Re: [spdx-tech] Update on website redirects

] Update on website redirects Gary, Due to changes in the output file names from the SPDX spec parser, some of these URLs need to be adjusted. Please change these redirects to the new URLs: https://spdx.org/rdf/3.0.0/spdx-model.ttl -> https://spdx.github.io/spdx-spec/v3.0/model/s

Re: [spdx-tech] Update on website redirects

Gary, Due to changes in the output file names from the SPDX spec parser, some of these URLs need to be adjusted. Please change these redirects to the new URLs: https://spdx.org/rdf/3.0.0/spdx-model.ttl -> https://spdx.github.io/spdx-spec/v3.0/model/spdx-model.ttl

[spdx-tech] Update on website redirects

Greetings all, All of the redirects for the schemas/context files for the SPDX 3.0 release are now in place. Below is the list of URL and the target of the redirects. Let me know if you have any issues accessing the files. Gary URL Redirect Target

[spdx-tech] FW: CISA SBOM update

FYI: Update an update today from Allan Friedman re: CISA SBOM activities - see email below. NOTE from Allan: As a reminder, CISA facilitates these open discussions, but the participants shape the agenda. These are also expressly not a forum for discussing USG policy, or offering any kind

[spdx-tech] Build Profile Meeting Cadence Update

an update in this list again). Cheers Brandon -=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#5011): https://lists.spdx.org/g/Spdx-tech/message/5011 Mute This Topic: https://lists.spdx.org/mt/97432955/21656 Group Owner: spdx-tech+ow...@lists.spdx.org

[spdx-tech] Build profile meeting update

Hi All, We will be resuming build profile meetings next week to put together a PR to update the build profile for the spdx-3-model. Hope everyone is having fun at FOSDEM for those that are there! Cheers Brandon -=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View

[spdx-tech] Minutes update and agenda for Tuesday's Tech Call

gt; * Decisions update from the 1 Nov 2022 tech call <https://github.com/spdx/meetings/pull/241> We covered a lot of ground on our Friday's call. We'll take the first part of the tech team call this Tuesday to discuss and gain consent on decisions made during the call. Below is the

Re: [spdx-tech] General meeting update

i should be available for the time slot On Wed, Nov 2, 2022 at 2:00 PM Gary O'Neall wrote: > Greeting tech team, > > > > For tomorrows general meeting, could we have someone from each of the > different tech sub-teams / profiles provide an update as part of the SPDX > tech

[spdx-tech] General meeting update

Greeting tech team, For tomorrows general meeting, could we have someone from each of the different tech sub-teams / profiles provide an update as part of the SPDX tech update? Team leads - if you let me know in advance, I'll try to organize the order of the reports. If no one

Re: [spdx-tech] Update on 2.3 release and schema review

l: +1 978-696-1788 From: Rose Judge Sent: Friday, June 17, 2022 3:44 PM To: g...@sourceauditor.com; d...@reliableenergyanalytics.com; 'SPDX Technical Mailing List' Subject: Re: [spdx-tech] Update on 2.3 release and schema review I think Dick is talking about comments that he made about wan

Re: [spdx-tech] Update on 2.3 release and schema review

Mailing List' Subject: Re: [spdx-tech] Update on 2.3 release and schema review I think Dick is talking about comments that he made about wanting a VDR example in appendix G not my PR adding SBOM minimum element mapping. My understanding from the tech call is that he was going to work

Re: [spdx-tech] Update on 2.3 release and schema review

O'Neall via lists.spdx.org Date: Friday, June 17, 2022 at 12:38 PM To: d...@reliableenergyanalytics.com , 'SPDX Technical Mailing List' Subject: Re: [spdx-tech] Update on 2.3 release and schema review ⚠ External Email Hi Dick, From: Spdx-tech@lists.spdx.org On Behalf Of Dick Brooks Sent: Friday

Re: [spdx-tech] Update on 2.3 release and schema review

Hi Dick, From: Spdx-tech@lists.spdx.org On Behalf Of Dick Brooks Sent: Friday, June 17, 2022 11:50 AM To: 'Gary O'Neall' ; 'SPDX Technical Mailing List' Subject: Re: [spdx-tech] Update on 2.3 release and schema review Gary, Will this pull request also include the addition of G.1.9

