brooks via lists.spdx.org
Sent: Monday, May 16, 2022 9:54 PM
To: spdx@...
Subject: Re: [spdx] SPDX and NTIA SBOM Minimum elements #spdx

You don't often get email from dick=reliableenergyanalytics.com@.... Learn why this is important

Caution: This e-mail originated from outside of Philips, be careful for phishing.

NTIA Framing document has the mapping you seek: see page 13

https://www.ntia.gov/files/ntia/publications/ntia_sbom_framing_2nd_edition_20211021.pdf

However the “EO 14028 NTIA min element list is a little different from the framing document list (see attached)

Thanks,

Dick Brooks

Active Member of the CISA Critical Manufacturing Sector,

Sector Coordinating Council – A Public-Private Partnership

Never trust software, always verify and report! ™

http://www.reliableenergyanalytics.com

Email: dick@...

Tel: +1 978-696-1788

From: spdx@... <spdx@...> On Behalf Of Patil, Sandeep via lists.spdx.org
Sent: Monday, May 16, 2022 12:10 PM
To: spdx@...
Subject: [spdx] SPDX and NTIA SBOM Minimum elements #spdx

Hi ,
Is there any document reference which can be used to see mapping between SPDX tags and NTIA Minimum elements ?
Some element names can be easily confused , something like "Author of SBOM Data" in NTIA Minimum elements and "Creator" tag in SPDX are those same ?

Regards
Sandeep

The information contained in this message may be confidential and legally protected under applicable law. The message is intended solely for the addressee(s). If you are not the intended recipient, you are hereby notified that any use, forwarding, dissemination, or reproduction of this message is strictly prohibited and may be unlawful. If you are not the intended recipient, please contact the sender by return e-mail and destroy all copies of the original message.

Re: SPDX and NTIA SBOM Minimum elements #spdx

Dick Brooks

#1514

NTIA Framing document has the mapping you seek: see page 13

https://www.ntia.gov/files/ntia/publications/ntia_sbom_framing_2nd_edition_20211021.pdf

However the “EO 14028 NTIA min element list is a little different from the framing document list (see attached)

Thanks,

Dick Brooks

Active Member of the CISA Critical Manufacturing Sector,

Sector Coordinating Council – A Public-Private Partnership

Never trust software, always verify and report! ™

http://www.reliableenergyanalytics.com

Email: dick@...

Tel: +1 978-696-1788

Show quoted text

From: spdx@... <spdx@...> On Behalf Of Patil, Sandeep via lists.spdx.org
Sent: Monday, May 16, 2022 12:10 PM
To: spdx@...
Subject: [spdx] SPDX and NTIA SBOM Minimum elements #spdx

Hi ,
Is there any document reference which can be used to see mapping between SPDX tags and NTIA Minimum elements ?
Some element names can be easily confused , something like "Author of SBOM Data" in NTIA Minimum elements and "Creator" tag in SPDX are those same ?

Regards
Sandeep

SPDX and NTIA SBOM Minimum elements #spdx

Patil, Sandeep

#1513

Hi ,
Is there any document reference which can be used to see mapping between SPDX tags and NTIA Minimum elements ?
Some element names can be easily confused , something like "Author of SBOM Data" in NTIA Minimum elements and "Creator" tag in SPDX are those same ?

Regards
Sandeep

SPDXID #spdx

Patil, Sandeep

#1512

Hi ,
I have query regarding SPDXID , Can this be expressed along with CPE or pURL something like

"SPDXRef-[cpe id]" or "SPDXRef-[pURL]"

Any further guidance on this will help.

Regards
Sandeep

Re: End Of Life Tag in spdx #spdx

Dick Brooks

#1511

Kate and Sandeep,

Our customers are also interested in this information. There are two concepts to consider:

Commercial Status:

Support Status:

        <enumeration value="Supported"></enumeration>

        <enumeration value="Unsupported"></enumeration>

        <enumeration value="Community"></enumeration>

Both are described in the open-source Vendor Response File (VRF) XML schema available here: https://raw.githubusercontent.com/rjb4standards/REA-Products/master/SAGVendorSchema.xsd

Thanks,

Dick Brooks

Active Member of the CISA Critical Manufacturing Sector,

Sector Coordinating Council – A Public-Private Partnership

Never trust software, always verify and report! ™

http://www.reliableenergyanalytics.com

Email: dick@...

