SPDX 3.0 Overview  ## Metadata - Author: [[YouTube]] - Full Title: SPDX 3.0 Overview - Category: #articles - Document Note: --- tags: [spdx, sbom, supply-chain-security] author: SPDX source: YouTube reference: https://www.youtube.com/watch?v=J_RzbPMYDMM date created: 2024-12-28 14:30 --- # 🏷️ Title: SPDX 3.0 Overview ## 🧰 Action Inbox - [H1] Review SPDX 3.0 release candidate model — Available now #spdx - [H2] Monitor Python library release — Expected in 1-2 weeks #tools - [H3] Evaluate profile needs for organization — Security, AI, Build, Licensing #planning ## 🧭 Table of Contents - [📝 Summary](#-summary) - [📖 Main Content](#-main-content) - [🗒️ Notes](#️-notes) - [📚 References](#-references) - [🗣️ Paraphrase](#️-paraphrase) - [📰 Newsletter](#-newsletter) - [✅ Action Items](#-action-items) - [🧪 Hypotheses](#-hypotheses) - [📊 Methodology](#-methodology) - [❓ Questions](#-questions) - [🔮 Future Research](#-future-research) - [💡 Implications](#-implications) - [🧠 Learning Styles Assessment](#-learning-styles-assessment) - [📊 Accessibility Assessment](#-accessibility-assessment) - [🌍 DEIB Assessment](#-deib-assessment) - [✅ Logical Validity](#-logical-validity) - [🛡️ DARVO Analysis](#-darvo-analysis) - [🎯 Conclusion](#-conclusion) ### 🔗 References - [SPDX 3.0 Model Release Candidate](https://github.com/spdx/spdx-3-model) - [CSA SBOM Types Reference](https://www.cloudsecurityalliance.org/) ## 📝 Summary - SPDX 3.0 represents a major evolution to support non-licensing scenarios including security, AI/ML, and safety-critical systems - Release candidate model is available now, with Python tools and serializations coming within weeks - New profile system allows focused use cases while maintaining backward compatibility - Introduces five types of SBOMs across software lifecycle: Design, Source, Build, Deployed, and Runtime - Collaboration with OMG CISC ensures unified approach rather than competing standards ## 📖 Main Content SPDX 3.0 marks a significant expansion from the licensing-focused 2.x versions to a comprehensive software supply chain transparency standard. The initiative addresses growing industry needs for security vulnerability tracking, AI model transparency, and safety-critical system requirements while maintaining full support for traditional licensing compliance use cases. The new profile-based architecture allows organizations to implement only the components they need - whether licensing, security, AI/ML, build, or usage profiles - while maintaining interoperability. This addresses long-standing feedback that SPDX was "too complicated" for simple SBOM generation. A key innovation is the formal definition of five SBOM types aligned with software lifecycle phases: Design (planning), Source (development), Build (compilation/packaging), Deployed (configuration), and Runtime (operational state). Each type captures facts available at that lifecycle stage and can reference earlier SBOM types, creating a traceable chain of software evolution. The technical foundation shifts from specification-first to model-first development, enabling automatic schema generation and better tool support. The model will generate JSON schemas, serialization formats, and comprehensive documentation automatically. ## 🗒️ Notes #### ⏱️ [00:00](https://www.youtube.com/watch?v=J_RzbPMYDMM?t=0) — [H1] Introductions and Context Setting - Key idea: Diverse stakeholder representation from VMware, Google, BBC, government, and international contributors - Evidence: "I work at VMware I'm on the spdx steering committee and I've been working on the spdx security profile" #### ⏱️ [07:30](https://www.youtube.com/watch?v=J_RzbPMYDMM?t=450) — [H1] Why SPDX 3.0 is Needed - Key idea: Expansion beyond licensing to support security, AI, and safety-critical use cases - Evidence: "there's been a lot of interest in using spdx for non-licensing scenarios" #### ⏱️ [09:15](https://www.youtube.com/watch?v=J_RzbPMYDMM?t=555) — [H2] AI and Data Set Transparency Requirements - Key idea: AI models require same transparency as compiled software for vulnerabilities and licensing - Evidence: "similarly as you compile and build an application you're creating your trained models" #### ⏱️ [10:00](https://www.youtube.com/watch?v=J_RzbPMYDMM?t=600) — [H2] OMG CISC Collaboration - Key idea: Joint effort with OMG to avoid competing standards and support data lake architectures - Evidence: "not yet another s-bomb we actually tried to very adjust on the spdx side as well as on the OMG side" #### ⏱️ [11:30](https://www.youtube.com/watch?v=J_RzbPMYDMM?t=690) — [H2] Profile-Based Simplification - Key idea: Profiles enable focused use cases while maintaining overall capability - Evidence: "making it very simple to see was part of it so making that the minimum easy to just basically access" #### ⏱️ [13:00](https://www.youtube.com/watch?v=J_RzbPMYDMM?t=780) — [H1] SPDX Historical Evolution - Key idea: Major breaking change precedent exists from 1.2 to 2.0 transition - Evidence: "we've gone through a breaking change before as a community" #### ⏱️ [15:45](https://www.youtube.com/watch?v=J_RzbPMYDMM?t=945) — [H1] 3.0 Timeline and ISO Process - Key idea: 3.0 releasing this year, ISO submission after field experience - Evidence: "we will be releasing the three of um spec Etc this year" #### ⏱️ [16:30](https://www.youtube.com/watch?v=J_RzbPMYDMM?t=990) — [H2] Release Candidate Availability - Key idea: Model release candidate available now for tool developers - Evidence: "the 3-0 model release candidate is out now as of last weekend" #### ⏱️ [18:00](https://www.youtube.com/watch?v=J_RzbPMYDMM?t=1080) — [H2] Development Process Change - Key idea: Model-first approach replaces specification-first development - Evidence: "we've changed the order right now we're having the model out there and then the specification will be generated" #### ⏱️ [19:30](https://www.youtube.com/watch?v=J_RzbPMYDMM?t=1170) — [H2] Automatic Schema Generation - Key idea: Schemas automatically generated from model metadata - Evidence: "we're also having the classes properties and enumerations or vocabularies the metadata is there for each element" #### ⏱️ [21:00](https://www.youtube.com/watch?v=J_RzbPMYDMM?t=1260) — [H1] Five SBOM Types Introduction - Key idea: Different SBOM types capture facts available at different lifecycle stages - Evidence: "there's different types of s-bombs that they're included here" #### ⏱️ [22:15](https://www.youtube.com/watch?v=J_RzbPMYDMM?t=1335) — [H2] SBOM Type Usage Patterns - Key idea: Security focuses on build SBOMs, licensing on source SBOMs - Evidence: "security people have focused mostly on the build as bombs so if you have a security people talking about a sponsor usually thinking build" #### ⏱️ [24:00](https://www.youtube.com/watch?v=J_RzbPMYDMM?t=1440) — [H2] SBOM Lifecycle Mapping - Key idea: SBOM types align with software development lifecycle phases - Evidence: "Your Design is happening when you're doing your planning your Source s-bombs usually are happening on procurement and development" #### ⏱️ [25:30](https://www.youtube.com/watch?v=J_RzbPMYDMM?t=1530) — [H3] Facts vs Guesses Philosophy - Key idea: Recording facts at appropriate lifecycle stages improves SBOM trustworthiness - Evidence: "the more times in this ecosystem we can record facts rather than guesses the more we're gonna be able to trust these documents" ## 📚 References - [SPDX 3.0 Model Repository](https://github.com/spdx/spdx-3-model) - [CSA SBOM Types Framework](https://www.cloudsecurityalliance.org/) - [OMG CISC Initiative](https://www.omg.org/) - [ISO/IEC 5962:2021 SPDX Standard](https://www.iso.org/standard/81870.html) ## 🗣️ Paraphrase - SPDX 3.0 expands from a licensing-focused format to a comprehensive software transparency standard supporting security, AI, and safety use cases through a profile-based architecture - The new model-first development approach automatically generates schemas and tools, with a release candidate available now and Python libraries coming within weeks - Five SBOM types (Design, Source, Build, Deployed, Runtime) capture facts at different software lifecycle stages and can reference each other to create comprehensive traceability ## 📰 Newsletter The SPDX community has released the 3.0 model release candidate, marking a major evolution in software supply chain transparency. This isn't just another version bump - it's a fundamental expansion from licensing compliance to comprehensive software lifecycle visibility. **What's New:** SPDX 3.0 introduces profiles for security, AI/ML, and safety-critical systems while maintaining full licensing support. The new architecture lets you implement only what you need without losing interoperability. **For WordPress Users:** This evolution particularly benefits the WordPress ecosystem's complex plugin and theme dependencies. The new SBOM types can track components from development through deployment, crucial for managing WordPress sites with dozens of dependencies. **Timeline:** Python tools arrive within weeks, with full specification following. The model-first approach means tool developers can start building immediately from the available schemas. Resources: [SPDX Model](https://github.com/spdx/spdx-3-model), [Developer Docs](https://developer.wordpress.org/), [WP-CLI](https://wp-cli.org/) ## ✅ Action Items #### DevRel - Developer advocacy: Present SPDX 3.0 capabilities at WordCamps and meetups, create demo integrations - Education: Develop workshops on SBOM integration for plugin/theme developers - Developer experience: Create WordPress-specific SPDX generation tools and documentation - Developer marketing: Content series on supply chain security for WordPress ecosystem - Community management: Facilitate discussions between WordPress and SPDX communities #### OSPO - Policy & Governance: Evaluate SPDX 3.0 adoption requirements and timeline - License Compliance: Pilot source SBOM generation for WordPress core and major plugins - Security Management: Implement build SBOM generation for vulnerability tracking - Software Inventory: Plan SPDX 3.0 integration with existing dependency management - Developer Support: Training materials for SPDX 3.0 profiles and use cases - Community Engagement: Contribute feedback during release candidate phase - Strategic Alignment: Align SBOM strategy with broader supply chain initiatives #### Community - Maintainers: SBOM generation guidance for plugin/theme repositories - Contributors: Tooling for automatic SPDX metadata in contributions - Sponsors: Transparency reporting using standardized SBOM formats - Ecosystem: Cross-platform SBOM sharing protocols and standards #### WordPress - Core: Integrate SPDX generation into build process, establish core SBOM publication - Core Performance: Profile performance impact of SBOM generation and validation - Core AI: Evaluate AI profile applicability for AI-powered WordPress features - Security: Implement security profile for vulnerability disclosure and tracking - Plugins: Repository integration for automatic SBOM generation and validation - Themes: Similar SBOM requirements and generation for theme directory - Meta: API endpoints for accessing component SBOMs and dependency information - CLI: Commands for SBOM generation, validation, and dependency analysis - Hosting: Guidelines for SBOM collection and analysis across hosting providers #### The WPCC - Programs: Fellowship projects focused on SPDX tooling for WordPress ecosystem - Projects: Open source SBOM tools specifically designed for WordPress workflows - Funding: Support SPDX community development relevant to WordPress use cases #### FAIR - Technical independence: Ensure WordPress SBOM generation doesn't lock into specific vendors - Policies: Transparency requirements for dependency management and security reporting - Governance artifacts: Standards for SBOM publication and maintenance ## 🧪 Hypotheses - Profile-based architecture will reduce SPDX adoption barriers by allowing incremental implementation of specific use cases - Model-first development approach will accelerate tool ecosystem growth compared to specification-driven development - Five SBOM types will enable comprehensive software lifecycle traceability from design to runtime - Collaboration with OMG CISC will prevent ecosystem fragmentation and enable enterprise data lake integration ### 📊 Methodology - Comparative analysis of adoption rates between SPDX 2.x and 3.0 across different user segments - Tool ecosystem growth metrics measuring time from model release to functional implementations - Supply chain traceability effectiveness studies using linked SBOM types - Enterprise integration success rates for data lake and query capabilities ### ❓ Questions - How will existing SPDX 2.x tools and workflows transition to the new model-based architecture? - What governance mechanisms will ensure profile consistency across different tool implementations? - How will the five SBOM types handle complex deployment scenarios like containerized microservices? ### 🔮 Future Research - Impact measurement of lifecycle-based SBOM generation on vulnerability response times - Analysis of AI profile effectiveness for machine learning model transparency and governance - Comparative study of SPDX 3.0 vs other SBOM standards for enterprise adoption patterns ### 💡 Implications - Practice: Organizations need to plan profile adoption strategies and tool migration paths - Policy: Regulatory frameworks may need updates to accommodate expanded SBOM capabilities - Security: Enhanced vulnerability tracking through build and deployed SBOM types - Education: Training programs must cover new concepts like SBOM types and profile selection - Funding: Investment needed in tool development and organizational capability building ### 🧠 Learning Styles Assessment Reading level estimate: 12-14 (Technical/Professional) #### 👀 Visual learners - Present: Lifecycle diagrams showing SBOM type relationships - Improve: Architecture diagrams showing profile interactions, tool flow charts #### 🔊 Aural learners - Present: Conference presentation with speaker explanations - Improve: Podcast series on SPDX 3.0 concepts, audio summaries of key features #### 🗣️ Verbal learners - Present: Clear definitions of new terminology and concepts - Improve: Glossary expansion, analogy-based explanations of complex relationships #### 🧩 Kinesthetic learners - Present: Hands-on model exploration and