Okay, we're a little behind time, but we're cut-up, I'll be very brief, and I'll be very quick,
and now, yeah, okay, so this is something that I've been working on for a very long
time, but in case we don't know me, I'm Alexis, and I've been working in this
bomb for many years, and so this is a preview of what the big effort that is what we're
doing at work, and yeah, part of it, I think, we've been interested for more people, right?
In case you haven't known by now, right, the CDX talks about three different levels, right?
They're talking about package, talking about file and inside files are snippets, and this is
high- and high-erarch, right, and the package, which is the largest of the three, right, in both
in this definition of the CDX version two and the definition of the CDX version three, it's called,
it's any unit of content that can be associated with the distribution of software, right,
so it's about software being distributed, right, and this is a package, right, and in our work,
we found this problem, because this is about something being distributed, right, a very concrete
thing being distributed, but sometimes we want to refer to something more general, right, we want
to talk about open SSL in general, right, or Z-lib, or love for J, if you were working to Christmas
ago, right, or Lama, or something like that, right, so in our current terminology, in SPDX,
there's no way to refer to open SSL in general, right, you have to refer to one specific
package and I'll explain that, right after, so we introduced this new concept that we just
called component, right, and when I say we introduce it, we have an internal system that we call
Tosca, and this is the acronym of the open source component aggregate, or any because they could
not find another word from me, so it's a system that handles open source essentially and
is bombs and all this stuff, but essentially we had to introduce the new idea of a component,
right, so the component in some abstract thing, right, that talks about a specific software
component, right, open SSL, so it might refer to a specific version of open SSL or not,
but remember when we were talking about a package, a package is a very specific, when you say a
package, it's open SSL version 310, as distributed by Ubuntu, right, this is a package,
because open SSL and other version as distributed by Ubuntu will be a different package, right,
or open SSL exactly the same version as distributed by Debian, for example, is yet another package,
right, so each of the package is a component with a specific version from a specific supplier,
right, and when we're talking about suppliers, supplier is the entity that provides the software,
right, so if we're talking about the dead things, you can get it from Debian, for example,
or Ubuntu, these are suppliers, right, if you get Python packages, you usually get them from
pipi, Java, you get them from name and central and PM from node, all this stuff, right, we're
asked you get from great sale, and in go unfortunately there is no such thing, we'll have the
issue afterwards, right, but besides the actual distributors of packages, right, there is
project themselves, right, open SSL, also publishes their own source, so they're also supplier,
right, and they publish it in open SSL.org, so our model our ontology if we want to call it in
nice words from SPDX, right, we had the package, and the package is a package of a component,
and is provided is supplied by a supplier, right, and they all belong to an ecosystem,
this is an internal thing, and then we can, you know, our ontologies much larger, we have licenses,
we have attribution text, we have other stuff, right, but the whole idea is that a package is
repeating the same words again, right, is one specific version by one specific supplier,
but we wanted to have the component part, because the component part is something abstract, right,
if I want to refer to something, covering for example, two different versions of open SSL, right,
I can use the component abstraction, right, a couple of example,
careful example, right, you see there there are four different type of boxes,
I'll show them there a label on the right hand side, right, and there are four different types of
arrows, right, what is licensed under is distributed by is instance of any package of,
and the box tile is licensed supplier component of the package, the package is the
rectangle, and the abstract thing is the ellipse, that's the component, right, so we're talking
about the curl component in the center, right, and there are two curl different versions,
but they get, they're again an abstract, right, because I'm talking about in general,
curl 8.9, right, and then if you get the specific version of curl by a specific supplier,
then this is a package, right, and then you have, you know, the suppliers and all this stuff.
