Tooling Up for SPDX Software Package Data Exchange
summary
Overview of practical SPDX tooling and measurable results: a pipeline combines Fossology (pathology) signatures, the Ninka license extractor, and an expert-rule engine called ZDarwin to weight and reconcile outputs, plus a developer-level proposal of silver bullet tags embedded in source files. Wind River measures against human-made "high definition" benchmarks across ~800 packages and shows automated scores moving from 538 to 581 to a combined 905/1000 when silver-bullet-like tagging is present. Demos and scripts for injection, comparison, and quality-index rules are available.
AI-written summary · about
chapters (7)
- 0:00Start
- 1:16Agenda
- 4:42Background
- 6:17Presentation Goal
- 7:11zDarwin Project
- 18:04Silver Bullet Agent
- 48:15Tool Information: Ninka
related talks
46mAdvancing Transparency and Security in Software: A Deep Dive Into SPDXv3
10mSPDX for Better License Statements
46mSPDX Generation via Yocto and the New LID code License Scanner
53mAdvancing Transparency and Security in Software: A Deep Dive into SBOM and SPDX
16mSPDXv3: Advancing Transparency in Software
49mLicensing Support by Build Systems and What Remains To Be Done- 49mLicensing Support by Build Systems and What Remains To Be Done
28mSPDX: Tackling System Risk in Modern Supply Chains