SPDX 3.0 Mini Summit @ Open Source Summit Europe 2023
2023-09-18
-- online --
[OSPOCon @ Open Source Summit Europe 2023, Critical Software Summit @ Open Source Summit Europe 2024, Emerging OS Forum @ Open Source Summit Europe 2022, Open Source Summit North America 2022, Community Leadership Conference @ Open Source Summit Europe 2022, OSPOCon @ Open Source Summit Europe 2022]
who it's for
spdx implementers and tool authors, security engineers, license compliance engineers, ai and machine learning engineers, functional safety engineers, supply chain managers, java and python library maintainers
topics
SPDX 3.0 data model; JSON-LD serialization for SBOMs; profiles concept (core, security, AI, services); services profile for service metadata; vulnerability modeling with externalRefs and VEX-style facts; Python SPDX tools and converters; Java SPDX libraries and storage adapters; Lite profile and JSON schema; AI profile: model provenance and training metadata; safety ASBOMs and traceability; dataset privacy detection and license recommendation; OpenChain security process standard
| title | author | length |
|---|---|---|
| Security Profile | Jeff Schutt, Thomas Steenbergen | 11m |
Adds 12 new externalRefs so SBOM entries point to evidence (assessments, tool outputs, internal reports) and new external identifiers for CVE and GitHub… | ||
| Discussion of tooling ecosystem and gaps | Jordi Mon Companys | 37m |
RC1 of SPDX 3.0 (model) exists and RC2 aims to land in about two to three weeks with a JSON-LD serialization spec; prototypes and libraries for Python and Java… | ||
| SPDX 3.0 Update | Rose Judge | 16m |
SPDX 3.0 centralizes a new profiles concept that narrows what metadata a producer must carry (security, safety, AI data, build, licensing, software, core)… | ||
| Services profile | Gary O'Neall | 04m |
A Services profile for SPDX 3.1 is under active development to record service-level metadata not covered by software SBOMs, aiming to capture certificate… | ||
| SPDX tools workshop | Maximlian Huber, Armin Taenzer | 06m |
Python SPDX tools are now at 0.8.1 release with performance fixes and a large refactor behind 0.8 that readies the code for SPDX 3.0; there is an experimental… | ||
| SPDX Java libraries & validation | Gary O'Neall | 02m |
Prototype lives on a separate branch and a generator currently in a personal repo is generating Java files from the specification so source stays in sync and… | ||
| Licensing | Steve Winslow, Alexios Zavras, Gary O'Neall | 06m |
SPDX 3.0 keeps most of 2.3 but makes three concrete changes: it adds license additions so WITH can point to custom-defined clauses, it splits licensing into… | ||
| Looking towards safety | Nicole Pappler | 20m |
Argues that SPDX can carry functional safety evidence end-to-end, mapping V‑model artifacts into machine‑readable outputs and enabling deterministic impact… | ||
| Lite Profile | Yoshiyuki Ito | 06m |
Current status of a Lite Profile pull request for SPDX: a minimal, industry-friendly subset based on SPDX Lite (adopted in SPDX 2.3 NXG) that enforces… | ||
| Dataset | Gopi Krishnan Rajbahadur, Gao Kun, Kate Stewart | 11m |
A pipeline that trains on labeled columns, injects code, computes a similarity matrix, then runs inference to separate data columns from non-data columns and… | ||
| AI Profile | Karen Bennet | 18m |
Defines an SPDX AI profile that extends a software bill of materials to record model properties, training process and provenance, and to enable automated… | ||
| New OpenChain Security Standard | Shane Martin Coughlan | 06m |
OpenChain publishes a new process standard for security assurance that has completed ISO ballots completed and already exists as a de facto spec with… | ||
| Hardware profile | Kate Stewart | 05m |
New working group launches a hardware profile to represent physical devices including FPGAs and virtualization and to capture supply chain and safety metadata… | ||
| SPDX Landscape | Jordi Mon Companys | 09m |
Landscape remains half-built and needs contributors to populate 100s of missing entries; current state uses YAML config files and a JavaScript renderer, and… | ||
| nothing matches | ||