1. Spdx
  2. Topics

Tutorials, sample RDF files

Marvin Humphrey <marvin@...>
 

Greetings,

I'm an active contributor at the Apache Software Foundation with regards to
release policy and licensing. I'd like to explore the possibility of having
an Apache project supply SPDX data in a release.

I'm imagining that we would supply SPDX data as an RDF file, because our
official releases are 100% source. I also imagine that we would want to
either hand-craft those files or generate them using open source tools.

Can you point me to some sample RDF files, tutorials, or documentation
explaining how I would go about that? It's been surprisingly difficult to
track down such materials.

Best,

Marvin Humphrey

Bill Schineller
 

Hi Marvin,
Welcome to the list and thanks for your interest!

Is this you?

https://www.openhub.net/people?query=Marvin%20Humphrey



Regarding samples and tools, our spdx-tools repo is mirrored here:
https://github.com/spdx/tools


Primary developer for those tools is Gary O'Neall, with some contributions from others.

Have a look, and I'm certain that Gary and some hands-on tech team contributors would be happy to guide you through their use.

- Bill



Bill Schineller
VP Engineering - KnowledgeBase
Black Duck Software
781-425-4405
508-308-5921 (cell)
bschineller@...

On 2/8/16, 2:49 PM, "spdx-bounces@... on behalf of Marvin Humphrey" <spdx-bounces@... on behalf of marvin@...> wrote:

Greetings,

I'm an active contributor at the Apache Software Foundation with regards to
release policy and licensing. I'd like to explore the possibility of having
an Apache project supply SPDX data in a release.

I'm imagining that we would supply SPDX data as an RDF file, because our
official releases are 100% source. I also imagine that we would want to
either hand-craft those files or generate them using open source tools.

Can you point me to some sample RDF files, tutorials, or documentation
explaining how I would go about that? It's been surprisingly difficult to
track down such materials.

Best,

Marvin Humphrey
_______________________________________________
Spdx mailing list
Spdx@...
https://lists.spdx.org/mailman/listinfo/spdx

Manbeck, Jack
 

I believe Gary has been working on a Maven plug in generator for SPDX as well if that would be useful.

Jack

-----Original Message-----
From: spdx-bounces@... [mailto:spdx-bounces@...] On Behalf Of Bill Schineller
Sent: Monday, February 08, 2016 3:04 PM
To: Marvin Humphrey; spdx@...
Subject: Re: Tutorials, sample RDF files

Hi Marvin,
Welcome to the list and thanks for your interest!

Is this you?

https://www.openhub.net/people?query=Marvin%20Humphrey



Regarding samples and tools, our spdx-tools repo is mirrored here:
https://github.com/spdx/tools


Primary developer for those tools is Gary O'Neall, with some contributions from others.

Have a look, and I'm certain that Gary and some hands-on tech team contributors would be happy to guide you through their use.

- Bill



Bill Schineller
VP Engineering - KnowledgeBase
Black Duck Software
781-425-4405
508-308-5921 (cell)
bschineller@...








On 2/8/16, 2:49 PM, "spdx-bounces@... on behalf of Marvin Humphrey" <spdx-bounces@... on behalf of marvin@...> wrote:

Greetings,

I'm an active contributor at the Apache Software Foundation with
regards to release policy and licensing. I'd like to explore the
possibility of having an Apache project supply SPDX data in a release.

I'm imagining that we would supply SPDX data as an RDF file, because
our official releases are 100% source. I also imagine that we would
want to either hand-craft those files or generate them using open source tools.

Can you point me to some sample RDF files, tutorials, or documentation
explaining how I would go about that? It's been surprisingly difficult
to track down such materials.

Best,

Marvin Humphrey
_______________________________________________
Spdx mailing list
Spdx@...
https://lists.spdx.org/mailman/listinfo/spdx
_______________________________________________
Spdx mailing list
Spdx@...
https://lists.spdx.org/mailman/listinfo/spdx

Yev Bronshteyn
 

I believe Gary mentioned said generator has a dependency on external packages in order for its output to be legal.

On 2/8/16, 3:33 PM, "spdx-bounces@... on behalf of Manbeck, Jack" <spdx-bounces@... on behalf of j-manbeck2@...> wrote:

I believe Gary has been working on a Maven plug in generator for SPDX as well if that would be useful.

