SPDX

Mentors: Student: Harsh Vardhan Mahawar

The SoftWare Heritage provides each part of the archive (be it any single file, directory or collection of lines of code) or archive itself a stable identifier and these identifiers are called SoftWare Heritage persistent IDentifiers (SWHIDs) which acts as a reference to retrieve them through the Command-line interface(CLI) or Web-API of SWH. Problem statement is that the license and copyright information (license, author, package version etc.) of the project is stored in various different files and there is no single file representing all this information. Therefore developing a tool which can give the Software bill of materials (SBOM) of any referenced file/directory in SPDX format is proposed. Approach is to develop a package to do this task by first parsing the metadata achieved from SWHIDs and forming an logic/algorithm for taking the necessary fields according to spdx format from retrieved data to generate valid spdx-document.

Mentors: Student: BassCoder2808

This project aims to enhance the SPDX Online Tool by improving its functionality and efficiency for license submissions. The project proposes adding features such as automatic creation of pull requests and .txt test files, improving error handling, adding unit tests and GitHub API interaction tests with mock, and creating a base reusable Django app to reduce development efforts. The objective is to streamline the license submission process, reduce manual effort, save time, and enhance productivity. The project proposes clear deliverables such as generating a .txt test file, differentiating exceptions from license submissions, adding or fixing unit tests, and improving error handling. The project will contribute to the open-source community and will provide a learning experience for the software engineering student working on the project. The choice of SPDX as the organization to work with is motivated by its mission to create a standard format for communicating the components, licenses, and copyrights of software packages and its strong community of developers, contributors, and users committed to driving innovation in the field of software licensing.

Mentors: Student: Rahul Tiwari

The spdx-sbom-generator tool helps generating SBOM information complying with the SPDX standard and relies heavily on the parsers project. This GSoC project aims at improving the existing parsers for Python's package managers namely pipenv, poetry and pyenv. The project also aims to add initial support for conda which is another dependency and environment manager for Python and other languages.

Mentors: Student: Joshua Lin

The minimum constituent parts of an overall Software Bill of Material (SBOM) – referred to as NTIA’s minimum elements – are three broad, interrelated areas (Data Fields, Automation Support, and Practices and Processes). These elements will enable an evolving approach to software transparency, capturing both the technology and the functional operation. The purpose of this project is to check if an SBOM document contains the minimum required data fields such as the supplier name, component name, component version, unique identifiers, dependency relationships, author of the SBOM, and timestamps.

Mentors: Student: Rohan Chandrashekar

The project involves web-based system for managing license texts; similar to the SPDX License List but oriented towards other private collections of licenses. My proposal here is to build a scalable, secure Private license management system with a 3-tier architecture: 1) Thin front end with HTML, CSS and Java script 2) SOA(Service Oriented Architecture) based middle tier with Python based REST APIs 3) A Secure persistent data storage With SOA we plan to build a scalable software and along with the RDBMS system we ensure a reliable and secure data solution. The solution encompasses Checking if the namespaces and license format is in accordance with the SPDX License List Matching Guidelines, v2.1, Deduplication to eliminate any duplicate licenses in the system and also converting the license information uploaded to user into a Canonical format using a Mapping function and store it in the Secure database.