2012 Embedded Linux Conference | Presentations

The Power of SPDX - Sharing Critical Licensing Information within a Linux Device Supply Chain

Embedded Linux device runtimes are derived from 100s of open source packages. A common misunderstanding is that just one or two licenses govern a given open source package, when in fact; often a dozen or more apply. Therefore a device runtime could be under 100s of unique licenses. Determining which licenses are relevant is challenging. SPDX, the Linux Foundation’s license exchange format, provides an effective mechanism for recording and sharing licensing information within a device vendor supply chain. We present an overview of SPDX along with a detailed source code example on how to create and extract relevant licensing information. The target audience includes developers, engineering managers, release operation engineers and license compliance professionals. They will learn what SPDX is, how it’s created, and how it is used. A basic understanding of open source licensing is helpful.

Mark Gisi, Wind River

Mark Gisi is Sr. Manager of Intellectual Property at Wind River where he is responsible for managing IP policies and processes. He manages the license compliance of thousands of open source packages of a Linux distribution and currently serves on the SPDX working group. He founded Quality Instincts, an IP business consulting firm and Actify, Inc., where he served as VP of Business Development. Mark was a Software Engineer at HP Labs. Mark holds a MS in Computer Science and a BS in Mathematics.