schema generation - Improve: Interactive tutorials, step-by-step implementation guides #### 🧠 Logical learners - Present: Clear progression from problems to solutions with structured reasoning - Improve: Decision matrices for profile selection, implementation timelines #### 🧑‍🤝‍🧑 Social learners - Present: Community collaboration examples and stakeholder introductions - Improve: Working groups for specific use cases, peer implementation sharing #### 🧘‍♀️ Solitary learners - Present: Detailed technical documentation for independent study - Improve: Self-paced learning paths, individual assessment tools #### 🌿 Naturalistic learners - Present: Software ecosystem and lifecycle metaphors - Improve: Supply chain ecosystem analogies, sustainability impact discussions ### 📊 Accessibility Assessment #### Screen reader semantics - Present: Structured headings and clear topic transitions - Improve: More detailed alt text for technical diagrams, table summaries #### Keyboard navigation - Present: Standard video controls and transcript availability - Improve: Timestamped navigation points, keyboard shortcuts for sections #### Contrast and readability - Present: Clear presentation slides with adequate contrast - Improve: High contrast mode - Document Tags: [[spdx]] [[tools]] [[planning]] - Summary: SPDX 3.0 Overview - URL: https://www.youtube.com/watch?v=J_RzbPMYDMM I think we're going to do a quick round of introductions just so we're aware of who's in the room my name is Rose judge I work at VMware I'm on the spdx steering committee and I've been working on the spdx security profile my name is Adolfo Garcia I am a software engineer with Junior and I'm contributor to spdx but also maintaining a bunch of other S1 tools awesome hi I'm Brandon I'm a software engineer at Google I helped maintain the golang tools SPX Library as well as help with the build profile and also a song along with Adolfo also helping build some tools around s-bombs and ecosystem hi I'm Karen Bennett I representing IEEE but I also work in building AI models for the last six years for auto self-driving cars software engineer at the BBC on smart TV apps um here to learn about sbdx hey there um David Buckhurst also from the BBC um so I guess me and Tom are the closest to an ospo that that we have so uh so yeah um but we're yeah looking to sort of give that more uh more emphasis so yeah really interested in this morning I'm Steve colbain I'm not at the BBC um I work for Analog Devices I'm mainly involved in opengain and I'm here just to learn much more about spdxr sbx3 in general okay hi my name is Jordi um uh and I'm the spdx marketing manager who are happy to elevate everyone's voice from the ecosystem that is contributing or just wanting to learn more about spdx hi my name is soin Kim I'm ospo in AIG electronics and I have many interested in spdx hello I'm Jeff Shapiro I'm with Linux foundation and I do lots and lots of license scanning oops let's throw back this way hi my name is Aaron refit I'm at Carnegie Mellon University um I primarily work with federal government and I'm just interested well they're rolling out as bomb swag crazy right now so I'm learning about the toolingo system to help them do their jobs better hi I'm Denver Gingrich director of compliance at software Freedom conservancy and I'm curious to see how spdx can help with compliance and especially to see how we can make sure that some of the other parts of the copyleft licenses can be upheld through some of the work spdx is doing so collaboration there thanks good morning I'm a material solo I'm part of the reproducible built Community especially working in producers in Debian I'm here to learn more about spdx and how it's evolving and if we can do something together maybe possibly hello my name is Mark easy I'm with Wind River systems I'm head of the open source program office and I've been using spdx since 2012. we've been delivering I guess bombs to our customers since then and I'm always interested in seeing how it's evolving hello I'm to Medford from Bloomberg and apparently been nominated by a bunch of people can raise their hands who also from Bloomberg we are part of a group that help with our software supply chain efforts internally looking to how we can leverage spdx more and also contribute back foreign hello I'm Kevin Connor I was with red hat I'm now unfortunately an employee so I'm here as an independent I've done a fair bit of work with Cyclone DX and s-bombs they're now here to learn about spdx and strengthen my knowledge of that so thanks very much I'm also from here in Vancouver I just live on the North Shore so I enjoy the scenery every day yeah that'll be great um hi everybody I'm Vinita gear um I'm Sam chandan hi I'm Akshay Lisa I also work at Bloomberg hi I'm Nisha I work for Oracle I