Tel: +1 978-696-1788

Show quoted text

From: spdx@... <spdx@...> On Behalf Of Kate Stewart
Sent: Friday, May 6, 2022 3:34 PM
To: SPDX-general <spdx@...>
Subject: Re: [spdx] End Of Life Tag in spdx #spdx

Hi Sandeep,

There is a pull request expected shortly from the Usage profile team, to add this specific field to 2.3.

When it comes in, please feel free to review and make sure it's going to suffice for your needs.

For now, with 2.2 documents, suggest you use the Package Comment field (https://spdx.github.io/spdx-spec/package-information/#720-package-comment-field) and standardize on a tag (like EndOfSupport: ) and the date.

Will that work for now?

Thanks,
Kate

On Fri, May 6, 2022 at 2:27 PM Patil, Sandeep via lists.spdx.org <sandeep.patil=philips.com@...> wrote:

Hi All,
We have requirement to specify End Of Life as part of package information in SBoM ,
Is there way current SPDX format support this ?

Regards
Sandeep

Re: End Of Life Tag in spdx #spdx

Kate Stewart

#1510

Hi Sandeep,

There is a pull request expected shortly from the Usage profile team, to add this specific field to 2.3.

When it comes in, please feel free to review and make sure it's going to suffice for your needs.

For now, with 2.2 documents, suggest you use the Package Comment field (https://spdx.github.io/spdx-spec/package-information/#720-package-comment-field) and standardize on a tag (like EndOfSupport: ) and the date.

Will that work for now?

Thanks,
Kate

Show quoted text

On Fri, May 6, 2022 at 2:27 PM Patil, Sandeep via lists.spdx.org <sandeep.patil=philips.com@...> wrote:

Hi All,
We have requirement to specify End Of Life as part of package information in SBoM ,
Is there way current SPDX format support this ?

Regards
Sandeep

End Of Life Tag in spdx #spdx

Patil, Sandeep

#1509

Hi All,
We have requirement to specify End Of Life as part of package information in SBoM ,
Is there way current SPDX format support this ?

Regards
Sandeep

Re: SPDX Thurs General Meeting Reminder

Kate Stewart

#1508

The video has been posted here:

https://www.youtube.com/watch?v=8X5PWa7A6pY&list=PLciqFgcGu7TvR_f3aKZHkozX0WIs-N7vc&index=7

Thanks again to Joshua for sharing with us!

Show quoted text

On Wed, May 4, 2022 at 4:22 PM Christopher Lusk <clusk@...> wrote:

Hello,

Is it possible to get the recording from the April SPDX meeting?

Thanks.

Christopher D. Lusk
Product Security Analyst
Product Security Office
Lenovo

clusk@...

Lenovo.com
Twitter | Instagram | Facebook | Linkedin | YouTube | Privacy

From: spdx@... <spdx@...> On Behalf Of Phil Odence via lists.spdx.org
Sent: Wednesday, May 4, 2022 9:17 AM
To: SPDX-general <spdx@...>
Subject: [External] [spdx] SPDX Thurs General Meeting Reminder

No special presentation this month, but I will announce this year’s recently added Member Reps and provide a little review of this aspect of the governance process.