Jack


-----Original Message-----
From: spdx-bounces@... [mailto:spdx-bounces@...] On Behalf Of Bill Schineller
Sent: Monday, February 08, 2016 3:04 PM
To: Marvin Humphrey; spdx@...
Subject: Re: Tutorials, sample RDF files

Hi Marvin,
Welcome to the list and thanks for your interest!

Is this you?

https://www.openhub.net/people?query=Marvin%20Humphrey



Regarding samples and tools, our spdx-tools repo is mirrored here:
https://github.com/spdx/tools


Primary developer for those tools is Gary O'Neall, with some contributions from others.

Have a look, and I'm certain that Gary and some hands-on tech team contributors would be happy to guide you through their use.

- Bill



Bill Schineller
VP Engineering - KnowledgeBase
Black Duck Software
781-425-4405
508-308-5921 (cell)
bschineller@...








On 2/8/16, 2:49 PM, "spdx-bounces@... on behalf of Marvin Humphrey" <spdx-bounces@... on behalf of marvin@...> wrote:

Greetings,

I'm an active contributor at the Apache Software Foundation with
regards to release policy and licensing. I'd like to explore the
possibility of having an Apache project supply SPDX data in a release.

I'm imagining that we would supply SPDX data as an RDF file, because
our official releases are 100% source. I also imagine that we would
want to either hand-craft those files or generate them using open source tools.

Can you point me to some sample RDF files, tutorials, or documentation
explaining how I would go about that? It's been surprisingly difficult
to track down such materials.

Best,

Marvin Humphrey
_______________________________________________
Spdx mailing list
Spdx@...
https://lists.spdx.org/mailman/listinfo/spdx
_______________________________________________
Spdx mailing list
Spdx@...
https://lists.spdx.org/mailman/listinfo/spdx
_______________________________________________
Spdx mailing list
Spdx@...
https://lists.spdx.org/mailman/listinfo/spdx

Gary O'Neall
 

Hi Marvin,

Just following up on Bill's email, I would be happy to provide you any
information/background on using SPDX/RDF for Apache.

I've also written a Maven plugin that generates SPDX/RDF files at
https://github.com/goneall/spdx-maven-plugin that may provide another
example application.

The RDF terms are defined at http://spdx.org/rdf/terms/.

Let me know what other information I can help with.

Best regards,
Gary

-----Original Message-----
From: spdx-bounces@... [mailto:spdx-bounces@...]
On Behalf Of Bill Schineller
Sent: Monday, February 8, 2016 12:04 PM
To: Marvin Humphrey; spdx@...
Subject: Re: Tutorials, sample RDF files

Hi Marvin,
Welcome to the list and thanks for your interest!

Is this you?

https://www.openhub.net/people?query=Marvin%20Humphrey



Regarding samples and tools, our spdx-tools repo is mirrored here:
https://github.com/spdx/tools


Primary developer for those tools is Gary O'Neall, with some
contributions from others.

Have a look, and I'm certain that Gary and some hands-on tech team
contributors would be happy to guide you through their use.

- Bill



Bill Schineller
VP Engineering - KnowledgeBase
Black Duck Software
781-425-4405
508-308-5921 (cell)
bschineller@...








On 2/8/16, 2:49 PM, "spdx-bounces@... on behalf of Marvin
Humphrey" <spdx-bounces@... on behalf of
marvin@...> wrote:

Greetings,

I'm an active contributor at the Apache Software Foundation with
regards to release policy and licensing. I'd like to explore the
possibility of having an Apache project supply SPDX data in a release.

I'm imagining that we would supply SPDX data as an RDF file, because
our official releases are 100% source. I also imagine that we would
want to either hand-craft those files or generate them using open
source tools.

Can you point me to some sample RDF files, tutorials, or documentation
explaining how I would go about that? It's been surprisingly
difficult
to track down such materials.

Best,

Marvin Humphrey
_______________________________________________
Spdx mailing list
Spdx@...
https://lists.spdx.org/mailman/listinfo/spdx
_______________________________________________
Spdx mailing list
Spdx@...
https://lists.spdx.org/mailman/listinfo/spdx

Marvin Humphrey <marvin@...>
 

Thanks, everyone, for the quick responses! I've successfully built and run
the tools from Github, and I found the sample RDF files within the repo.