Re: [spdx-tech] Update on 2.3 release and schema review

Gary O'Neall Sent: Friday, June 17, 2022 2:48 PM To: 'SPDX Technical Mailing List' Subject: [spdx-tech] Update on 2.3 release and schema review Greetings SPDX tech team, I just pushed an updated schema to the existing PR: https://github.com/spdx/spdx-spec/pull/716 Thanks to all who re

[spdx-tech] Update on 2.3 release and schema review

Greetings SPDX tech team, I just pushed an updated schema to the existing PR: https://github.com/spdx/spdx-spec/pull/716 Thanks to all who reviewed the changes! There is one outstanding issue identified in the review which impacts the spec itself as well as tooling. We will need to

Re: [spdx-tech] SPDX release 2.3 - Starting to update the schema

alytics.com; 'SPDX Technical Mailing List' Subject: RE: [spdx-tech] SPDX release 2.3 - Starting to update the schema Hi Dick, Would this be considered a documentation issue or an issue that would change the schema and tools? Thanks, Gary From: Dick Brooks mailto:d...@reliablee

Re: [spdx-tech] SPDX release 2.3 - Starting to update the schema

to update the schema Gary, FYI, this version of the SPDX 2.3 spec does not contain explicit support for NIST Executive Order 14028 vulnerability disclosure reporting recommendations at the SBOM component level in appendix G, refer to NIST 5/5/2022 guidance regarding this requirement: https

Re: [spdx-tech] SPDX release 2.3 - Starting to update the schema

liableenergyanalytics.com> Tel: +1 978-696-1788 From: Spdx-tech@lists.spdx.org On Behalf Of Gary O'Neall Sent: Sunday, June 12, 2022 3:13 PM To: 'SPDX Technical Mailing List' Subject: [spdx-tech] SPDX release 2.3 - Starting to update the schema Greetings SPDX tech team, I believe

[spdx-tech] SPDX release 2.3 - Starting to update the schema

Greetings SPDX tech team, I believe I just merged in the last PR that will impact the schemas and tools for the 2.3 release of the SPDX Spec. Please review the open PR 's and open issue

Re: [spdx-tech] Proposal to update examples in the spec to JSON

22 3:57 AM To: rju...@vmware.com; Spdx-tech@lists.spdx.org Cc: Vargenau, Marc-Etienne (Nokia - FR/Paris-Saclay) Subject: Re: [spdx-tech] Proposal to update examples in the spec to JSON Hi Rose, hi all, Unless I am mistaken, I do not think the current standard defines a "default-recommended SPDX fo

Re: [spdx-tech] Proposal to update examples in the spec to JSON

: <mailto:d...@reliableenergyanalytics.com> d...@reliableenergyanalytics.com Tel: +1 978-696-1788 From: Spdx-tech@lists.spdx.org On Behalf Of Anthony Harrison Sent: Monday, June 6, 2022 6:25 AM To: Spdx-tech@lists.spdx.org Subject: Re: [spdx-tech] Proposal to update examples in the spec to JSON

Re: [spdx-tech] Proposal to update examples in the spec to JSON

All I agree that tag value should be retained (it is easy to generate :-) ) but adding JSON examples to the spec would be a good idea. I think we should ensure all the examples are equivalent. Regards Anthony -=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group.

Re: [spdx-tech] Proposal to update examples in the spec to JSON

so to keep the current examples in Tag Value in RDF formats. Best regards, Marc-Etienne From: Spdx-tech@lists.spdx.org On Behalf Of Rose Judge via lists.spdx.org Sent: Friday, June 3, 2022 1:00 AM To: Spdx-tech@lists.spdx.org Subject: [spdx-tech] Proposal to update examples in the spec to JSON Hi All

[spdx-tech] Proposal to update examples in the spec to JSON

Hi All, I won’t be able to make next week’s SPDX call so I’m hoping start an a-sync discussion here on the mailing list. In the SPDX Implementers call we’ve discussed moving away from the Tag Value format as the default-recommended SPDX format as it’s not as tooling friendly as others SPDX

Re: [spdx-tech] SPDX Java tools update related to hasFiles and Contains property

Simon, See https://www.w3.org/TR/rdf11-concepts/#change-over-time. The RDF data model is atemporal: RDF graphs are static snapshots of > information. However, RDF graphs can express information about events and about temporal > aspects of other entities, given appropriate vocabulary terms.