have been a contributor to spdx for a while now and also a maintainer with rose and Adolfo and Brandon so I miss you oh thank you uh nice to meet you uh I'm noriel from uh I am a hospital staff in Sony group population and I'm participating uh open change Japan working group and contributed to uh spdx light or next sorry I forgot use usage profile usage profile to your spdx version 3.0 nice to meet you open source program office and I'm also working with the spdx sp6 right from the open chain Japan work groups so I'm really happy to join this discussion thank you hi hi my name is from Japan I am working for a company named Solutions and I'm working for open source management thank you and thank you hi everyone my name is ayomi Watanabe I'm working for heated Solutions Japan and I am a ID Consultant and who is uh helping Japanese companies to use and understand the open open source compliance and the open open source management and especially for spdx so thank you very much nice to meet you everyone hi my name is Dan I'm an open source maintainer and developer in a number of different projects and we've just recently implemented the spdx source code tags on one of our projects and with some outside prompting so I'm here to learn a little bit more about what we can do to help Downstream users hi my name is Alex Wright I'm with the United States Air Force and I'm here to learn about the next upcoming standard of spdx and furthering our spam efforts thank you very much I'm Kate Stewart and I've been pretty much with spdx since the start of it um and so we're here to sort of talk about what's coming down the pipe and get your input and hopefully help get the tools so with that I'll move it over to Rose and okay so just a quick agenda so you all know what to expect Kate's going to give us an spdx 3.0 overview and then Steve and Jeff are going to give us an overview of the license compliance use cases with spdx 3.0 Adolfo and I are going to go over security use cases for spdx 3.0 and then Karen and Gopi or maybe just Karen I'm not sure are going to go over how to utilize spdx for AI use cases um Brandon maybe Nisha two okay are going to cover the build profile for us and then Gary who is arriving shortly is going to wrap it all up by kind of summarizing the differences between 2.x and 3.0 at 10 30 we're going to have a group photo and then we'll let discussion follow after that so possible discussion topics are the transition paths for tools and um if you have any questions concerns comments please bring those up and we'd love to discuss those so I'm going to turn it over to Kate yep thanks and if people have a oops thanks and if people have topics that they want to see you know please write them down also we're trying to collect so those who are watching this remotely we have a getter room and if you want to basically put your questions in the get a room someone in here will be keeping an eye probably me we'll be keeping an eye on it and then I'll raise them on your behalf so that we can have a little bit of interactivity not a lot but at least a little bit and so like I say there is the app getterm and then the lobby hopefully you can catch that we'll bring it back up again later yeah so with that talking about 3-0 and where we're going with it so why are we doing 3-0 well there's been a lot of interest in using spdx for non-licensing scenarios that being said we want to make sure we are coherent and stay you know true to being able to support all the licensing scenarios so but getting the security and some of the needs for safety critical systems um I'll be able to be represented was one of the motivators also we're seeing a tremendous surge in AI in fact we started working on this over a year ago if not longer and on data sets and how we can get the transparency for those because the similarly as you compile and build an application you're creating your trained models and the information there could have vulnerabilities could have licensing issues all of these things at spdx is good at representing so we want to be able to extend them on for that and there was efforts going on for doing work on s-bombs at the OMG cisc efforts and so I guess about two years ago we combined forces with them to make sure what we were coming up with was going to work for both communities so not yet another s-bomb we actually tried to very adjust on the spdx side as well as on the OMG side so we had something that would work for both groups the OMG cisc efforts were very much focused on data Lakes and moving so that they could represent the information in a data like and query it um and so this is part of the main Direction we've been going for and then you know there's a lot of the other piece of critique we've heard um through the years is um oh it's too