On Mon, Feb 8, 2016 at 1:53 PM, Gary O'Neall <gary@...> wrote:

Just following up on Bill's email, I would be happy to provide you any
information/background on using SPDX/RDF for Apache.
Here's a bit more context: On my own initiative, I'm exploring SPDF as a
general solution for documenting dependency licensing for Apache projects.
See this thread I started yesterday on the Apache legal-discuss list:

http://markmail.org/message/6435qziggbjyvy6u

I've also written a Maven plugin that generates SPDX/RDF files at
https://github.com/goneall/spdx-maven-plugin that may provide another
example application.
This plugin would surely be very useful for any Maven-driven Java project, but
for my purposes, it cannot be counted on as available -- in fact the pilot
project is likely to be a C project. (There are a lot of Java projects at
Apache, but the Foundation is actually technology-neutral.) It is not
important to deliver anything concrete in the near term -- instead, the goal
is to understand how much effort it would for *any* Apache project to generate
SPDX data. The worst case is particularly important -- no Maven plugin,
minimal XML expertise, etc.

Let me know what other information I can help with.
What I envision as most helpful would be a tutorial which shows how to craft
SPDX data manually for progressively more complex scenarios.

* Start off with a single "hello world" source file.
* Add several more source files under the same license.
* Add a bundled dependency under the same license but with a different
copyright holder.
* Add a bundled dependency under a different license.
* Add a seperately-downloaded dependency under a different license.
* Generate a binary distribution.

And so on. There are naturally many corner cases to deal with (which I'm sure
comes as no surprise to you all), and I don't expect that such documentation
exists because my use case is esoteric -- but I hope that communicates where
I'm headed with this.

Marvin Humphrey

Manbeck, Jack
 

Marvin,

Thanks for the feedback on the tutorials. It's a good idea. We have started a wiki page where we are doing something similar. Ill add this as an example as well.

Wiki link: http://wiki.spdx.org/view/Technical_Team/Best_Practices

Scroll down to the examples. I think its likely we will pull them out to their own page.

Jack



-----O a wiki priginal Message-----
From: spdx-bounces@... [mailto:spdx-bounces@...] On Behalf Of Marvin Humphrey
Sent: Monday, February 08, 2016 6:53 PM
To: Gary O'Neall
Cc: spdx@...
Subject: Re: Tutorials, sample RDF files

Thanks, everyone, for the quick responses! I've successfully built and run the tools from Github, and I found the sample RDF files within the repo.

On Mon, Feb 8, 2016 at 1:53 PM, Gary O'Neall <gary@...> wrote:

Just following up on Bill's email, I would be happy to provide you any
information/background on using SPDX/RDF for Apache.
Here's a bit more context: On my own initiative, I'm exploring SPDF as a general solution for documenting dependency licensing for Apache projects.
See this thread I started yesterday on the Apache legal-discuss list:

http://markmail.org/message/6435qziggbjyvy6u

I've also written a Maven plugin that generates SPDX/RDF files at
https://github.com/goneall/spdx-maven-plugin that may provide another
example application.
This plugin would surely be very useful for any Maven-driven Java project, but for my purposes, it cannot be counted on as available -- in fact the pilot project is likely to be a C project. (There are a lot of Java projects at Apache, but the Foundation is actually technology-neutral.) It is not important to deliver anything concrete in the near term -- instead, the goal is to understand how much effort it would for *any* Apache project to generate SPDX data. The worst case is particularly important -- no Maven plugin, minimal XML expertise, etc.

Let me know what other information I can help with.
What I envision as most helpful would be a tutorial which shows how to craft SPDX data manually for progressively more complex scenarios.

* Start off with a single "hello world" source file.
* Add several more source files under the same license.
* Add a bundled dependency under the same license but with a different
copyright holder.
* Add a bundled dependency under a different license.
* Add a seperately-downloaded dependency under a different license.
* Generate a binary distribution.

And so on. There are naturally many corner cases to deal with (which I'm sure comes as no surprise to you all), and I don't expect that such documentation exists because my use case is esoteric -- but I hope that communicates where I'm headed with this.

Marvin Humphrey
_______________________________________________
Spdx mailing list
Spdx@...
https://lists.spdx.org/mailman/listinfo/spdx

1 - 7 of 7