Re: Hello World!

Jeremiah Foster <jeremiah.foster@...>

On Fri, Aug 29, 2014 at 1:19 PM, Philip Odence <podence@...> wrote:
Hey Jeremiah,

It’s been a while. Forgive me for doing a lousy job educating you on SPDX.

Not at all! My misunderstanding is not due to your pedagogy. :P
Thanks, MarkG for filling in.

Having been involved in SPDX from the outset, I can tell you that there are many issues, but lack of a problem focus really isn’t one. Attached is the high level way we’ve expressed it. We’ve been well-focused, I believe, on providing a lingua franca for partners in a supply chain to exchange software BoM information. There’s been external pressure, by the way, to expand our focus, for example into OpenChain type activities—thanks, Dave Marr, for starting OC and thereby relieving the pressure. 

I think Open Chain might complement SPDX quite well.

Adoption is a challenge, a real chicken/egg problem. How do you get people to communicate in your language when it’s hard to find others who are fluent? That said Wind River, TI, Siemens, Samsung, Alcatel-Lucent and others have all started using SPDX internally and increasingly with partners. I have been heartened this year to learn of a number of companies using SPDX who have never been involved with the group developing the standard. We would love their involvement, but that fact that organizations can get value, without being in the middle of SPDX specification development, says to me we’ve turned a corner and that the virtuous cycles are starting to spin.

Version 2.0 does look promising. I think SPDX would benefit greatly from some more public roadmap description and perhaps a promise that the format churn might settle a little. Having to use version 1.1 in Yocto (with a paucity of good documentation) and wanting 2.0 features is a bit suboptimal, but then that is not SPDX's fault. Communicating a roadmap and promising some stability (1.1, 1.2, 2.0 seem to have come out rather quickly after each other) would potentially go a long way towards adoption.



The SPDX group will stay close to the OpenChain activities. As Bogart said, “I think this is the beginning of a beautiful friendship.” 


Join to automatically receive all group messages.