Gary O'Neall

icon indicating a website link sourceauditor.com icon indicating an email [email protected]

icon company Source Auditor Inc. icon location San Francisco Bay Area icon location Contributor to Linux Foundation @spdx and @OpenChain-Project projects. Consultant providing technical due diligence and open source compliance services.

Results 1059 comments of Gary O'Neall

Tagging license and license rules with "SPDX matching guidelines"

> would matching each text against the SPDX XML with https://github.com/spdx/LicenseListPublisher/blob/master/src/org/spdx/licenselistpublisher/LicenseXmlTester.java be the way? Is this code implementing the guidelines alright? @pombredanne the code to implement the matching guidelines is...

Update Schema to disallow alt and optional tags within copyright, bullet, and title text

> what is the status on this? is there a change needed in this repo? The schema file in this repo should be updated. I won't have time to work...

Address gaps in documentation of VEX implementation in SPDX 3.0

We can add the mapping as a markdown file to the [annexes directory in the spdx-spec v3](https://github.com/spdx/spdx-spec/tree/development/v3.0/docs/annexes) branch.

Address gaps in documentation of VEX implementation in SPDX 3.0

Transferring this issue to the spec repo since we are fixing this in an Annex

Several TODOs in specification version 3.0.0

Hmmm - I ran a grep on TODO's a couple months ago and I thought we took care of all of them. It looks like most of these are in...

[Discussion] Findings on Discrepancy Assessments within the SBOM Ecosystem.

Having run across SBOMs with a wide range of quality in my day job, I'm quite interested in any efforts to reduce the inconsistencies. I really appreciate the analysis done...

[Discussion] Findings on Discrepancy Assessments within the SBOM Ecosystem.

@dw763j - This week - May 1.

[Discussion] Findings on Discrepancy Assessments within the SBOM Ecosystem.

BTW - I'll be 30 minutes late to this weeks call

Add a section in the spec to describe how to upgrade from SPDX 2.X to 3.0

Moving this to the SPDX spec repo

Is there a reason for this redundancy in the example files?

This was due to a bug in the converter tool which has been fixed for a while - but apparently we need to update the examples files.