Yeah, hello everyone. My name is Shaheem and I am Gaurav with me. We both are working
for a physiology community and we are from Siemens. So maybe let me start. So, Phosology
is open source license compliance project. Initially, it was published by HP in 2008
and in 2015 it has become Linux foundation collaboration project and Phosology is a Linux
application. It works on Linux distributions and different tasks done for OSS license compliance
by Phosology are scanning for licenses, copyrights, author ships, emails and ECC statements. Apart
from this, we have key words and IP address statements as well. And we also generate documentation
like read me OSS text documentation and unified report as well. So and then we have export
and import of SPDX files. So maybe we can discuss about SPDX files later in the slides.
So Phosology is about finding the licenses as I said already. So we scan for the source
code. So the source code might have the license text, reference to the license text or written
text explaining some licensing and then we might also have the license relevant statements.
So this all will be identified by Phosology. And later we have uploaded a component called
thrift which is Apache source code. And Phosology have found Apache license. Apart from Apache
license we have many more licenses. It is because it is very natural that OSS project
reuses the available OSS from other projects. So for example, if you see Phosology have
found 25 other licenses, relevant licenses in Apache, apart from Apache 2.0. So what
is the uniqueness about Phosology is we have conclusions. So if you take licensing can
be simple, but it might be challenging as well because you might see some unknown licenses,
written statements about licenses, some licenses might be unclear and there might be some
incomplete license statements as well. So actually to do this I think one required a
good domain knowledge. So yeah, SBOM and Phosology. So we are producers of SBOM as well as the
consumers. So Phosology produces SBOM in SPDX version 2.3 format which includes the file
level information, license findings and its conclusions and copyrights as well as the
custom license text. So as a consumer Phosology import all this information and add it to
a component as well. So more information about the SBOM will be discussed later in the slides.
So yeah, maybe Gaurav will take over and explain about the releases and more SBDX features
of Phosology. Thank you. Thanks. So yeah, with Phosology we recently released
few versions and in all of them we majorly try to sync our license set with the SBDX
license set so we are up to date. And at the same time we are continuously working to improve
our REST API so we can provide more automation flexibility to anyone who is interested to
use it. And like recently we had some GDPR updates thanks to Orange like how the user
data will be managed in the server and things like that we recently updated to Bootstrap
UI. We are planning to move to React but yeah, it's in the works. With 4.1 we recently integrated
scan code so you can upload your source code to Phosology itself and let Phosology scan
using its own scanners or if you prefer you can also use scan code and import the license
findings in Phosology itself. We also worked a little on our copyright false positive reduction
using Spacey and with the latest release so we would like to say we are reused.software
standard compliant in our source code and we also try to display the information like
whatever reused linter provides. So you can check if any project supports reused standard
they do it like that. So Phosology can, you can very easily know how much scan you have
to do. So we are coming to the recent updates with SBDX within Phosology. So since it's
a pretty old project and we had some difficulty to comply to the SBDX standards. So we decided
to take on the challenge in two steps. So first step is done what we are presenting
and the second is actually a work in progress. So what we initially started with the pain
point was the license name which gets end up in the report. So Phosology initially use
short names so which are supposed to be unique and they are actually used for identification
with internally in Phosology. So here we added a new field called SBDX ID so where you can
have different variants of the same license. So for example in a license there is a copyright
by X but for a different one the same license with a copyright Y. So the license text changes
but you can still use the same SBDX ID for both of them and that will be end up in the
report whatever you generate. In case the SBDX ID is missing or is not in the SBDX license
list so we also perform a check on that. So it will be converted as a license ref and we
have introduced this license ref Phosology prefix for that. In the upcoming updates we
will further enhance this and provide users way to write actual SBDX license expressions
including the and or and with exceptions. So with the reports with various dog fest with
SBDX we came to understand that many of our reports were flawed. So we try to fix them
as well as at the same time update it to the latest spec 2.3. So what was wrong so the
extracted licensing info was missing. So as I said you can have your own custom license
text in Phosology so if any of the file has a finding of that license text or a conclusion
on it. So the license text itself was missing from the report so we have fixed that and
also the packet verification code used by SBDX. The algorithm internally was a little
wrong so yeah minor fix and then at the same time we compared the spec and the fields which
Phosology can store. So we figured out like we can have the version information as well
in the report the release date along with external left to like PURLs, Maven, Nougat
and such stuff. And at the same time Phosology also allows you to manage your acknowledgments
and obligations. So we use the attribution text field for providing acknowledgments to
specific files and the same attribution text field for the entire package if you have any
obligation related to a license. And also the calculation of conjunctive licenses and
disjunctive license was wrong. So yeah Phosology has a special license called dual license.
So yeah we have fixed how we are going to calculate that now. So not every license in
the report is now a disjunctive license set. And yeah also at the same time added the missing
license name and text also for the listed licenses. So yeah with that I guess pretty
much all our SBDX reports should now be valid. So yeah thank you and please consider starting
us on GitHub if you do use them and if you have any questions. Yes please. Okay so the
question is which format we use for SBDX. So Phosology currently supports the RDF and
the tag value format. Okay so yeah the question is like
with the SBDX ID if there is a custom license text how it ends up in the report. So yeah
with SBDX IDF format so it's a self-contained report so it will contain your SBDX ID the
license name as well as your custom license text along with all the other various formats
which Phosology supports. Readme OSS your unified report they will work the same. It's
just that instead of using the license name which was coming from the short name field
we are going to use the SBDX ID field now. Yeah but how do you include the text of the
license in the SBDX file? Okay. Because otherwise you get only. Yeah so if you see here SBDX
has this field called license text. Okay. So you can include information like name of
the license, license ID, its text if you have any external ref and such stuff. Okay. So
it's there for IDF. For tag value I'm not very sure we need to check because for custom
text they do support it for tag value format as well. But yeah for standard they do not.
Yeah. Okay. Thank you. Any more questions? Any support to the SBDX IDF? You are planning
to do it. Yeah. Yeah yes you're planning. Okay. Any more colleagues? Yeah. Thank you.