Re: [spdx-tech] SPDX Java tools update related to hasFiles and Contains property

David, I don't agree with this assertion: [D.K.] A hasFiles property on the Package, once created by the OEM, implies that the list of files will remain static for that version of the package, while a CONTAINS relationship implies that later documents can modify the list of files in a given

Re: [spdx-tech] SPDX Java tools update related to hasFiles and Contains property

Gary, There are two possibilities - the actual package is updated or not. You're thinking of the first case where a new version of the package artifact is released that AMENDS the previous artifact. I'm thinking of the second case, where there is no new artifact and the package OEM made an

Re: [spdx-tech] SPDX Java tools update related to hasFiles and Contains property

update related to hasFiles and Contains property Gary, I agree that "Package with a File listed in the hasFiles property is semantically the same as Package has a CONTAINS relationship with File." And that "model store" is the set of deserialized data (in SPDXv3 the mod

Re: [spdx-tech] SPDX Java tools update related to hasFiles and Contains property

Thanks Simon for the review and comments. Responses inline below. From: Spdx-tech@lists.spdx.org On Behalf Of Simon Avery via lists.spdx.org Sent: Sunday, December 12, 2021 10:50 PM To: Spdx-tech@lists.spdx.org Subject: Re: [spdx-tech] SPDX Java tools update related to hasFiles

Re: [spdx-tech] SPDX Java tools update related to hasFiles and Contains property

ed to the hasFiles property in JSON and >>> the CONTAINS relationship. >>> >>> >>> >>> If you’re a user of the SPDX Java tools, please review the following >>> since it *may* introduce an incompatibility with prior versions. >>> >&

Re: [spdx-tech] SPDX Java tools update related to hasFiles and Contains property

w the following >> since it *may* introduce an incompatibility with prior versions. >> >> >> >> If you’re an implementer of tools that read or write SPDX, you may also >> want to review this and let us know if you agree with the approach. >> >>

Re: [spdx-tech] SPDX Java tools update related to hasFiles and Contains property

at read or write SPDX, you may also > want to review this and let us know if you agree with the approach. > > > > If you’re working on the SPDX 3.0 spec, you may find this issue relevant > to some upcoming topics related to serialization/deserialization. > > > > I’d like

[spdx-tech] SPDX Java tools update related to hasFiles and Contains property

. I'd like to get feedback over the next week or two before I update the tools with the changes. Problem statement: The SPDX Java tools are currently representing the relationships between the Package and the files contained in the Package in two possibly inconsistent ways - using a hasFile

Re: [spdx-tech] Google Summer of Code update

Gary O'Neall > > Cc: 'spdx-tech' > > Subject: Re: [spdx-tech] Google Summer of Code update > > > > Hi Gary. > > > > I'd be interested in mentoring for tasks related to tools-python this > year. > > Specifically, I was hoping we could: > > > &g

Re: [spdx-tech] Google Summer of Code update

nal Message- > From: Santiago Torres Arias > Sent: Wednesday, March 10, 2021 3:25 PM > To: Gary O'Neall > Cc: 'spdx-tech' > Subject: Re: [spdx-tech] Google Summer of Code update > > Hi Gary. > > I'd be interested in mentoring for tasks related to tools-pytho

Re: [spdx-tech] Google Summer of Code update

Hi Gary. I'd be interested in mentoring for tasks related to tools-python this year. Specifically, I was hoping we could: 1. Get some tasks related to field-testing spdx3.0 features 2. Provide more user-facing CLI tooling using tools-python. 3. If Nisha approves, I was hoping we could have a

[spdx-tech] Google Summer of Code update

Greetings all, We have been informed that SPDX has been accepted to be part of the Google Summer of Code program for 2021. Applications will open up for students on March 29. However, if there are any students interested, I would strongly suggest they engage with the community through

[spdx-tech] SPDX Tools - update bookmark and request for review and feedback

Greetings SPDX Tech and SPDX legal teams, A new URL for the SPDX online tools is now be available at https://tools.spdx.org. Please change any bookmarks or links from http://spdxtools.sourceauditor.com or http://13.57.134.254/app/ to https://tools.spdx.org. A new version of the online

