Please excuse the later reminder. I was shocked this morning to notice it’s August already. Was thinking we had a week.

We will be joined by at least one, maybe two, of our Google SoC students to present their work. Please join.

GENERAL MEETING

Meeting Time: Thurs, Aug 1, 8am PT / 10 am CT / 11am ET / 15:00 UTC.  http://www.timeanddate.com/worldclock/converter.html

Conf call dial-in:

New dial in number: 415-881-1586

No PIN needed

The weblink for screenshare will stay the same at: 
http://uberconference.com/SPDXTeam

Administrative Agenda

Attendance

Minutes Approval: https://wiki.spdx.org/view/General_Meeting/Minutes/2019-07-11  

GSoC Presentations

Technical Team Report – Kate/Gary

Legal Team Report – Jilayne/Paul

Outreach Team Report – Jack

Any Cross Functional Issues –All

https://wiki.spdx.org/view/General_Meeting/Minutes/2019-07-11

< General Meeting‎ | Minutes

·         Attendance: 14

·         Lead by Phil Odence

·         Minutes of June meeting approved 

Contents

 [hide] 

·         1 Special Presentations - Xavier Figouoa/ Philip Ekong Obie, GSoC

·         2 Tech Team Report - Kate/Gary

·         3 Legal Team Report - Jilayne/Paul/Steve

·         4 Outreach Team Report - Kate

·         5 Cross Functional -

·         6 Attendees

·         Python Library- Adding support for more formats

·         Generating SPDX docs from IDs in code

·         Spec

·         All known issues are addressed in 2.2

·         Under discussion: 

·         Idea of a short format for copyrights ala license IDs from FSFE

·         Would be added as an appendix (like license IDs)

·         Could use a joint tech/legal teams call

·         Exploring branching strategy

·         Pared down version, defining minimal subset (from Japan work group)

·         Still SPDX compliant as it will utilize mandatory fields

·         Part of the spec

·         Important to communicate that; it’s not a fork

·         Tools

·         GSoC

·         8 projects total (a record)

·         Great progress, all passed first evaluations 

·         Flurry of tooling work with the new license list

·         Better matching/copyright matching

·         License format improvements

·         License List

·         3.6 version went live yesterday

·         10 new licenses and exceptions

·         Other mark up and doc updates

·         Attention now turning to 3.7

·         Other topics of discussion already covered.

·         Namespace Project

·         Need to make clear the difference between LL and NS registry

·         NS is an option for rejected licenses

·         Could be a stop before being accepted

·         Shane has readied the survey

·         Based on input from Phil, Jack, Kate, Gary

·         Will go do the General Meeting mailing list

·         Will designate one Tech Call per month to include Legal Team

·         Third one of the month

·         Starting next week

·         Phil Odence, Black Duck/Synopsys

·         Jilayne Lovejoy, Canonical

·         Steve Winslow, LF

·         Gary O’Neall, SourceAuditor

·         Kate Stewart, Linux Foundation

·         Philippe Ombrédanne- nexB

·         Alexios Zavras, Intel

·         Michael Herzog- nexB

·         David Ryan

·         Dave McLaughlin, Rogue Wave

·         Paul Madick, Dimension Data

·         Mark Atwood, Amazon

·         Xavier Figouoa

·         Philip Ekong Obie

Joining us will be two students doing Google Summer of Code projects for us. Xavier will be talking about his and Philip will do a short demo.

Xavier Figueroa, Undergraduate Computer Science student from Ecuador, first time contributing to an Open Source project

Title: GSoC Project: Addtional format support for Python libraries

Abstract: The GSoC Project Addtional format support for Python libraries initially implied adding support for JSON/XML/YAML formats to the SPDX Python Library, but now some additional work will be done. In this presentation, it will be covered what the project currently entails, where we are and what it is next.

Philip Ekong Obie

SPDX Document Generator for projects using SPDXIDs

GENERAL MEETING

Meeting Time: Thurs, July 11, 8am PT / 10 am CT / 11am ET / 15:00 UTC.  http://www.timeanddate.com/worldclock/converter.html

Conf call dial-in:

New dial in number: 415-881-1586

No PIN needed

The weblink for screenshare will stay the same at: 
http://uberconference.com/SPDXTeam

Administrative Agenda

Attendance

Minutes Approval:  https://wiki.spdx.org/view/General_Meeting/Minutes/2019-06-06

GSoC Presentations

Technical Team Report – Kate/Gary

Legal Team Report – Jilayne/Paul

Outreach Team Report – Jack

Any Cross Functional Issues –All

Note, July Meeting has been moved to July 11.

June minutes: https://wiki.spdx.org/view/General_Meeting/Minutes/2019-06-06

Thanks to Paul for hosting in my stead.

Phil

L. Philip Odence

General Manager, Black Duck On-Demand

Synopsys Software Integrity Group, Burlington, MA

M (781) 258-9502 | phil.odence@...