The nice thing about that is that if you see the point in the center, there is a
dotted line from curl to curl, the curl is the abstract component in the center, and there
one in the lower part of the screen is the license, right, so I can associate the license on the
abstract component, and I say, yeah, I can save the information that the curl is under the curl
license, I should have chosen another example, so that you're more interesting, right, and you
can save it here and not repeat this information in for every of the four different packages,
right, that you have this information, the A, you know, the curl 7.8 by Ubuntu is under curl,
the curls 8 under Ubuntu is under curl, and all these different versions. If we go to open
SSL, it's a little even more complex, and then, you know, you have different versions of open SSL
from different suppliers, and then, you know, depending on the version, the license formation
might change, right, the open SSL 3 is under Apache, but open SSL 1 point, something is under
open SSL license, right, so you can have, you know, again, you're building your graph, and you can
have your information whenever you want, right, and you have still your suppliers and the license
formation notes and stuff, so the main, you know, idea I want to present here is this introduction
of this abstract component thing, right, and the advantage that we found using this is that you
refer to something in, you know, in general, like I said before, you know, I want to talk something
about open SSL in general, or in curl in general, right, and I can refer to that independent
of the specific version, and independent of the actual supply, or who gives me the actual bits
of a specific package, right, typical information that we used for, and that's where we started
with that was license information, and obviously any information can also be, if there is pertinent
to an abstract version of a component, you can associate it with that, right, so as I said, we're
very short, so a couple of real-world data, we've been using this abstraction, I mean, we developed
an internally and designed it and developed it, we've been now working in for, not two years,
but a little less than two years, right, we keep updating the model, this was not even in the beginning,
the same, I'm talking about the abstraction, right, the ontology, the data model, right,
we had different software implementations, we started, you know, from proof of concept for the type,
pilot, we have different, and every implementation, depending on the team that did it,
did it something different, this is the software part is not the industry part, it's the
data model part, right, and we also do continuous data collection, right, so we collect
data for a lot of open source packages, right, in order to get, for example, you get packages
from the suppliers, right, there are too many variations to get how to get the data from suppliers,
do they publish a list of components, do they not, you know, is the list,
include only the latest version, does it get all the version, do you get license formation,
for example, do you get a source link, do you get other meta information, this depends completely
on the ecosystem, I mean, I'm not sure if it's clear, but when I'm saying, does this apply
or provide the list of components, let's see, a supplier is Ubuntu as we say, right,
does Ubuntu provide the list of all its components, and the answer there is, it depends,
how to get it, right, and if the question was about debut, the answer is yes, I can get it
all the list of packages in debut, right, and if you're talking about Pi Pi, yes, it does,
if you're talking about Rust, Crates I.O. does publish a list of packages, but not all the versions,
right, it publishes the latest version of each one, right, so depending on what you want,
this answer, this answers very little, so some real data statistics, for four different suppliers,
right, we have a list of how many packages are we handle, right, and how many components,
remember, components are the abstract idea, and what's the savings, if you put the information on
the component level instead of the package level, right, and you see in debut what we collect
the information once per month, right, the we have in our data 234,000 packages, right,
but these correspond to 54,000 components only, right, so you save 77% if you keep the information
on the component level, right, and then, you know, we won't do, we only care about LTS,
we did it every three months, we get about 60% I'm going to be reading all the numbers here,
Rust, we collect everything once a month, we have 6,000 things, and you know, you save 74%
if you only care about, if you keep the information on the component level instead of the package level,
right, and then pie pie is the wonderful thing, right, pie pie, you can query it and get the list of
all everything available there, you get all the versions, right, it's not easy to remove versions,
so these are the data, I think, couple of weeks ago, or maybe a week ago, couple of weeks probably,
right, so I can get 13 million packages from pie pie, right, but it's only 600,000,
okay, so, you know, I'm saving 95% of the data if I can talk about, you know,
the three requests package, instead of having a request version of all the different versions
that are available, right, when we're talking about bone information, his bone information,
right, we obviously refer to a specific package, right, because you have to talk about hey,
this is a specific component, a specific version from a specific supplier, right, but there is a
way to organize your information on a more abstract level, what I got, and saving our time,
that's all, then we have a couple of, maybe it's for questions, yes, please, we're going to
do this, but projects can change license between the rules and for me the licensing
information, because of this, is that we're connected to the package and not to come, okay, sorry for
cutting you short with that, repeating the observation is that you cannot always abstract everything
because some information on this version dependent, right, and for example, the package may change
license, and this is obviously correct, and that's quite for example, on the open SSL example,
the license formation is not in the abstract, but there is another note about open SSL 3 that
has the information, right, so the license, you put it there, what we actually do is, when we
collect information, because the correction, the information you always collect it on the package level,
right, so you get a new version, you get the information, and if it's the same, then you obstruct
it, half words on the tree, right, and there is always information, pieces of information like,
you know, softer hash ID that we compute the content hash of everything, it's obviously specific
for packets, there is no way that you can obstruct this, but different versions may have different
information, so you have to be to know where you put it in, sorry, he was, we're a rather
time, so yes, license has been changed, the hash is relevant for the packages, all those
executable abilities are relevant for packages, with understanding correctly, then you say you could
save time, but still we need to process every package to determine the differences to the
right, so you, when you collect the question was, but we still have to process everything,
right, the savings of there is the saving of storage, essentially, right, in order to find out
whether something is apply or not, you have to check it, right, but for example, you have to check,
you have to keep all the copyright holders for everything, right, instead of keeping them
for 30 millions, you may keep it only for 600 if they are the same, okay, sorry, we're really
out of time, next one, thank you very much.