Re: [spdx-tech] Update on project: Validate license cross references

tail knowing all possible values, and any update on this values will require updating the projects that parse this information. So, we would like to know your thought process on this, and if storing this information is of utmost importance. MDB My opinion is that the isMatch operator should be tru

[spdx-tech] Reminder: GSoC projects page update

Just a friendly reminder to anyone with an interest to mentor or anyone who has an idea for SPDX tooling to review and update the Google Summer of Code project page at https://wiki.spdx.org/view/GSOC/GSOC_ProjectIdeas#SPDX_Workgroup_Tooling_Pro jects before Tuesday's tech call. Thanks to those

[spdx-tech] SPDX Tools Update

I plan on working on an update to the SPDX tools tomorrow, Sunday 29 Sept. This may impact the availability of the SPDX tools and the license submittal feature. Regards, Gary - Gary O'Neall Principal Consultant Source Auditor Inc. Mobile

Re: [spdx-tech] SPDX Tech call update - license namespace discussion

: SPDX Tech call update - license namespace discussion Greetings all, The minutes from today tech call can be found at https://wiki.spdx.org/view/Technical_Team/Minutes/2019-04-02 We had good discussion on the license namespace proposal. Those on the call agreed to move forward

[spdx-tech] SPDX Tech call update - license namespace discussion

and how the SPDX documents are related The project ideas page was updated rather quickly, so those of you on the call please review and update anything I missed. Thanks, Gary - Gary O'Neall Principal Consultant Source Auditor Inc. Mobile

[spdx-tech] GSoC Status Update: Licence coverage grader

Hi Mentors, I pushed some code refactoring on the repository, and today, I got an additional variable into the output dictionary and here is a potential output: { 'num_license_concluded': 0, 'num_license_possible': 0, 'total_num_files': 0, 'total_num_files_with_license': 0 };

[spdx-tech] Google Summer of Code Github Integration Project Update

Good day, I am working on the SPDX-GitHub integration. This email is an update on my progress and some future plans for this project. Right now my code is able to download and scan a repo using a scanner such as ScanCode, and outputs an SPDX document. I also have code to respond to webhook

Re: [spdx-tech] GSoC "License Coverage Grader" Project Status Update

>> files. >> >> >> >> >> >> -- zvr – >> >> >> >> *From:* spdx-tech-boun...@lists.spdx.org [mailto:spdx-tech-bounces@list >> s.spdx.org] *On Behalf Of *Kate Stewart >> *Sent:* Tuesday, 30 May, 2017 20:04 >> *To:* Krys Nuva

Re: [spdx-tech] GSoC "License Coverage Grader" Project Status Update

, during the meeting? Thanks. On Thu, May 25, 2017 at 7:30 PM, Kate Stewart <kstew...@linuxfoundation.org> wrote: > Hi Krys > > On Wed, May 24, 2017 at 3:56 AM, Krys Nuvadga <tetechri...@gmail.com> > wrote: > >> Hi kate, >> >> I am sending your

[spdx-tech] GSoC "License Coverage Grader" Project Status Update

Hi kate, I am sending your an early update on my progress as of our last hangout. ---Updates 1) Work with Scancode <https://github.com/nexB/scancode-toolkit> to generate license and copyright infos 2) Played aronud with dosocs2 <https://github.com/s

Re: Update

ifficult until all the files are in one place > to do it in one pass, though. > > Kris > > On Tue, Feb 7, 2017, at 10:58, g...@sourceauditor.com wrote: > > Thanks Kris for the update and pointers to the code. > > > > I'll give it a try - but it looks li

Re: Update

printing. When we're ready for that, I hope I can help out! It will be difficult until all the files are in one place to do it in one pass, though. Kris On Tue, Feb 7, 2017, at 10:58, g...@sourceauditor.com wrote: > Thanks Kris for the update and pointers to the code. > > I'll give

RE: Update

Thanks Kris for the update and pointers to the code. I'll give it a try - but it looks like there is a good amount of detail with access to the source, I don't expect any problems. I'm also warming up to Node as a decent infrastructure for the tooling. Do you have any tools or ideas

