SPDX Generation via Yocto and the New LID code License Scanner
Talkat Embedded Linux Conference + OpenIoT Summit North America 2017 · on Thursday, 2017-02-23· at 09:00· Atrium Ballroom·
summary
Integration of LiD license scanner (Python3, Docker available) with Yocto produces SPDX metadata for Dronecode releases and claims 100% coverage of SPDX templates and ~94% real-world license-hit accuracy versus Nomos/Monk. A new source-map layer archives pristine upstream tarballs, records patched file deltas and build artifact relationships (SPDX 1.2), and lets scanning run out-of-band and parallelized to avoid multi-day scans. Tooling is on CAF/GitHub; initial integration and Dockerized runs succeed but distributed scaling and multi-license region handling remain work.
AI-written summary · about
chapters (20)
- 0:00Intro
- 0:35Agenda
- 1:20What is SPDX
- 3:16Existing SPDX class
- 4:31SPDX Archiver BV class
- 6:20Limitations
- 7:08Source Map
- 10:32Initial Approach
- 12:24Sourcemap
- 20:11Nomos
- 22:25Monk
- 23:05Goals
- 26:40Example Output
- 27:14Comparative Analysis
- 27:31Coverage
- 27:52Accuracy
- 28:47Flexibility
- 31:47Example Package
- 32:38Status
- 37:12LiveMagic
related talks
49mLicensing Support by Build Systems and What Remains To Be Done- 49mLicensing Support by Build Systems and What Remains To Be Done
10mSPDX for Better License Statements
53mTooling Up for SPDX Software Package Data Exchange
26mSPDX Dashboard
16mSPDXv3: Advancing Transparency in Software
46mAdvancing Transparency and Security in Software: A Deep Dive Into SPDXv3
53mAdvancing Transparency and Security in Software: A Deep Dive into SBOM and SPDX