SPDX Introduction
The Software Package Data Exchange® (SPDX®) specification is a standard format for communicating the licenses and copyrights for components of a software package.  The vision of SPDX is to achieve software license compliance with minimal cost across the software supply chain with a primary focus on compliance with open source licenses.

The SPDX Technical Team members develop open source tools to create, convert and validate SPDX documents.

SPDX Community
Website - www.spdx.org
Wiki – http://wiki.spdx.org
GitHub
    https://github.com/goneall/SPDX-Tools
    https://github.com/spdx-tools/fossology-spdx
Mailing Lists  
http://lists.spdx.org/mailman/listinfo
http://lists.spdx.org/mailman/listinfo/spdx-tech
IRC channel - #spdx on freenode
Code Licenses: Apache 2.0, BSD 2-Clause

PROJECTS

Eclipse Maven (m2e) SPDX Extension
Develop an Eclipse Maven (m2e) Extension which will produce and maintain an SPDX document within the Eclipse development environment. This will enable software developers using the Eclipse IDE an easy method of developing and maintaining SPDX documents.

Skills Needed
Experience with the Eclipse IDE
Experience with Maven
Java software coding skills
Understanding of the software development and build process

Background Information
The Extension Development Wiki describes what is involved in writing an m2e extension. The spdx-maven-plugin, which generates SPDX documents within a Maven script, can provide an example of a similar software project. The SPDX specification itself will describe the output of the tool.

Mentor: Gary O'Neall

Parser Libraries
Create a library for creating and parsing SPDX documents in a popular programming language. This will enable other tools developers to easily add SPDX support and create a larger community of tools developers.

Skills Needed
Development skills in the language of choice
Experience with parser development
Understanding of RDF and XML

Background Information
SPDX currently provides libraries supporting the reading and writing of SPDX document. Currently, only Java libraries have been developed. There has been several requests for libraries in additional languages. The libraries must support both RDF/XML import/export as well as tag/value import/export. The SPDX git repository SPDX Tools project contains the source code for the Java libraries.

Mentor: Gary O'Neall

Online Validation Tools
Create a web accessible tool for validating SPDX documents.

Skills Needed
Software development skills for Web based applications
Good user interface design skills

Background Information
An online form which allows the uploading, parsing, and validation of SPDX would provide immediate benefit to the SPDX community. There is no specific programming language requirement, but there is an existing Java library which could be used in the project. Some of the technical challenges for this project include having to handle long running operations and implementing a very robust parser implementation able to handle any input. Additional online tools could also be added, such as document format conversion and reporting/pretty printing.

Available Mentor: Gary O'Neall

Source Code License Identifier Parser
Create a tool which will parse source code and create an SPDX document based on SPDX standard license identifiers found in the source code.

Skills Needed
Experience developing parser/scanners
Understanding of various programming languages
Java development experience a plus

Background Information
There is a proposal to add Meta Tags in source code comments. Once these license ID's have been produced, this tool could scan the source code for the meta tags and create the appropriate SPDX document. There is no language requirement, however there are existing Java libraries which could help build the SPDX document.

Available Mentor: Gary O'Neall

Merge Tool
Create a tool to merge multiple SPDX documents into a single SPDX document updating all the appropriate fields. This tool has been requested by corporate users who will be using it in their software development process.

Skills Needed
Java software coding skills
Understanding of the software development and build process
Experience developing in an environment with multiple developers and multiple committers

Background Information
It is recommended that the existing SPDX tools framework be used as a base for the tools. The SPDX git repository SPDX Tools project contains the source code for the framework. There will likely be some interaction with some of the companies requesting the tool. The SPDX workgroup tools webpage provides an overview of the current tools implemented using this framework.

Available Mentor: Gary O'Neall

Fossology+SPDX Tools
Support the advancement of tooling to produce SPDX documents from the FOSSology open source package scanner. This tool supports the integration of the SPDX standard into current license scanning practices.

Skills Needed
Linux environment skills
PHP software coding skills
MySQL database skills
GitHub repository management skills
Understanding of the software development and build process
Experience developing in an environment with multiple developers and multiple committers

Background Information
This project was one of the first open source tooling projects aimed at integrating the SPDX standard into package scanning software. The project began in 2012 at the University of Nebraska Omaha's Open Source Lab, aimed at bridging two open source initiatives in the advancement of both communities. The project has evolved to include both web-based and command line tools in the integration of FOSSology and SPDX. Future work includes interface redesign, FOSSology performance improvements, and the inclusion of additional package scanning software results to improve the robustness of SPDX documents. Current source is available here.

Available Mentor: Matt Germonprez

Yocto+SPDX Tools
Support the advancement of tooling to produce SPDX documents as part of the Yocto build process. The Yocto Project is an open source project supported by the Linux Foundation. The Yocto project “provides templates, tools and methods to help you create custom Linux-based systems for embedded products regardless of the hardware architecture.” The proposed project integrates the production of SPDX documents into upstream, open source projects intending to advance open compliance standards. Current source is available here.

Skills Needed
Linux environment skills
Python software coding skills
MySQL database skills
JSON format skills
GitHub repository management skills
Understanding of the software development and build process
Experience developing in an environment with multiple developers and multiple committers

Background Information
This project was intended to bridge two Linux Foundation supported projects in SPDX and Yocto. It was also aimed at identifying upstream open source projects that could help the distribution of the SPDX documents. A critical component of the SPDX standard is its production and consumption in software supply chains. Upstream projects offer considerable potential in large scale, albeit data poor, SPDX documents. Work on the Yocto+SPDX project would continue to refine the systems by which SPDX documents are built during automated build processes.

Available Mentor: Matt Germonprez