GENERAL MEETING

Meeting Time: Thurs, May 5, 8am PT / 10 am CT / 11am ET / 15:00 UTC. http://www.timeanddate.com/worldclock/converter.html

Conf call dial-in:

Join the meeting:
https://meet.jit.si/SPDXGeneralMeeting

To join by phone instead, tap this: +1.512.647.1431,,1310118349#

Looking for a different dial-in number?
See meeting dial-in numbers: https://meet.jit.si/static/dialInInfo.html?room=SPDXGeneralMeeting

If also dialing-in through a room phone, join without connecting to audio: https://meet.jit.si/SPDXGeneralMeeting#config.startSilent=true

Etherpad for minutes:

https://spdx.swinslow.net/p/spdx-general-minutes

Administrative Agenda

Attendance

Minutes Approval https://github.com/spdx/meetings/blob/main/general/2022-04-07.md

Special Presentation

Technical Team Report – Kate/Gary/Others

Specification and Profiles

Overview
Core
Legal
Integrity
Defects
Usage and Other Emerging

Tooling

Legal Team Report – Jilayne/Paul/Steve

Outreach/Website Team Report – Jack/Sebastian

Re: SPDX Thurs General Meeting Reminder

Christopher Lusk

#1507

Hello,

Is it possible to get the recording from the April SPDX meeting?

Thanks.

Christopher D. Lusk Product Security Analyst Product Security Office Lenovo	clusk@...

Lenovo.com Twitter \| Instagram \| Facebook \| Linkedin \| YouTube \| Privacy

Show quoted text

From: spdx@... <spdx@...> On Behalf Of Phil Odence via lists.spdx.org
Sent: Wednesday, May 4, 2022 9:17 AM
To: SPDX-general <spdx@...>
Subject: [External] [spdx] SPDX Thurs General Meeting Reminder

No special presentation this month, but I will announce this year’s recently added Member Reps and provide a little review of this aspect of the governance process.

GENERAL MEETING

Meeting Time: Thurs, May 5, 8am PT / 10 am CT / 11am ET / 15:00 UTC. http://www.timeanddate.com/worldclock/converter.html

Conf call dial-in:

Join the meeting:
https://meet.jit.si/SPDXGeneralMeeting

To join by phone instead, tap this: +1.512.647.1431,,1310118349#

Looking for a different dial-in number?
See meeting dial-in numbers: https://meet.jit.si/static/dialInInfo.html?room=SPDXGeneralMeeting

If also dialing-in through a room phone, join without connecting to audio: https://meet.jit.si/SPDXGeneralMeeting#config.startSilent=true

Etherpad for minutes:

https://spdx.swinslow.net/p/spdx-general-minutes

Administrative Agenda

Attendance

Minutes Approval https://github.com/spdx/meetings/blob/main/general/2022-04-07.md

Special Presentation

Technical Team Report – Kate/Gary/Others

Specification and Profiles

Overview
Core
Legal
Integrity
Defects
Usage and Other Emerging

Tooling

Legal Team Report – Jilayne/Paul/Steve

Outreach/Website Team Report – Jack/Sebastian

SPDX Thurs General Meeting Reminder

Phil Odence

#1506

No special presentation this month, but I will announce this year’s recently added Member Reps and provide a little review of this aspect of the governance process.

GENERAL MEETING

Meeting Time: Thurs, May 5, 8am PT / 10 am CT / 11am ET / 15:00 UTC. http://www.timeanddate.com/worldclock/converter.html

Conf call dial-in:

Join the meeting:
https://meet.jit.si/SPDXGeneralMeeting

To join by phone instead, tap this: +1.512.647.1431,,1310118349#

Looking for a different dial-in number?
See meeting dial-in numbers: https://meet.jit.si/static/dialInInfo.html?room=SPDXGeneralMeeting

If also dialing-in through a room phone, join without connecting to audio: https://meet.jit.si/SPDXGeneralMeeting#config.startSilent=true

Etherpad for minutes:

https://spdx.swinslow.net/p/spdx-general-minutes

Administrative Agenda

Attendance

Minutes Approval https://github.com/spdx/meetings/blob/main/general/2022-04-07.md

Special Presentation

Technical Team Report – Kate/Gary/Others

Specification and Profiles

Overview
Core
Legal
Integrity
Defects
Usage and Other Emerging

Tooling

Legal Team Report – Jilayne/Paul/Steve

Outreach/Website Team Report – Jack/Sebastian

~24 hours left to propose SPDX talks to All Things Open!

