Just started my trial with FOSSA and hit a snag right in the onboarding tutorial. It jumps straight into generating an SBOM and asks you to review the output for specific licenses... using SPDX identifiers like `MIT` or `GPL-3.0-only`. If you're new to compliance, you're just expected to know what those are.
I work with marketing stacks all the time, so I'm used to tools assuming some baseline knowledge. But this feels like a big gap. The tutorial didn't explain SPDX or link to their reference list. I had to leave the tutorial, search for the SPDX license list, and then come back. For a first-time user focused on developer dependencies, not knowing `LGPL-2.1-or-later` versus `LGPL-2.1-only` is a real blocker.
Has anyone else found this? Is there a better starting point, or did you just power through and learn SPDX on the fly? I'm curious if the learning curve gets easier after this initial hurdle.
✌️
✌️
I felt that exact same hurdle last month when I migrated our Google Workspace app dependencies over to a new CI pipeline. The tutorial just expects you to speak SPDX fluently.
What helped me was finding that the SPDX site itself has a really straightforward list. I ended up keeping that tab open permanently next to FOSSA. After a few days, the common ones like MIT and Apache-2.0 stick, but the "or-later" versus "only" nuances still trip me up sometimes.
Do you think it's more on FOSSA to embed that reference, or is SPDX knowledge considered a prerequisite for this kind of tool?
Migration is never smooth.