Re: Update

mode. It looks for an SPDX spreadsheet in > ./license-list and attempts to run the process for every license (or > exception) it finds that *does not exist* in ./src/licenses or > ./src/exceptions > > There is a branch (`git checkout current`) on the license-tool > repository that has a

Tools update

Greetings all, I have completed the RDF to Tag and Tag to RDF for the version 2.1 spec. I ran into a few spec related items. I made comments in the Google docs version of the spec on the items I found: https://docs.google.com/document/d/112x3s3g1Qg2tj8bjvIPsqIBlWUp3Sob37cvAx2ei

Implementation update and issues

Greetings all, I completed implementing the core model classes in the SPDX tools to match the 2.1 spec. I ran into one issue that may impact the specification. If an external reference type for a non-listed location is specified, in RDF it has a unique URI specified. There currently

Update

Hey folks, I've got to lead with an apology - I wasn't able to start in on converting the license data like we spoke about last call until today, and it turns out to be not as "in the bag" as I had hoped, so I'm sorry for the late response. There's just lots of variations, exceptions, and so on

Re: Update

ok thanks for the heads-up Kris. Keep on truckin' Bill Schineller VP Engineering - KnowledgeBase Black Duck Software 781-425-4405 508-308-5921 (cell) bschinel...@blackducksoftware.com On 1/31/16, 5:15 PM, "spdx-tech-boun...@lists.spdx.org on behalf of

Re: Update

Hi Kris, Thanks for letting us know. Will queue up some of the other material due for review for the meeting this Tuesday, and look forward to reviewing your work on 2/9. Kate On Sun, Jan 31, 2016 at 4:15 PM, Kris.re wrote: > Hey folks, I’ve got to lead with an

RE: Suggestion to Update Java Version

PM To: 'Yev Bronshteyn'; 'Ryan O'Meara' Cc: 'spdx-tech@lists.spdx.org' Subject: RE: Suggestion to Update Java Version I like the idea of moving to 1.7 - only concern is compatibility for existing users. I would propose that if no one objects due to compatibility or other concerns within

Suggestion to Update Java Version

Hi all, I have been making pull requests to the SPDX tools library via GitHub, and I noticed that the tools still use Java 1.6. I was wondering if we could consider updating to Java 1.7 - Oracle officially dropped support for Java 1.6 a long time ago, and is actually in the process of dropping

Re: Suggestion to Update Java Version

Given that the 2.0 tooling already requires significant code changes from the user, moving to one-before-current platform seems reasonable. I would argue it makes more sense to do it sooner rather than later, when the update has increased. On Jun 18, 2015, at 10:53 AM, Ryan O'Meara rome

RE: Suggestion to Update Java Version

...@lists.spdx.org] On Behalf Of Yev Bronshteyn Sent: Thursday, June 18, 2015 8:11 AM To: Ryan O'Meara Cc: spdx-tech@lists.spdx.org Subject: Re: Suggestion to Update Java Version Given that the 2.0 tooling already requires significant code changes from the user, moving to one-before-current

SPDX 2.0 Model update - new property

Greetings all. This does not impact the tag/value specification - just RDF. In 1.2, an SPDX document could only describe a single package. In RDF, a property in the SPDX document describesPackage is used to relate the document to the package it describes. In 2.0, an SPDX document can

Re: Do not rebase already published work! (Re: status update?)

I am curious how you arrived at 707443 . Can you remember how you did it? Code-wise it is the same as a9c4423 , but log-wise it is the same as a8afe54 . Code-wise they differ by some re-indentation and some additional comments. It is almost as if you have arrived at a8afe54 then rebase and squash

Re: Do not rebase already published work! (Re: status update?)

Head should now be at a8afe54 On Sun, Aug 17, 2014 at 11:08 AM, Hin-Tak Leung ht...@users.sourceforge.net wrote: You have made a mistake some where - as well as tried to change things while you restore. You seem to have restored the code to a9c4423 instead of a8afe54, as well as tried to

Do not rebase already published work! (Re: status update?)