< General Meeting‎ | Minutes

·         Attendance: 12 (attendance list at bottom)

·         Lead by Paul Madick

·         Minutes of May meeting approved 

Contents

 [hide] 

·         1 Tech Team Report - Gary

·         2 Legal Team Report - Jilayne/Paul

·         3 Outreach Team Report - Jack Manbeck

·         4 General Items

·         5 Attendees

·         Spec No issues remaining to latest spec, 8 GOSC students approved and working. Looking forward to new tools this summer. Lots of new projects adopting SPDX and Linux kernel clean up of licensing still working (about 2/3 through). Making great progress.

·         Tools

·         License List 

·         GSOC student on last call. Great information. Legal Meeting minutes has the description, take a look if you are interested or would like to provide input.

·         Reworking the license inclusion guidelines and moving into github repository in the documentation folder. Please weigh in if you are interested in more licenses. Still looking for more volunteers to move license submissions into license approvals. 

·         A big welcome to new co-lead of legal team Steve Winslow and a big thank you to Karen for her years of stewardship as she steps away from the co-lead position.

·         Not a lot going on now, but working on a survey. Intention is to send the survey to companies to see where they are at in using/implementing SPDX. Maybe include some community in survey, but not sure yet.

·         Conversation: are we meeting for summer LF event in SD. Not currently, but Kate will look into getting meeting room for ½ day, etc. Jack, Paul, Kate, Steve and others are potentially available to attend at least one day in SD. 

·         Alexios Zavras, Intel

·         JC Herz, Ion Channel

·         Dave McLoughlin

·         Paul Madick, Dimension Data

·         Jilayne Lovejoy

·         Steve Winslow, LF

·         Kate Stewart, Linux Foundation

·         Alexios Zavras, Intel

·         Philippe Ombrédanne- nexB

·         Jack Manbeck

·         Mike Herzog

·         Mark Atwood

Notes:

• I will be on vacation tomorrow. Paul will host.
• I forgot to post minutes after the May meeting. Just did: https://wiki.spdx.org/view/General_Meeting/Minutes/2019-05-02

GENERAL MEETING

Meeting Time: Thurs, June 6, 8am PST / 10 am CST / 11am EST / 15:00 UTC. http://www.timeanddate.com/worldclock/converter.html

Conf call dial-in:

New dial in number: 415-881-1586

No PIN needed

The weblink for screenshare will stay the same at: 
http://uberconference.com/SPDXTeam

Administrative Agenda

Attendance

Minutes Approval: 

https://wiki.spdx.org/view/General_Meeting/Minutes/2019-05-02

Technical Team Report – Kate/Gary

Legal Team Report – Jilayne/Paul

Outreach Team Report – Jack

Any Cross Functional Issues –All

Moving the July 4 instance of this meeting to July 11 due to the US holiday.

*****

I’m extending this recurring meeting to run through 2019. Please accept so it is updated on your calendar, however no need to send a response to me.

New dial in number: 415-881-1586

No PIN needed

The weblink for screenshare will stay the same at:
http://uberconference.com/SPDXTeam

MEETING MINUTES FOR REVIEW: http://spdx.org/wiki/meeting-minutes-and-decisions

Hi Steve,

sw360 is an open source project under the umbrella of the Eclipse foundation. Its is a software component and product management system, which is on the one hand a system where you can manage the software components you are using no matter whether they are OSS, commercial or internal components or other artifacts on the other hand it is a system to manage your products (aka projects) in order to keep track of the bill of “materials”, to generate the OSS declaration document and source code bundles in scope of a product.

For the integration in the CI/CD workflow it provides a REST API

You can find the source code here: https://github.com/eclipse/sw360

Some documentation is available here: https://github.com/eclipse/sw360/wiki

If you like we can arrange a web meeting since we are using sw360 in our daily work.

Ciao

Oliver

Hi all,

I first heard about SW360 during the presentations at the Linux Open Source Summit in Edinburgh. Searching around, though, I see very little mention of it, to the point where it's difficult to see whether this is a project just finding its feet, or something that has already been abandoned. I'd be interested in hearing from anyone who is actually using it in anger, who is willing to share their experiences.

Thanks for any info,

steve

Hi all,

I first heard about SW360 during the presentations at the Linux Open Source Summit in Edinburgh. Searching around, though, I see very little mention of it, to the point where it's difficult to see whether this is a project just finding its feet, or something that has already been abandoned. I'd be interested in hearing from anyone who is actually using it in anger, who is willing to share their experiences.

