SPDX General Meeting Minutes - Feb 3, 2022

Administrative

Press release about the report
Report itself
Showing a selected set of slides from the report
In all his years as an industry analyst, he never heard of SBOMs. Now though, it's about to become a massive market.
Was careful to not be too LF biased by surveying a broad end user community.
Anticipate a 60+ percent growth of orgs using SBOMs…if the tooling exists to support that growth. He hasn't yet looked at the tools that are out there.
Not a lot of visibility for this from the vendors & tooling providers. Analysts also haven't yet done a market forecast for this, either.
Discussion on formats that wasn't included in the report. Won't summarise here as it's not really public.

Good progress on building concensus on when to use properties or relationships (packages containing files for example). Follow along in spdx-3.0-model repo.

Follow up from Docfest on some clarifications that emerged from comparisons.
Anything that we need to help people adopt SPDX for presidential order. Dick points out CMC issued an RFI that incorporates SBOM: https://sam.gov/opp/fe53a2be20094034b178e260f29cd0ad/view
For licensing-related fields that are currently mandatory but can have noassertion, looking at permitting them to be made as optional for 2.3, presuming NOASSERTION if field is omitted.

Rohit working on merge for Online tools.
Working with CycloneDX team to have tools that interoperate.
FOSDEM coming up this weekend - Software Composition and Dependency devroom, https://fosdem.org/2022/schedule/track/software_composition_and_dependency_management/

Historically added about 80 licenses to license list in 2014, based on Fedora's own list of licenses
Similar to discussion previously with Warner about use in FreeBSD
Will provide updates to General team on Fedora and FreeBSD as it proceeds

1 - 1 of 1

Home Hashtags Subgroups Terms