SPDX Lite
OpenChain project Japan workgroup1 ▇▇▇ The OpenChain project Japan work group / Sony Corporation / CC0-1.0

CONFIDENTIAL

Background of SPDX Lite
•Issue in actual business• We do not receive OSS license information from our suppliers•Why can’t suppliers give the information?

• They do not know OSS license (compliance)• They cannot use tools to generate/evaluate the information•Who are our suppliers?

• Hardware vendors• ODM vendors• SoC vendors• Their software partners• They are in Japan and Asia

2 ▇▇▇ The OpenChain project Japan work group / Sony Corporation / CC0-1.0

Growing model and activity

Contribution

Improving
Process

Japan workgroup
MakingProcess
Starting
Practice
Basic
Education
Orientation

3 ▇▇▇ The OpenChain project Japan work group / Sony Corporation / CC0-1.0

CONFIDENTIAL

Growing model and activity

Contribution

Improving
Process

Japan workgroup
MakingProcess
Starting
Practice
Basic
Education
Orientation

Our suppliers’ position

4 ▇▇▇ The OpenChain project Japan work group / Sony Corporation / CC0-1.0

CONFIDENTIAL

Proposal of SPDX Lite
SPDX Lite:– Is the subset of the SPDX specification (Compatibility)– Is the minimum requirement by automotive and consumer
electronics industries (Minimum workload)– Can be manually created without special tools (Easy to create)– Has been proved by actual business (Industry oriented)

5 ▇▇▇ The OpenChain project Japan work group / Sony Corporation / CC0-1.0

CONFIDENTIAL

Scenario #1: for unskilled suppliers

LiteContribution

Improving
Process

Japan workgroup
MakingProcess
Starting
Practice
Basic
Education
Orientation

Our suppliers’ position

6 ▇▇▇ The OpenChain project Japan work group / Sony Corporation / CC0-1.0

CONFIDENTIAL

Scenario #2: for non engineering staff
Supplier

Recipient

SoftwareLicense review w/ tools
Engineering Staff
License review w/o tools

Lite

Legal Staff
Procurement Staff

7 ▇▇▇ The OpenChain project Japan work group / Sony Corporation / CC0-1.0

CONFIDENTIAL

List of SPDX Lite#corresponding SPDX section no.

License Info.

L1.2

2.2

Data License

L1.1

L1.3

L1.4

L1.5

L1.6

L1.7

L2.1

L2.2

L2.3

L2.4

L2.5

L2.6

L2.7

L2.8

L2.9

L2.10

L2.11

L2.12
L3.1

L3.2

L3.3

L3.4

2.1

2.3

2.4

2.5

2.8

2.9

3.1

3.2

3.3

3.4

3.7

3.8

3.11

3.13

3.15

3.16

3.17

3.20
6.1

6.2

6.3

6.5

SPDX Version
SPDX Identifier

Document Name

SPDX Document Namespace
CreatorCreatedPackage Name

Package SPDX Identifier
Package Version

Package File Name

Package Download Location
Files Analyzed

Package Home Page
Concluded License
Declared License

Comments on License
Copyright Text

Package Comment
License Identifier
Extracted Text
License Name

License Comment

8 ▇▇▇ The OpenChain project Japan work group / Sony Corporation / CC0-1.0

CONFIDENTIAL

Big Picture of SPDX world

Community
REUSE initiative =Copyright/License Notice+ SPDXSupplier

SPDX Lite

SPDX Lite

Under consideration
ex. Package Info.
OpenChain Compliant
Use SPDXOpenChain Non-Compliant
Use SPDXOpenChain world

Supplier

SPDX

Integrator

SPDX Lite

SPDX

Supplier

User

Supplier

OpenChain Non-Compliant
Cannot use SPDX

9 ▇▇▇ The OpenChain project Japan work group / Sony Corporation / CC0-1.0

CONFIDENTIAL