Thanks for any info,

steve

Our “guest” presentation for this session feature guest Aaron Williamson (whom you are probably aware was counsel for the SFLC) and non-guest Jilayne. The twosome collaborated on the handbook they will discuss:

The Fintech Open Source Foundation (FINOS) recently released the Open Source License Compliance Handbook, a resource of practical compliance information about common open source licenses. FINOS launched the project to support its members in building more mature compliance processes and made the content (and code) open source to encourage adoption and contribution by the community. The handbook's "source code" is a collection of machine-readable YAML text files that can be compiled into a single document (using the supplied python script) or incorporated easily into databases and other systems. Aaron will discuss the project, the decisions behind its design, and plans for the future.

Aaron Williamson is General Counsel and Director of Governance at the Fintech Open Source Foundation (FINOS), a nonprofit foundation promoting open source collaboration in the financial services industry. In addition to managing the Foundation’s legal affairs, he leads the Foundation’s Open Source Readiness Program, helping members to develop policies and processes that enable productive engagement with open source. He also co-organizes the FINOS Open Source Strategy Forum, an annual conference on open source in financial services. 

GENERAL MEETING

Meeting Time: Thurs, May 2, 8am PST / 10 am CST / 11am EST / 15:00 UTC. http://www.timeanddate.com/worldclock/converter.html

Conf call dial-in:

New dial in number: 415-881-1586

No PIN needed

The weblink for screenshare will stay the same at: 
http://uberconference.com/SPDXTeam

Administrative Agenda

Attendance

Minutes Approval: https://wiki.spdx.org/view/General_Meeting/Minutes/2019-04-04

Special Presentation – Jilayne/Aaron

Technical Team Report – Kate/Gary

Legal Team Report – Jilayne/Paul

Outreach Team Report – Jack

Any Cross Functional Issues –All

https://wiki.spdx.org/view/General_Meeting/Minutes/2019-04-04

L. Philip Odence

General Manager, Black Duck On-Demand

Synopsys Software Integrity Group, Burlington, MA

M (781) 258-9502 | phil.odence@...

< General Meeting‎ | Minutes

·         Attendance: 18

·         Lead by Phil Odence

·         Minutes of March meeting approved 

Contents

 [hide] 

·         1 Special Presentation - Gary/Steve

·         2 Tech Team Report - Gary

·         3 Legal Team Report - Jilayne/Paul

·         4 Outreach Team Report - Jack Manbeck

·         5 Attendees

·         SPDX: Bridging the Compliance Tool Gap

·         https://events.linuxfoundation.org/wp-content/uploads/2018/07/SPDX-Bridging-the-Compliance-Tooling-Gap.pdf

·         Spec

·         Starting to put out 2.1.1 in pdf form

·         Kudos to Jack

·         Starting in on 2.2

·         Tools

·         GSoc

·         Very active

·         Lots of students and mentors

·         Good project

·         License List

·         3.5 Release out! 

·         7 new licenses and exceptions

·         including 3 open hardware licenses

·         More open hw planned for 3.6

·         Rethinking a bit and redefining 

·         Survey is next step

·         Phil Odence, Black Duck/Synopsys

·         Steve Winslow, LF

·         Nisha Kumar, VMWare

·         Dave Huseby, LF

·         Alexios Zavras, Intel

·         Nicolas Toussaint, Orange

·         Mark Atwood, Amazon

·         Kate Stewart, Linux Foundation

·         Gary O’Neall, SourceAuditor

·         Jilayne Lovejoy

·         Philippe Ombrédanne- nexB

·         JC Herz, Ion Channel

·         Andrew Sinclair, Canonical

·         Paul Madick, Dimension Data

·         Jack Manbeck, TI

·         Michael Herzog- nexB

·         Mark Baushke, Juniper

·         Stephanie, Qualcomm

·         Uwe, Qualcomm

Our talk for this session with be from Gary O’Neall and Steve Winslow:

SPDX: Bridging the Compliance Tool Gap

Any organization which utilizes open source software needs to comply with the open source license terms and the specific security policies of their industry.  To satisfy the basic requirement of knowing the specific open source packages included in the software, several tools have been produced which create or manage a software “Bill of Materials”.  The Software Package Data Exchange (SPDX) defines a standard format for a Bill of Materials which can facilitate harmonious integration of multiple tools.

This is a reprise of a very well-received talk they gave at the LF Open Source Leadership Summit earlier this month. If you have colleagues, friends or partners that would like to learn SPDX, this would be great 30 minute intro. Please invite them.

GENERAL MEETING

Meeting Time: Thurs, April 4, 8am PST / 10 am CST / 11am EST / 15:00 UTC. http://www.timeanddate.com/worldclock/converter.html

Conf call dial-in:

New dial in number: 415-881-1586

No PIN needed

The weblink for screenshare will stay the same at: 
http://uberconference.com/SPDXTeam

Administrative Agenda

Attendance

Minutes Approval: https://wiki.spdx.org/view/General_Meeting/Minutes/2019-03-07  

Special Presentation – Gary/Steve

Technical Team Report – Kate/Gary

Legal Team Report – Jilayne/Paul

Outreach Team Report – Jack

Any Cross Functional Issues –All