complicated how do I carry the licensing information I just want the straight s bomb stuff I just want a component and I think well you could do that today however making it very simple to see was part of it so making that the minimum easy to just basically access and use was a motivator here on what we've been working on and then being able to include the profiles you care about like licensing like security like the AI and ml the assets build usage these are scenarios that people have brought to us use cases people have brought to us that we're trying to basically make sure we can support so just to give you guys a bit of a history we've been around for quite a while as you can see um one of the big transitions was between 1.2 and 2.0 so we've gone through a breaking change before as a community and there we basically went to enable an arbitrary hierarchy and the documents and so forth and so that was one of those shifts so some of the things that we've learned from that lesson we're trying to make sure we apply this time around as we're going into 3-0 we basically added the spdx Lite again thinking that people just wanted to have the minimum set at one point in time that got added in and then we took that to ISO so spdx is an international standard and has been recognized as such and has gone through the extra level of scrutiny to make sure we could actually do that we will be taking the 3-0 work after it matures a bit in the field back to ISO as well okay but we have to basically because there's so much um so many new use cases so much thing we want a little bit of experience to make sure we've got it right so it'll either be 3-0 or three one we take to it but we want to do a little bit of bacon in practice with the tools and everything else before we go however we will be releasing the three of um spec Etc this year the 3-0 model release candidate is out now as of last weekend so if you want to get a feel for what's happening with spdx now that you can look at that model and understand the classes the properties the vocabularies how this is all fitting together and so just to sort of talk a bit about it um literally we went from a 1.2 where it was just one package per um document effectively so allowing multiple packages per document and having an arbitrary hierarchy that was a significant change for us at the time um you know other systems that are out there right now for s-bombs are sort of talking in this type of mode um and the terms of like one package per thing it's only one thing in this just the dependencies and so we learned from our communities that we need to be able to have multiple scenarios we also initially had it in a Google a Google Docs effectively and word docs was how we wrote Our spec initially and then we would generate a model underneath from that we moved out over to being in markdown up on GitHub so we had much more closer tracking of it and so that happened in the 2.1 to 2.2 release I think actually um and then from that is what we went to ISO with with the two two one oops let me go back and now and now we're here in this real with that release candidate model and we are working towards the next step right now is we're going to be serializing it and getting serializations out from the model so that people can sort of see the files and so forth there's a lot of examples right now already in play and there'll be more showing up um and then the specification will be available so before we used to do the specification then put the model we've changed the order right now we're having the model out there and then the specification will be generated in a more readable fashion so this at this point in time it's very much oriented towards tools and people working on tools because these schemas will be there and you should be able to build from that and then eventually we'll try to go for ISO submission after we get that but that's a flow we're aiming towards right now so um the specification as you say is being transformed it used to be straight text it's now being in markdown and we're also having the classes properties and enumerations or vocabularies the metadata is there for each element and will be basically automatically generating schemas now so there's a preliminary Json schema sitting there and we've been working on the python tools as we've been sort of finalizing this stuff so there will be a python Library out there for people to play with in the next week or two um at least to start playing with anyhow and then we'll be adding more of the formats generation after that and it's these profiles the way to work with them is if you care about them you indicate you want to use it and there are certain things that are mandatory and things that are optional and those properties are available to you all the