• Journal of Software Assessment and Valuation
• /
• v.13 no.1
• /
• pp.15-21
• /
• 2017

Analyzing a software package which is consisted of big numbers of files takes enormous costs and time. Therefore, SPDX (Software Package Data Exchange) working group collaborate with Linux Foundation published a software information(metadata) specification: SPDX. On the first half of 2017, the specification contains seven chapters and 66 items, according to Ver 2.1 of SPDX spec. It prefers Tag/Value or RDF forms but also supports spreadsheet form. In this paper, we introduce SPDX parsing & validation tools to check the validity of SPDX document. We'll develop SPDX document generator to manage software package more efficiently for our next target.

• Journal of Software Assessment and Valuation
• /
• v.13 no.2
• /
• pp.9-17
• /
• 2017

Software compliance is an essential process when Open Source Software is included in software development to avoid such as license violation issue. However, analyzing quite big software which involves many developers requires enormous time and hard difficulty. To resolve these kinds of problem, SPDX formalizes and standardize the metadata about the software package. When the use of SPDX is activated, software package analysis would be simple and could contribute fair Open Source Software distribution. In this paper, we develop blockchain based SPDX distribution platform which fulfills the requirement of SPDX lifecycle to provide SPDX database which does not depend on particular centralized service but serve as distributed ledger and control by user's certification and their purpose. Moreover, to contribute invigoration of blockchain based SPDX distribution platform, we develop SPDX document generation plug-in for integrated development environment such as Visual Studio.