VM (Vicky) Brasseur

#1505

All Things Open (ATO) is one of the largest open source conferences in the world now. In 2022 it’ll be in-person only, in its normal location of the Raleigh Convention Center in Raleigh, North Carolina, USA.

ATO 2022 happens October 30-November 2 (yes, over Halloween, ugh). This is either soon after or contemporaneous with the release of 3.0.

Considering the size of the potential audience (thousands) and the diversity of the event (both in attendees and in topic tracks), it would be great if folks could propose some SPDX-related talks. For instance:

Steve could propose the talk he’s doing for OSPOcon in June
An intro talk about SPDX would be good for a large percent of the audience
A survey of tools for using and/or creating SPDX might be fun
A general talk about supply chain stuff & how SPDX can help would be timely
Why distros (Fedora, Yocto) are supporting SPDX and how you can help your fave distro do the same

The ATO CFP form allows for submitting 15 minute keynote slots this year! That would be a great place for Kate, Jilayne, or someone to talk about the impact of supply chain stuff and where SPDX 3.0 fits in!

Anyway, time’s running short. The CFP closes EOD tomorrow!

Here’s the link and more information: https://www.allthingsopen.org/call-for-papers-2022/

--V

'The information contained in this electronic message and any attachments to this message are intended for the exclusive use of the addressee(s) and may contain proprietary, confidential or privileged information. If you are not the intended recipient, you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately and destroy all copies of this message and any attachments. WARNING: Computer viruses can be transmitted via email. The recipient should check this email and any attachments for the presence of viruses. The company accepts no liability for any damage caused by any virus transmitted by this email. www.wipro.com'

Internal to Wipro

The OpenChain Industry Survey 2022 - SPDX Included

Shane Coughlan

#1504

The OpenChain Industry Survey 2022 covers a big topic: the global status of corporate engagement and management of open source. Please help by completing the survey from your perspective before May 1st.

English:
https://forms.gle/9Jf9h1J6AwzFpMz89

Simplified Chinese:
https://wj.qq.com/s2/9935077/5841/

Japanese:
https://forms.gle/A2qdawgY9h7CWr3q8

(Thank you China and Japan work groups! :) )

We are considering open source from a “strategy” perspective rather than a “development” perspective. Our goal is to help inform project, product and supply chain decisions in the year ahead. This goes far beyond compliance, OSPO and any other single topic. However, we are explicitly unpacking industry engagement with SPDX.

This survey is licensed under CC-0 so feel free to take it as the basis for your own surveys in the future.

Special Presentation and SPDX Thurs General Meeting Reminder

Phil Odence

#1503

NOTE: I am a little behind and have not posted the minutes from the March meeting in GH. In advance of that, I have included that minutes in roughg form at the bottom of this email.

PRESENTATION: Please join us for this presentation to kick off the meeting. Yocto have been very supportive of SPDX and active in incorporating the technology.

SPDX in the Yocto Project – Joshua Watt

Abstract:

As Software Bills of Material (SBoMs) become more important in the software industry, the generation of high quality SBoMs from the beginning of the Software Supply Chain has also become more important. The Yocto Project is designed to build up software images from source, and such is a prime candidate to generate these SBoMs at the point where software packages are compiled and assembled into customer images. Joshua will talk about how the Yocto Project is able to do this, and some of the interesting quirks encountered when implementing this feature.

Joshua Watt is a Software Engineer for Garmin, where he has been working for the past 13 years. He has been a developer with OpenEmebedded and the Yocto Project for the past 7 years, and is a member of the OpenEmbedded Technical Steering Committee.

