Jilayne Lovejoy <Jilayne.Lovejoy@...>
toggle quoted messageShow quoted text
Thanks for raising the question, Jeremiah, and to Mark for providing the excellent clarification – both to the benefit of all!
From: openchain-bounces@... [mailto:openchain-bounces@...]
On Behalf Of Jeremiah Foster
Sent: Friday, August 29, 2014 1:18 AM
To: Gisi, Mark
Subject: Re: [OpenChain] Hello World!
-- IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents
to any other person, use it for any purpose, or store or copy the information in any medium. Thank you.
On Fri, Aug 29, 2014 at 7:37 AM, Gisi, Mark <Mark.Gisi@...> wrote:
Jeremiah raised some common concerns about SPDX that, as an early adopter, I wanted to share my experiences.
>> while SPDX looks great, its not widely adopted. Debian has its own format and Yocto
is using SPDX
>> version 1.1. Its hard to use, has numerous supported versions (1.1, 1.2 and 2.0 in
SPDX is a specification and not a tool.
Okay, I confess I view it more as a tool, good to have this clarified for me.
It is analogous to PDF, which is also a specification. Specification details are largely relevant
to tool developers and not so much to the tool end users. Most of us view PDF files using one tool or another, but very few of us know what the specifications looks like (nor should we need to). Therefore updates to a specification largely only impact tool
developers. Adobe released multiple versions of the PDF spec over the course of the first few years. This is to be expected.
>> Being Java based (there is Go code and python code now) its better suited for those
working in a
>> Windows environment and while I'm certain that is a highly lucrative market,
>> for Free Software developers it tends to be anathema.
Since SPDX is a specification I assume you are referring to tool support. I understand your concerns
here. Additional tool support is a place where SPDX could benefit.
>> For example, while SPDX looks great, its not widely adopted.
Although the jury is still out on SPDX, it is progressing through the typical stages of technology
adoption as described in Geoffrey Moore’s entrepreneurial bible: “Crossing the Chasm”. At Wind River we see early adopter participation rapidly increasing. We have seen a tripling in customer usage over the past 12 months which includes traffic to our free
SPDX file generation website (spdx.windriver.com). Similarly, PDF too got off to a slow start, yet triumphed in the end.
>> and feels a bit like a solution looking for a problem.
Wind River’s adoption was heavily driven by a mission critical problem we faced. Wind River offers
a Linux Distro kit consisting of more than 1000 software packages plus a kernel. In the beginning, customers demanded contractually that we deliver “complete” licensing information using their “customized” format. This was a nightmare. We were required to
rummage through millions of source files to grab the specified licensing information to be put into the customer’s “custom” format. After we preformed this task it was repeated by other organizations downstream in the supply chain. We understood this cost
could be significantly mitigated if there was a commonly accepted file format we could use to record and exchange licensing information. SPDX directly solved this problem. We also utilize SPDX data in our internal compliance program.
Thanks very much for this email. Puts SPDX into the right perspective for me. I've sort of viewed it from a software engineer's view as this thing I have to add not knowing really why. If it does provide a software Bill of Materials that
can effectively provide assurance in the supply chain then clearly its a solution to a very real problem.
ARM Limited, Registered office 110 Fulbourn Road, Cambridge CB1 9NJ, Registered in England & Wales, Company No: 2557590
ARM Holdings plc, Registered office 110 Fulbourn Road, Cambridge CB1 9NJ, Registered in England & Wales, Company No: 2548782