Hello Gary, Thanks for your reply.
Regarding "Google Summer of code project", I am glad and eager to contribute. Let me know the details this week. Parallely I will experiment merging of few spdx files and keep you posted. Best regards Kotrappa. From: Gary O'Neall [mailto:[email protected]] Sent: Friday, April 18, 2014 10:58 PM To: Kotrappa DeverShetty (WT01 - Manufacturing & Hi Tech); [email protected] Cc: Akanksha Singh (WT01 - Manufacturing & Hi Tech); Ravishankar T.S (WT01 - Manufacturing & Hi Tech) Subject: RE: [SPDX Tools] Query regarding tool to combine multiple .spdx files to a single .spdx file. Hi Kotrappa, This looks reasonable to me. Also - FYI - there is a Google Summer of Code project proposal for an SPDX merge tool. I'm not sure if it will meet all of your functionality, quality or timeframe requirements - but if the project gets started, it would be great to get your help in providing the student feedback as the project gets going. We should know by next Tuesday if the project is accepted. Gary From: [email protected] [mailto:[email protected]] Sent: Friday, April 18, 2014 7:04 AM To: [email protected]; [email protected] Cc: [email protected]; [email protected] Subject: RE: [SPDX Tools] Query regarding tool to combine multiple .spdx files to a single .spdx file. Hello Gary. This is long pending task for us, I would like to clarify the steps you have mentioned here. STEP 1 >>- Merge the file level information into the document If One_spdx.xls ,Two_spdx.xls and Three_spdx.xls has to be merged, we will take "Per File Info" sheet of two spdx files, merge "FileName", "FileType", "FileChecksum" entries and remove duplicates if full path of filename and checksum matches. STEP 2 >>- Recalculate the packageVerificationCode After removing duplicates files as in step above, we will recalculate packageVerficationCode by following command java -jar spdx-tools-jar-with-dependencies.jar GenerateVerificationCode sourceDirectory [ignoredFilesRegex] where sourceDirectory - should contain all files of all three packages with out duplicates. STEP 3 >>- Merge the licenseInfoFromFiles (this is more of a set union operation, >>there should not be any duplicate file references) >From Sheet "per file Info" and column "License Info in File", we will take >all licenses references, and perform the operation as follows. For e.g. One_spdx.xls - LicenseRef-1, LicenseRef-2, LicenseRef-3 Two_spdx.xls - LicenseRef-1, LicenseRef-2, LicenseRef-3 Three_spdx.xls - LicenseRef-1, LicenseRef-2, LicenseRef-3 -- ( if above licenseref in red font are duplicates i.e "ExtractedText", "LicenseName" field matches, then name that as LicenseRef-2, all other are different) The final one will have like this. One_spdx.xls - LicenseRef-1, LicenseRef-2, LicenseRef-3 Two_spdx.xls - LicenseRef-1, LicenseRef-2, LicenseRef-3 --> will be named as LicenseRef-4, LicenseRef-5 Three_spdx.xls - LicenseRef-1, LicenseRef-2, LicenseRef-3 --> Will be named as LicenseRef-6, LicenseRef-7 Final_spdx.xls - LicenseRef-1, LicenseRef-2, LicenseRef-3, LicenseRef-4, LicenseRef-5, LicenseRef-6, LicenseRef-7 STEP 4 >>- Check to see if the package level concluded license or declared license is >>impacted by the merge ( we will have to figure out how to do it) Best regards Kotrappa. From: Gary O'Neall [mailto:[email protected]] Sent: Monday, February 10, 2014 11:19 PM To: Kotrappa DeverShetty (WT01 - Manufacturing & Hi Tech); [email protected]<mailto:[email protected]> Cc: Akanksha Singh (WT01 - Manufacturing & Hi Tech); Ravishankar T.S (WT01 - Manufacturing & Hi Tech) Subject: RE: [SPDX Tools] Query regarding tool to combine multiple .spdx files to a single .spdx file. Hi Kotrappa, Unfortunately, we do not have a tool to provide this functionality today. If you're looking for merging the file information from more than one SPDX documents into a single SPDX document representing a new package, the following steps should work: - Merge the file level information into the document - Recalculate the packageVerificationCode - Merge the licenseInfoFromFiles (this is more of a set union operation, there should not be any duplicate file references) - Check to see if the package level concluded license or declared license is impacted by the merge Note that the above will result in a single package description in a single file. The current specification does not support multiple packages being described in the same file. In SPDX 2.0 (currently under development), we will support multiple package descriptions within the same file. It would be a small to medium effort to add a merge tools - I'll add that on the list of new project ideas. The source code for the tools are available under the Apache 2.0 license at git.spdx.org under the spdx-tools project if you would like to contribute this functionality yourself. Gary From: [email protected]<mailto:[email protected]> [mailto:[email protected]] On Behalf Of [email protected]<mailto:[email protected]> Sent: Monday, February 10, 2014 4:29 AM To: [email protected]<mailto:[email protected]> Cc: [email protected]<mailto:[email protected]>; [email protected]<mailto:[email protected]> Subject: [SPDX Tools] Query regarding tool to combine multiple .spdx files to a single .spdx file. Hi, This is Kotrappa, I am from Wipro Technologies, India. We have been using FOSSology+SPDX module for open source analysis. Recently we visited SPDX workgroup tools page for format conversion and compare tools. For our automation requirement, we need "SPDX file merge tool" i.e. something which merges multiple .spdx files into a single .spdx file. Is there any tool for the same, or Will it work if we combine contents of multiple .spdx files into a single .spdx file? Best regards Kotrappa. The information contained in this electronic message and any attachments to this message are intended for the exclusive use of the addressee(s) and may contain proprietary, confidential or privileged information. If you are not the intended recipient, you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately and destroy all copies of this message and any attachments. WARNING: Computer viruses can be transmitted via email. The recipient should check this email and any attachments for the presence of viruses. The company accepts no liability for any damage caused by any virus transmitted by this email. www.wipro.com<http://www.wipro.com> The information contained in this electronic message and any attachments to this message are intended for the exclusive use of the addressee(s) and may contain proprietary, confidential or privileged information. If you are not the intended recipient, you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately and destroy all copies of this message and any attachments. WARNING: Computer viruses can be transmitted via email. The recipient should check this email and any attachments for the presence of viruses. The company accepts no liability for any damage caused by any virus transmitted by this email. www.wipro.com<http://www.wipro.com> The information contained in this electronic message and any attachments to this message are intended for the exclusive use of the addressee(s) and may contain proprietary, confidential or privileged information. If you are not the intended recipient, you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately and destroy all copies of this message and any attachments. WARNING: Computer viruses can be transmitted via email. The recipient should check this email and any attachments for the presence of viruses. The company accepts no liability for any damage caused by any virus transmitted by this email. www.wipro.com
_______________________________________________ Spdx-tech mailing list [email protected] https://lists.spdx.org/mailman/listinfo/spdx-tech
