SPDX Lite
Hiro Fukuchi, Sony (hiroyuki.fukuchi@sony.com)
OpenChain project Japan workgroup1 ▇▇▇ The OpenChain project Japan work group / Sony Corporation / CC0-1.0

CONFIDENTIAL

Background of SPDX Lite
•Problem in actual business• We do not receive OSS license information from our suppliers•Why can’t suppliers give the information?

• They do not know OSS license (compliance)• They cannot use tools to generate/evaluate the information•Who are our suppliers?

• Hardware vendors• ODM vendors• SoC vendors• Their software partners• They are in Japan and Asia•We want to resolve the problem

2 ▇▇▇ The OpenChain project Japan work group / Sony Corporation / CC0-1.0

Member companies•Automotive and Suppliers• Toyota Motors• DensoTen• Panasonic• Pioneer•Consumer Electronics:• Sony•IT:• Fujitsu•Precision Instruments• Olympus•Semiconductor• Renesas Technology

3 ▇▇▇ The OpenChain project Japan work group / Sony Corporation / CC0-1.0

Growing model and activity

Contribution

Improving
Process

Japan workgroup
MakingProcess
Starting
Practice
Basic
Education
Orientation

4 ▇▇▇ The OpenChain project Japan work group / Sony Corporation / CC0-1.0

CONFIDENTIAL

Growing model and activity

Contribution

Improving
Process

Japan workgroup
MakingProcess
Starting
Practice
Basic
Education
Orientation

Our suppliers’ position

5 ▇▇▇ The OpenChain project Japan work group / Sony Corporation / CC0-1.0

CONFIDENTIAL

Proposal of SPDX Lite
SPDX Lite:– Is the subset of the SPDX specification (Compatibility)– Is the minimum requirement by automotive and consumer
electronics industries (Minimum workload)– Can be manually created without special tools (Easy to create)– Has been proved by actual business (Industry oriented)

6 ▇▇▇ The OpenChain project Japan work group / Sony Corporation / CC0-1.0

CONFIDENTIAL

Scenario #1: for unskilled suppliers

LiteContribution

Improving
Process

Japan workgroup
MakingProcess
Starting
Practice
BasicEducation
Orientation

Our suppliers’ position

7 ▇▇▇ The OpenChain project Japan work group / Sony Corporation / CC0-1.0

CONFIDENTIAL

Scenario #2: for non engineering staff
Supplier

Recipient

SoftwareLicense review w/ tools
Engineering Staff
License review w/o tools

Lite

Legal Staff
Procurement Staff

8 ▇▇▇ The OpenChain project Japan work group / Sony Corporation / CC0-1.0

CONFIDENTIAL

List of SPDX Lite#corresponding SPDX section no.

License Info.

L1.2

2.2Data License

L1.1

L1.3

L1.4

L1.5

L1.6

L1.7

L2.1

L2.2

L2.3

L2.4

L2.5

L2.6

L2.7

L2.8

L2.9

L2.10

L2.11

L2.12
L3.1

L3.2

L3.3

L3.4

2.1

2.3

2.4

2.5

2.8

2.9

3.1

3.2

3.3

3.4

3.7

3.8

3.11

3.13

3.15

3.16

3.17

3.20
6.1

6.2

6.3

6.5

SPDX Version
SPDX Identifier

Document Name

SPDX Document Namespace
CreatorCreatedPackage Name

Package SPDX Identifier
Package Version

Package File Name

Package Download Location
Files Analyzed

Package Home PageConcluded License
Declared License

Comments on License
Copyright Text

Package Comment
License Identifier
Extracted Text
License Name

License Comment

9 ▇▇▇ The OpenChain project Japan work group / Sony Corporation / CC0-1.0

CONFIDENTIAL

Big Picture of SPDX world

Community
REUSE initiative =Copyright/License Notice+ SPDX

Unskilled
Supplier

SPDX Lite

SPDX Lite

Under consideration
ex. Package Info.
OpenChain Compliant
Use SPDXOpenChain Non-Compliant
Use SPDXSPDX OpenChain world

Supplier

SPDX

Integrator

SPDX Lite

SPDX

Supplier

User

Unskilled
Supplier

OpenChain Non-Compliant
Cannot use SPDX

10 ▇▇▇ The OpenChain project Japan work group / Sony Corporation / CC0-1.0

CONFIDENTIAL

Big Picture of SPDX world

Community
REUSE initiative =Copyright/License Notice+ SPDX

SPDX OpenChain world

Expand SPDX and OpenChain world

Supplier

SPDX Lite

SPDX

Under consideration
ex. Package Info.
OpenChain Compliant
Use SPDXOpenChain Non-Compliant
Use SPDX

Supplier

SPDX

Integrator

SPDX Lite

SPDX

Supplier

User

Unskilled
Supplier

OpenChain Non-Compliant
Cannot use SPDX

11 ▇▇▇ The OpenChain project Japan work group / Sony Corporation / CC0-1.0

CONFIDENTIALSPDX Lite samples:
https://github.com/OpenChain-Project/Japan-WGGeneral/tree/master/License-Info-Exchange/SPDX-Lite-sample

12 ▇▇▇ The OpenChain project Japan work group / Sony Corporation / CC0-1.0

CONFIDENTIAL