A great meeting with great attendance.

Please volunteer or suggest a guest speaker for next time. Anything SPDX related is fair game.

https://wiki.spdx.org/view/General_Meeting/Minutes/2020-04-02

< General Meeting‎ | Minutes

·         Attendance: 19

·         Lead by Phil Odence

·         Minutes of April meeting

Contents

 [hide] 

·         1 Guest Speaker- Allan Friedman, NTIA

·         2 Tech Team Report - Kate

·         3 Legal Team Report - Steve

·         4 Outreach Team Report - Jack

·         5 Cross Functional -

·         6 Attendees

·         NTIA’s Multistakeholder SBOM Process

·         Concerns about software supply chain risks have garnered more attention and energy in the OSS community, industry, and governments around the world. One natural starting point is a greater expectation of transparency of software components and dependencies. Any solution must scale up and down the software supply chain, and across the incredibly diverse software ecosystem, from modern CI/CD application development to critical infrastructure and embedded systems. Over the past two years, NTIA has helped a diverse set of stakeholders find a common vision for a "software bill of materials" (SBOM) that has the potential to scale as needed, and serve as a foundation for even more innovation around software supply chain security and quality. The SPDX community has played a key role in this discussion, and emerged as a key standard. This presentation will give an overview of the policy landscape, the progress made, and the work yet to be done around SBOM. 

·         Allan’s slides  https://drive.google.com/open?id=1KOsm6grnSZ5FsSnzTI9ybYT9m84F8Zfe

·         Spec

·         Wrapping up 2.2 spec

·         Known unknowns made it in

·         3.0 Visions

·         William Bartholomew’s talk about profiles was great (and recorded)

·         Tools

·         Gary’s been working on 2.2 tooling

·         Requiring a complete rewrite to the java tools

·         Not API compatible

·         Google SoC

·         15 different submissions

·         Google is looking for additional mentors on each project

·         So, we need more mentors; contact Gary

·         Finalized updates to license inclusion principles

·         Mostly clarifications

·         But also to broaden a bit for non-OSS source available licenses

·         https://github.com/spdx/license-list-XML/blob/master/DOCS/license-inclusion-principles.md

·         3.9 list release has been pushed out a bit

·         Were waiting for above

·         https://github.com/spdx/license-list-XML/issues?q=is%3Aopen+is%3Aissue+milestone%3A%223.9+release%22

·         In anticipation of 3.0 working on a licensing profile

·         With Tech Team, updating back end of SPDX website to manage move from Drupal to Wordpress

·         Maintaining license URLs

·         Static pages moving do a different domain.

·         Will be looking for help to update content for Website as per above

·         Documenting comprehensive list of SPDX-related tooling

·         None

·         Phil Odence, Black Duck/Synopsys

·         Alan Friedman, NTIA

·         Rose Judge, VMware

·         Steve Winslow, LF

·         Kate Stewart, Linux Foundation

·         Alexios Zavras, Intel

·         Jack Manbeck, TI

·         Jim Hutchison, Qualcomm

·         William Bartholomew, GitHub

·         Dave McLoughlin, Flexera

·         Michael Herzog- nexB

·         Alex Rybak, Flexera

·         Gary O’Neall, SourceAuditor

·         Paul Madick

·         Brad Goldring, GTC Law

·         David Wheeler, Linux Foundation

·         Mike Dolan, Linux Foundation

·         Bob Campbell, DXC

·         Mark Atwood, Amazon

We’ll be pleased to welcome “professor-turned-technocrat” Allan Friedman, the Director of Cybersecurity at NTIA. He is at the center of NTIA’s effort to standard a software BOM and an SPDX fan. This is a great opportunity to understand this important work and where we fit. (Details on Allan and his talk below the agenda.)

GENERAL MEETING

Meeting Time: Thurs, April 2, 8am PT / 10 am CT / 11am ET / 15:00 UTC.  http://www.timeanddate.com/worldclock/converter.html

Conf call dial-in:

New dial in number: 415-881-1586

No PIN needed

The weblink for screenshare will stay the same at: 
http://uberconference.com/SPDXTeam

Administrative Agenda

Attendance

Minutes Approval:   

Guest Presentation – Allan Friedman

Technical Team Report – Kate/Gary

Legal Team Report – Jilayne/Paul/Steve

Outreach Team Report – Jack

Any Cross Functional Issues –All

 Concerns about software supply chain risks have garnered more attention and energy in the OSS community, industry, and governments around the world. One natural starting point is a greater expectation of transparency of software components and dependencies. Any solution must scale up and down the software supply chain, and across the incredibly diverse software ecosystem, from modern CI/CD application development to critical infrastructure and embedded systems. Over the past two years, NTIA has helped a diverse set of stakeholders find a common vision for a "software bill of materials" (SBOM) that has the potential to scale as needed, and serve as a foundation for even more innovation around software supply chain security and quality. The SPDX community has played a key role in this discussion, and emerged as a key standard. This presentation will give an overview of the policy landscape, the progress made, and the work yet to be done around SBOM. 

Allan Friedman is Director of Cybersecurity at National Telecommunications and Information Administration in the US Department of Commerce. He coordinates NTIA's multistakeholder processes on cybersecurity, focusing on addressing vulnerabilities in IoT and across the software world. Prior to joining the Federal Government, Friedman spent over 15 years as a noted InfoSec and tech policy scholar at Harvard's Computer Science Department, the Brookings Institution and George Washington University's Engineering School. He is the co-author of the popular text 'Cybersecurity and Cyberwar: What Everyone Needs to Know,' has a degree in computer science from Swarthmore College and a PhD in public policy from Harvard University, and is quite friendly for a failed professor-turned-technocrat.

> A new poll has been created…

I would prefer another option NOT in the poll (and thus have not voted): Treat it as just another license statement. There are multiple ways this kind of “uncopyrightable” assertion is made, and I think that specific form should be captured as a license statement.

New entries should be created for at least the “CC Public Domain Mark” and the situation where someone in the US government does it as part of official duties & doesn’t claim a copyright. There’s a discussion going on here:

https://github.com/spdx/license-list-XML/issues/988

Treating it like “everything else” means there are no special cases for SPDX, *and* you get finer-grained information.

For those who object & say that “there is no license”, well, “license” is just synonym for “permission”, and in this case the permission is granted by the way the legal systems work. So it’s a permission granted by the underlying mechanisms of law J.  I think the *users* of SPDX will appreciate the simplicity of *not* needing another special case.