Create 2024-07-09.md

Adds meeting minutes and agenda SPDX Tech Team Meeting 2024-07-09

Author: robcraig-LF

tech/2024-07-09.md

@@ -0,0 +1,93 @@
+ # SPDX Tech Team Meeting 2024-07-09
+
+## Attendees
+
+- Alexios Zavras
+- Alfred Strauch
+- Arthit Suriyawongkul
+- Bob Martin
+- Dick Brooks
+- Gary O'Neall
+- Ilans
+- Jeff Licquia
+- Joshua Watt
+- Karsten Klein
+- Kate Stewart
+- Marc-Etienne Vargenau
+- Maximilian Huber
+- Nisha Kumar
+- Peter Monks
+- Steven Carbno
+
+## Agenda
+
+- Progress on Tooling - Ilans
+- Improve CI checks for bad extensions: https://github.com/spdx/spdx-examples/pull/88
+- Moving informational annexes to new repo https://github.com/spdx/using/pull/1
+- New annex on license matching https://github.com/spdx/spdx-spec/pull/968
+- Add package-url specification as an annex https://github.com/spdx/spdx-spec/pull/969
+- Update on spec production/publishing (Alexios)
+
+## Notes
+
+### Tooling
+
+- Ilans giving demo of "SPDX Explorer" visual authoring tool,
+  for reviewing the specification and generating examples.
+- Showed how the red dot shows mandatory properties.
+- Selection is set up to automatically fill in as much as possible.
+- Everything is validated as RDF, and then translated to JSON.
+- Joshua - have you run through validator?
+  Discussion with Illans - must pass JSON schema and make sure it pass so that other tools can consume.
+- Open Question:  CreationInfo - has createdBy Agent - loop.  It is intentional?    Yes, It is not a DAG.
+- Open Question:  If another SBOM has same Creation Info can't use in one SBOM.
+   - Use of External Map - From one SBOM to another - can use ExternalMap.
+     Add property of element collection. Then add externalSpdxId.
+     Then put the organization of the reference.
+   - Referencing via ExternalMap.
+   - SPDXID's are universally unique.   You can assume they are the same thing and replicate.   
+   - Best practice is to reference with ExternalMap explicitly.
+   - Currently the range for createdBy/suppliedBy is Agent.
+     But it is possible that the Agent (Organization, Person) is exist elsewhere outside
+     without being instantiated inside the current SBOM, so in the future is should be possible to use IRI.
+
+### Issues/PRs
+
+- github actions: Add check for bad extensions - No objections - merged
+- Moving informational annexes to new repo (spdx/using) - Remove the SPDX Lite profile and can be merge
+- New annex on license matching - Update branch
+- Add package-url specification as an annex (Annex E) - Bob and Gary will put comments in the PR
+
+### Update on spec production/publishing
+
+- Alexios working on generation of .pdf that can be submitted to ISO.  Working with OMG to align with guidance.
+- The same input we're generating for the website, will now be able to generate the .pdf as well.
+- As soon as the workflow is ironed out, will pull in Jeff, to update the CI so that we can run.
+- This is being done with LATEX,  and then its converted to mkdocs.
+  This is what OMG is using right now to produce the documents.
+  Standalone tool, but hopefully simple to implement.
+- Want to decide how often we run this - probably on each release.
+  This is going to be a function on each time it takes.  .pdf at point in time
+  - random .pdf builds should have a "NOT AUTHORATIVE/DRAFT/etc" build.
+- Alexios to send close draft to Jorey/Rex for further review by JDF, to make sure no surprises.
+
+### Spec parser update
+
+- Basic flow is spec parser runs,  then mkdocs runs
+- Now you will see list "Superclasses" in each element.
+- External properties cardinality updated
+- All interited properties inside software are available, inside a class!
+- After this rolls out, will ask the Japan team if they still see need for LITE Annex.
+- Roll out plan:  Discussion with Jeff on whether we're pulling from latest spec parser.   Yes,  should be.
+  - New spec parser now generating list of files for "nav" section in mkdocs.yaml.
+    This should be integrated in the next release.
+  - Will affect this CI PR https://github.com/spdx/spdx-spec/pull/950
+- Discussion on core expansion - Alexios version doesn't auto expand.
+  - Core expansion issue: https://github.com/spdx/spdx-spec/issues/958
+  - New version of readthedocs should fix.  Jeff will try to validate fix, and then apply.
+- Is it possible to put the serialized json property in the table?
+  Joshua thinks that this will help with confusion.
+  Document of JSONLD context needs to be somewhere.
+  Writing a JSON LD document from the page won't work.
+  Alexios notes that the document describes RDF model.
+  - Issue for serialized name in spec doc: https://github.com/spdx/spdx-spec/issues/975