# 2017-07-10 Meeting **URL:** \ **Category:** scanning\ **Created:** [June 26, 2017, 6:25pm UTC](https://forums.mobyproject.org/t/2017-07-10-meeting/91 "2017-06-26T18:25:01Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![endophage](https://yyz1.discourse-cdn.com/flex031/user_avatar/forums.mobyproject.org/endophage/32/64_2.png) [@endophage](https://forums.mobyproject.org/u/endophage)\ **Post date:** [June 26, 2017, 6:25pm UTC](https://forums.mobyproject.org/t/2017-07-10-meeting/91/1 "2017-06-26T18:25:01Z")
Scheduled for July 10th 2017 at 8am PST. Zoom video conference link: [https://docker.zoom.us/j/226725723](https://docker.zoom.us/j/226725723) Agenda: - Review goals of group for new attendees. - approx. 15-20 minute presentation on SPDX, a Linux Foundation effort to standardize the communication of components, licenses, and copyrights associated with software. - Q&A on SPDX - Review of 2nd draft of report format. - CFP for future presentations on relevant topics. - Schedule next meeting. Documents: - 2nd draft of report format proposal: [https://docs.google.com/document/d/1cs3apBhtA2lS0SlYUF8v38uBPdNxKYi-mhkyU-b9VCs/edit?usp=sharing](https://docs.google.com/document/d/1cs3apBhtA2lS0SlYUF8v38uBPdNxKYi-mhkyU-b9VCs/edit?usp=sharing) ---
**Author:** ![yevster](https://yyz1.discourse-cdn.com/flex031/user_avatar/forums.mobyproject.org/yevster/32/79_2.png) [@yevster](https://forums.mobyproject.org/u/yevster)\ **Post date:** [July 10, 2017, 4:30pm UTC](https://forums.mobyproject.org/t/2017-07-10-meeting/91/2 "2017-07-10T16:30:13Z")
Some SPDX materials: - [Slides from today’s presentation](https://bitbucket.org/yevster/supplychainswithlinkeddata/src/5ebdf7734ddd92f5f90d9362a9dbd2b23d794f47/SPDX%20Whirlwind.pdf?at=master) - [SPDX Tech Team Weekly Call info](https://wiki.spdx.org/view/Technical_Team) ---
**Author:** ![endophage](https://yyz1.discourse-cdn.com/flex031/user_avatar/forums.mobyproject.org/endophage/32/64_2.png) [@endophage](https://forums.mobyproject.org/u/endophage)\ **Post date:** [July 10, 2017, 9:53pm UTC](https://forums.mobyproject.org/t/2017-07-10-meeting/91/3 "2017-07-10T21:53:57Z")
**Notes** - Great overview from Yev on SPDX (slides kindly provided immediately above). - What and how much should we use from SPDX? - It seems like it could replace pretty much the entire currently proposed format, is that desirable? Would it have restrictions that prevent use cases being met? - Should probably adopt the SPDX license names - [https://spdx.org/licenses/](https://spdx.org/licenses/) - Review of 2nd draft of report format - just use the single composed string value for CPEs - Blackduck offered to give a deep dive in the future on how CVSS scores are calculated. - Next meeting scheduled for 2017-07-31, will focus on use cases for scan reports ---
**Author:** ![james](https://avatars.discourse-cdn.com/v4/letter/j/bc8723/32.png) [@james](https://forums.mobyproject.org/u/james)\ **Post date:** [July 11, 2017, 3:25am UTC](https://forums.mobyproject.org/t/2017-07-10-meeting/91/4 "2017-07-11T03:25:50Z")
The SPDX presentation was great. We can definitely borrow a lot, at the very least, and there seems to be strong overlap of interests. I updated the draft specification. I made cpes an array because there are multiple versions of this specification as well. Score should be an array, as there could be many of them, and I added scoring metrics. One thing that’s a bit awkward about this design is that vulns will often reference CVEs which reference CPEs, but we’re putting CPE above vulns in our model. I think it makes sense, because while CVEs can relate to many products (CPEs), an entry in the BoM is by definition only part of one. ---
**Author:** ![lizrice](https://yyz1.discourse-cdn.com/flex031/user_avatar/forums.mobyproject.org/lizrice/32/72_2.png) [@lizrice](https://forums.mobyproject.org/u/lizrice)\ **Post date:** [July 27, 2017, 8:44am UTC](https://forums.mobyproject.org/t/2017-07-10-meeting/91/5 "2017-07-27T08:44:04Z")
There’s a note that the next meeting is scheduled for 31 July, just wanted to confirm whether it’s 8am PST again? ---
**Author:** ![endophage](https://yyz1.discourse-cdn.com/flex031/user_avatar/forums.mobyproject.org/endophage/32/64_2.png) [@endophage](https://forums.mobyproject.org/u/endophage)\ **Post date:** [July 27, 2017, 5:48pm UTC](https://forums.mobyproject.org/t/2017-07-10-meeting/91/6 "2017-07-27T17:48:12Z")
Yes it is. I have your email now so I’ll add you directly to the invitation.