Perhaps I had not mentioned it or emphasize it - it is considered VERY BAD PRACTISE to rebase and rewrite commits which are already made public. What is public is public, and should not ever be changed. You should only ever rewrite/rebase commits which have not been pushed. The reason is that

Re: Do not rebase already published work! (Re: status update?)

just e-mail it over (and to whoever else who might ask for it and check simultaneously). I don't think it is much more than a few MB's. Don't worry if you have small extra files, etc inside, but if you have large ones, i really only need the whole of the .git directory inside . So tar bz2 that

RE: RDF documentation update

@lists.spdx.org; spdx-tech- requ...@lists.spdx.org Subject: Re: RDF documentation update Ok, thanks. If possible, I volunteer to help with the testing of the tag/value on different open source projects once 2.0 is considered as stable enough, mostly to test its usability. With kind regards

RE: RDF documentation update

...@lists.spdx.org [spdx-tech-boun...@lists.spdx.org] on behalf of Gary O'Neall [g...@sourceauditor.com] Sent: Monday, July 28, 2014 6:17 PM To: spdx-tech@lists.spdx.org Subject: RDF documentation update Greetings all. I've been working on the problem of the RDF documentation and I think I came up

RE: RDF documentation update

@lists.spdx.org Subject: RE: RDF documentation update Good stuff Gary! I see what you're trying to do. I had to look closely at the screenshot to figure out which of the Superclasses each bucket of inherited properties is inherited from. Beggars can't be choosers, but an enhancement might be to indicate

RDF documentation update

Greetings all. I've been working on the problem of the RDF documentation and I think I came up with a solution. I downloaded the source for the RDF HTML documentation plugin that runs in Protege (OWLDoc). After a bit of sleuthing, I was able to figure out how it worked and modify it to

Re: RDF documentation update

Hi Gary, The screenshot looks good. Happy to see automated documentation available. Are the definitions on the screenshot also applicable to tag/value? Would it be possible to provide a snippet or sample document with the new syntax to see it in practice? Thanks. With kind regards, Nuno

RE: RDF documentation update

- From: spdx-tech-boun...@lists.spdx.org [mailto:spdx-tech- boun...@lists.spdx.org] On Behalf Of Nuno Brito Sent: Monday, July 28, 2014 3:38 PM To: spdx-tech@lists.spdx.org; spdx-tech-requ...@lists.spdx.org Subject: Re: RDF documentation update Hi Gary, The screenshot looks good. Happy

[GSOC] Go parser library update

Hello, This is just a status update for the SPDX Go Parser Library. I’m happy to say that most of the features are currently working but not very well tested (only the tag parser and lexer are extensively tested at the moment). The features are: Library - Parse SPDX files in RDF and tag

[GSOC] Python parser status update

Current working features: Tag/value parsing. Tag/value writing. There are three example files available write_tv_ex.py , parse_tv_ex.py and pp_tv.py. That demonstrate how to write out a tag/value format file, parse a tag/value file and 'pretty print' or format a tag/value format file,

Follow up on model comparison and general meeting request for model update

As a follow-up to last week's tech call, I went back through the model and compared it to the instance diagrams. I found one significant discrepancy - there are not classes or properties to describe a change between SPDX documents. This would affect the patch scenario where one SPDX document

RE: Follow up on model comparison and general meeting request for model update

and general meeting request for model update As a follow-up to last week's tech call, I went back through the model and compared it to the instance diagrams. I found one significant discrepancy - there are not classes or properties to describe a change between SPDX documents. This would affect

Re: SPDX 2.0 - update the checksum?

-tech@lists.spdx.org CC: kate.stew...@att.net SENT: Thursday, November 14, 2013 11:54 AM SUBJECT: Re: SPDX 2.0 - update the checksum? Dear Kate, Would each file still be described with an SHA-1 signature in version 2.0 as default? Sorry if I misunderstood something, I don't seem to be able

[Bug 1151] New: Update comment with 1.2

https://bugs.linuxfoundation.org/show_bug.cgi?id=1151 Bug #: 1151 Summary: Update comment with 1.2 Product: SPDX Version: 1.2 Platform: All OS/Version: All Status: NEW Severity: normal Priority: P2

Update for fossology-spdx tooling(Liang)

Greetings all. We have uploaded the package-level editing module provided by the team@UNO to FOSSology/SPDX generation tool. Now SPDX generation and package info edit functions are available at the following server. https://fossology-demo.ist.unomaha.edu We also found the [verification excluded