properties that are in spdx are available to you but there's certain ones that the schemas would automatically check if you've indicated you want to be following a profile and so there's a link to the model and that's what we to want to focus people at and focus people at making things more interesting at issues and pull requests right now are very much welcome as we try to get this hardened so just to Source you know what we sort of did is we found with to the 2x we found the full normal model really helped us enable the transition between formats we're using the same thing that's why we're doing the model approach and with Rio we're basically looking at having the same sort of thing between the formats but we're adding in support for data Lakes an addition s-bomb documents and formats so there's different types of s-bombs that they're included here so some of you may have seen that csap published at CIS out of the US published this um set of types of s-bombs which is where the type of information is available the licensing people have historically have focused mostly on the source s-bombs sorry security people have focused on the sorry about that just getting over a cold security people have focused mostly on the build as bombs so if you have a security people talking about a sponsor usually thinking build if you have licensing people an osbos dks bombs they're mostly talking source and so we needed a way of basically sit separating these use cases out and so there was an industry group that got together convenus and we word Smith for six months on these definitions um and so we've got some degree of consensus and all the people who have signed off on these definitions are a pretty wide swath of the industry so you can go to that link at the bottom in the slides and or just go into CSA s bomb um site and then you'll find the reference to this it came out on the 21st of last month along with a Vex document too which I'm sure Adolfo will reference at some point um but build and Source are really what's out there today design is going to be really useful for safety and requirements requirements catching things like that there's work going on there deployed is once you've actually configured something and putting on a system recording it and understanding what you've put on a system and recording it as it's in progress now each of these types of s-bombs can refer back to others in there okay I think that's important to understand an s-bomb isn't just one in everything we learned that lesson before and we've got very clean mechanisms for linking from one type of s-bomb to another type of s-bomb to refer to the information so you can generate the information where it is locally um and these most are around life cycle however historically someone may take a I've got this binary I want to try to understand what's in it you may need an analyzed one but we see this merging pretty much through the ecosystem so I just want you to be aware of this because you'll start to see people talking about it and it sort of maps pretty well to a software life cycle in that Your Design is happening when you're doing your planning your Source s-bombs usually are happening on procurement and development your build s bombs or your build test and release that's when they're generated because that's where the information is at the heart of it that's where you actually have facts as opposed to guesses and the more times in this ecosystem we can record facts rather than guesses the more we're gonna be able to trust these documents to be useful in the system and then okay hey you've got your release you've got your release oh I'm you've given it to a customer hey they're going to deploy it um well the courthouse they were going to deploy it that's effectively a deployed s-bomb we don't see a lot of that today I think we're going to see more and more of that and certainly from the safety side we're going to need it and then oh hey I've got this system it's been changing out from underneath me over time I want to look and see what's actually showing up so this guy may be called an instrument it as bomb or something like that but it's a way of summarizing what is actually running on a system and being able to compare it to what you think it should be running on the system with the deployed so a deployed s-bomb could refer actually a runtime is function refer to a couple deployed the deploy that could refer to a build the bill could refer to the source and the design could sort of basically be pointing at all of them so there's going to be some interesting new use cases being shown up by this but this is a pretty powerful mechanism and that it will let us represent these safety use cases we're trying to aim for, SPDX 3.0 Overview, YouTube, 01ka7pef2s4enexgxq0mm9dk5p.