Create 2024-07-08.md

Adds meeting minutes and agenda SPDX Tech Team Meeting - ASIA 2024-07-08

Author: robcraig-LF

asia/2024-07-08.md

@@ -0,0 +1,51 @@
+# SPDX Tech Team Meeting - ASIA 2024-07-08
+
+## Attendees
+- Norio Kobota
+- Nobuyuki Tana
+- Takashi Ninjouji
+- Yoshiyuki Ito
+- Kate Stewart
+- Bob Martin
+- Joshua Watt
+
+## Agenda
+
+- Discussion of 3.0 - SPDX Lite Annex
+- Timeline for 3.1?
+- Conformance of specification to SBOM definition.   Conformance to specific profile. 
+- Feedback on example? 
+- Open Compliance Summit?
+
+## Notes
+
+- Discussion of SPDX Lite Annex in the specification
+   - After discussion with Gary, we'll keep this Annex in the specification 
+   - If further tutorials on you to use SPDX-Lite - need to put the additional information in the "Using SPDX 3.0" guide, rather than add to this annex.
+   - Any key "bugs" need to be fixed by end of month. 
+
+- SPDX 3.1 timing- will follow after 3.0 goes to ISO.
+  Probably looking at spring for release. Working to get SPDX 3.0 to ISO this fall.
+
+- Looking for guidance on how to compare/convert between versions of SPDX.
+  - SPDX 3.0 minimum items, need to have guidance.
+    Looking for conversion of SPDX lite from 2.3 to SPDX lite 3.0.
+    What should minimum elements be specified, and compliance checks.
+  - Guidelines on conversion should be made?   Something Japan team can tackle in written guidances.   "Using SPDX document" for this?
+  - Gary tools working for translation from 2.3 to 3.0.   Maybe useful starting point?
+  
+  - Feedback on Examples: We have already sent a PR from here, but should we document in detail the contents of the README included in this PR? https://github.com/NorioKobota/spdx-examples/tree/lite-profile/lite
+    - .json-ld extension stopped it getting checked by the CI.   Recommend to rename as .json
+    - documents need some minor fixups to conform.
+    - because multiple version of SPDX in repository - all SPDX 3.0 examples should be in directory /spdx-3.0/
+    - Joshua to add inline comments in pull request (https://github.com/spdx/spdx-examples/pull/91)
+    - key will be to get it to pass CI checks.   Structure looks good overall. 
+
+- Open Compliance Summit?
+   - Watanabe-san - may have posted about SPDX 3.0 translation.
+   - Other topics?    SPDX 3.1?
+
+- Working on secure software development standard.
+  How SBOM management is in the process is a topic?
+   - Most are looking at SBOMs as way of conveying in general.
+     However looking at guidance of SSD - figuring out where to act for SBOM or build data in SPDX will make it more automatable.