GENERAL MEETING

Meeting Time: Thurs, April 7, 8am PT / 10 am CT / 11am ET / 15:00 UTC. http://www.timeanddate.com/worldclock/converter.html

Conf call dial-in:

Join the meeting:
https://meet.jit.si/SPDXGeneralMeeting

To join by phone instead, tap this: +1.512.647.1431,,1310118349#

Looking for a different dial-in number?
See meeting dial-in numbers: https://meet.jit.si/static/dialInInfo.html?room=SPDXGeneralMeeting

If also dialing-in through a room phone, join without connecting to audio: https://meet.jit.si/SPDXGeneralMeeting#config.startSilent=true

Etherpad for minutes:

https://spdx.swinslow.net/p/spdx-general-minutes

Administrative Agenda

Attendance

Minutes Approval https://github.com/spdx/meetings/blob/master/general/2022-02-03.md

Special Presentation

Technical Team Report – Kate/Gary/Others

Specification and Profiles

Overview
Core
Legal
Integrity
Defects
Usage and Other Emerging

Tooling

Legal Team Report – Jilayne/Paul/Steve

Outreach/Website Team Report – Jack/Sebastian

# SPDX General Meeting Minutes - March 3, 2022

## Administrative

- Attendance:

* Phil Odence, Black Duck Audits/Synopsys

* Patrick Reilly

* Sebastian Crane

* Bob Martin

* Joshua Dubin, Verizon

* Steve Winslow

* Brad Goldring, GTC Law Group

* Joshua Marpet

* Joshua Watt

* Jon Geater, Jitsuin (presenter)

* Alex Rybak

* Jeff Schutt

* Kate Stewart, Linux Foundation

* Maximillian Huber

* Mark Atwood, Amazon.com

* Philippe-Emmanuel Douziech, CAST GmbH / CISQ

* David Edelsohn

* Paul Madick

* Jilayne Lovejoy, Red Hat

* Ria Schalnat

* Molly Menomi

* Robert Boyd

- Lead by Phil Odence

- Minutes from last meeting approved.

## How RKVST Uses SPDX for Software Transparency by Jon Geater, CTO Jitsuin

### Jitsuin, RVST, Digital Twin Consortium

### The Problem

#### Cyber physical systems- Data is the new oil. Big Opportunity...but requires trusting data

#### Trust can be difficult because everyone is in a supply chain, crossing org boundaries

### Solution approach: Shared asset history w/evidence

#### Including BOM

##### Software and hardware combination (depending on industy)

##### SBOM- super crutial first step

#### Common understanding takes out human time-consuming steps

#### Anyone in the chain should be able to make their own risk assessment

##### Trust is not the same as security

##### Things change/are dynamic...and with software that's frequent

##### So systems need to be able to handle quickly, in real time

### Conclusions

#### What's needed is resilient operation of dynamic systems

#### Important first step is what's in the box

#### ...then vulernablities and what do to about them

#### interoperatiblity of standard formats

### Q&A

## Tech Team Report - Gary/Kate/Thomas

### Spec

#### Defects

* Meetings have started up, join the mailing list for details.

#### Core 3.0

* Kate / William - have been making good progress on punch list

#### 2.3 Release

* will be adding in some fields that people have been asking for interoperability with CycloneDX community

* license namespaces - Mark Atwood and Steve Winslow to sync

* SPDX Lite - add Package Supplier to match NTIA minimum definition for SPDX Lite profile

### Tools

#### GSOC

* Submission in, project ideas still welcome.

## Legal Team Report - Jilayne/Paul/Steve

* 3.16 released at beginning of February; continuing with issues / PRs for 3.17

* change in meeting cadence - moved to 2nd / 4th Thursday of every month, Steve to update downloadable invites on website

## Outreach Team Report - Sebastian

* Updates to landscape in process

* FOSDEM talk from Sebastian - recording not yet on FOSDEM website

* highlighting key aspects of effective, high-quality SBOMs

* will be available at https://fosdem.org/2022/schedule/event/security_sbom/ once it's posted

* March 20 - LibrePlanet talk - package management

* https://libreplanet.org/2022/speakers/#5830

* OpenSSF interest in vulnerabilities website

* Kate and Jack - updates to website