Hi,
We're now less than on month away from LinuxCon, and we wanted to get some
information out for those who want to participate in the SPDX 2.0 Bakeoff. If
you can make it to Seattle that’s fantastic -- we look forward to meeting you
or re-connecting! If you can’t make it in person that’s OK -- you may still
upload your SPDX files.
A folder has been setup to share SPDX files for the SPDX Bakeoff workgroup
session scheduled for Monday morning August 17, 2015. We’ll be meeting in
Virginia Room (located on the 4th floor, Union St side of hotel) from 9:00am -
1:00pm.
In order to facilitate the analysis and discussion we are asking everyone who
has tools that generate SPDX to at least generate an SPDX file (tag-value
format) for Time v1.7 (a small package for the purpose of comparing SPDX output
from different tools), cpio 2.10 and spdx-tools v 2.0 .
Please use the links to the source packages in the table below so that we are
comparing “apples to apples.” Then simply create a folder with the name of
your organization and just drop the SPDX files in there. If you have any
questions or problems email [email protected].
Also please fill out our sign-up form to let us know what additional topics you
would like to see covered in this session.
SPDX files to be compared:
|
| Simple SPDX Document Creation | SPDX Document Creation with Internal
Relationships | SPDX Document Creation with External Relationships |
| Packages | gnu Time 1.7 | cpio 2.10 | spdx-tools v 2.0
|
| Notes | This is the same package we used for the SPDX 1.1 bake-off. It is a
small package and should be reasonably straight forward. Deprecated fields
should not be used. | This is a package has a bit more files to it and there
are different file types and relationships internal to the package. | This is a
Maven project with external dependencies listed in the project POM. Don’t pay
too much attention to the SPDX file in the git repository - it is a 1.2 version
and does not include all of the dependencies. |
Reference Information:
- SPDX 2.0 specification
- SPDX 2,0 bakeoff README
Instructions:
- Create a folder for your tool in “SPDX 2.0 Bake-Off” folder.
- see example “doSoCs (UNO)”
- please remember to make sure that it is readable.
- Create a copy of the template for the tools’ environment context and put
into your tool’s folder.
- Add the SPDX files generated for the reference examples into your tool’s
folder.
- Ideally, please consider run the SPDX files through the verification tool
(aka translator) indicate if not run. The verification tool can be downloaded
from
https://github.com/spdx/tools/releases/download/V2.0.2/spdx-tools-2.0.2-jar-with-dependencies.jar.
Verification can be run executing the downloaded jar file with the command
“verify” with a single parameter of the SPDX file (e.g. java -jar
spdx-tools-2.0.2-jar-with-dependencies.jar myspdxfile.spdx).
- If you have any questions, feel free to email [email protected] and
we’ll try to help.
Thanks, Jack, Gary & Kate
_______________________________________________
Spdx mailing list
[email protected]
https://lists.spdx.org/mailman/listinfo/spdx
