Skip to main content
All Posts By

Shane Coughlan

OpenChain Telco Special Interest Group – 2023-02-02 – Recording

By News

In the February 2nd 2023 call, we reviewed the open pull requests on GitHub. All pull requests except one have been merged, with some modifications. The remaining pull request is about when the SBOM should be created. This needs further discussion. See section 3.7. Please review the current document and provide your comments.

Some topics that need review and input:

  • The list of mandatory elements in section 3.4
  • Section 3.7 SBOM Build information
  • Section 3.13 SBOM Verification
  • What level of detail do we mandate (package, file, snippet)?

Several “Verification and reference material” and “Rationale” sections are still empty.
The words “shall” and “should” are used. They must be defined.

Also, we need a good name for the specification. Currently in the document we have:

  • OpenChain Telecommunications Group SBOM Specification
  • OpenChain Telco SBOM specification
  • Telco Standard SBOM
  • telco standard SBOM
  • Telco Group SBOM specification
  • Telco SBOM specification
  • Telco Profile of SPDX

Best regards,
Marc-Etienne, Telco SIG Chair

Be Part Of This

OpenChain Newsletter #50

By Featured, Monthly Newsletter, News

Newsletter – Issue 50 – January 2023

After focusing on rolling news in 2022, the OpenChain Newsletter is back to provide a monthly summary of our work. You can expect an overview of what the OpenChain Project is doing to build trust around license compliance and security in the open source supply chain. You will also find other news directly related to our field. We accept suggestions and ideas. Just mail us at any time.

Cool Statistic To Start The Year

20% of German companies with over 2,000 employees have already implemented OpenChain ISO/IEC 5230:2020, the International Standard for open source license compliance.
Source: Bitkom Open Source Monitor 2021

Key Project Governance News

In Q4 2022 the OpenChain Project elected a new Governing Board Chair (Jimmy Ahlberg of Ericsson) as well as new co-chairs of the Specification Work Group (Helio Chissini de Castro, CARIAD + Chris Wood, Lockheed Martin) and a new chair of the Education Work Group (Nathan Kumagai, Qualcomm). This is all part of an initiative to ensure that the project has sustainable, clear and fair processes for leadership transition to ensure long-term sustainability.

Google Announces ISO/IEC 5230:2020 Conformant Program

We ended Q4 2022 with some exciting news. Google, an OpenChain Governing Board member and early adopter of the first generation OpenChain standard for open source license compliance, announced formal adoption of ISO/IEC 5230, the International Standard for open source license compliance.

Meanwhile, Around Security…

We have submitted the OpenChain Security Assurance Specification to the ISO/IEC JTC-1 PAS Transposition Process. We expect it to graduate as an ISO/IEC standard around mid-2023.

Security Assurance Specification Conformance

BlackBerry became the first multinational to go whole entity conformant with the OpenChain Security Assurance Specification. They also set a milestone as the first entity to achieve conformance with both OpenChain ISO5230:2020 and the OpenChain Security Assurance Specification 1.1.

That said, the very first company to announce adoption of the OpenChain Security Assurance Specification was Interneuron in the UK. This builds on their previous adoption of OpenChain ISO/IEC 5230:2020, and underlines their continued mission to seek excellence in open source software governance for the British National Health Service.

Security Assurance Specification Gains Additional Support

At the end of December 2022 we saw some significant announcements regarding support for the OpenChain Security Assurance Specification:

This support continued to grow in January 2023 with an announcement from Bitsea about their new services for customers around adoption.

OpenChain Meetings, Webinars And Events

Our monthly meetings kicked off with next generation specification reviews for North America / Europe and North American / Asia. We are seeing some solid discussion around the open issues on both the license compliance and security specifications. It is recommended to take part in these meetings if you have ideas, suggestions or comments about where you want our standards to go next.

We also held a Telco Special Interest Group meeting on the 12th of January and an Education Work Group meeting on the 19th of January. Telco are working on a meta specification about Software Bill of Materials. The Education Work Group is focused on renewal of core material to help people onboard with our standards. Everyone is welcome to join the calls and help out.

Want to join our calls? Just check out our global calendar.

The global calendar is also a great way to keep track of our webinars. We started the year with a great one: OpenChain Webinar #47 covered OSSelot: The Open Source Curation Database. OSSelot is a new project incubated by OSADL in Germany and promises to be an important part of automation tooling support moving forward.

Continuing our program of external collaboration, the OpenChain Project was also part of an external webinar about Applying OpenChain and SBOMs for InnerSource.

Our Training Material Continues To Support The Market

In 2021 and 2022 the OpenChain Education Work Group released online courses in collaboration with LF Training. During January we received some updates providing context for market impact.

Introduction to Open Source License Compliance Management (LFC193) has had 1,209 enrollments and 398 digital completion badges issued with a satisfaction rating of 4.65 out of 5. Implementing Open Source License Compliance Management (LFC194) has had 579 enrollments and 38 digital completion badges issued with a satisfaction rating of 4.55 out of 5. LFC194 has only been out a few months, so we look forward to continued adoption growth in 2023.

It is also noteworthy that Continental Corporation made LFC193 a required course for their software developers from late Q3 2022. This is a concrete example of a company leveraging free resources provided by OpenChain Project and The Linux Foundation to support their open source governance processes.

Check Out All Our Previous Newsletters:
https://www.openchainproject.org/newsletter

Quick Links

Legal: All trademarks belong to their respective owners. This newsletter is licensed under Creative Commons Attribution-NoDerivatives 4.0 International (CC BY-ND 4.0).

OpenChain Webinar #47 – OSSelot: The Open Source Curation Database

By Featured, News, Webinar

This OpenChain Webinar features OSSelot, an open source curation database recently launched by OSADL in Germany. This project addresses one of the most requested features around open source automation for open source compliance: an open, public database supporting SBOM (via SPDX ISO/IEC 5962) for common software packages. This could be a game-changer.

Check Out The Project Website:

BlackBerry Announces First North American OpenChain Security Assurance Specification Conformance

By Featured, News

BlackBerry Limited (NYSE: BB; TSX: BB) announces adoption of the OpenChain Security Assurance Specification 1.1, creating a series of landmarks in doing so. BlackBerry is the first whole entity to announce conformance, the first conformance in the Americas, the first multinational company conformance, and first entity to achieve conformance with both OpenChain/ISO5230:2020 and OpenChain Security Assurance 1.1 with an OpenChain Partner, OSS Consultants. This announcement builds on their previous adoption of OpenChain ISO/IEC 5230:2020, the international standard for open source license compliance. OpenChain Security Assurance Specification 1.1 is the sister standard to ISO/IEC 5230, and is also slated to become an ISO standard later in 2023.

OpenChain has a collaborative global community of companies working to build a more effective and efficient supply chain to create trust between entities around open source; working to increase trust in the open source supply chain. With thousands of people from hundreds of companies actively involved, it is a key part of the governance fabric behind open source technology. BlackBerry is the first company in North America to gain company-wide OpenChain Security Assurance conformance, and the first to collaborate with an official OpenChain Partner Company, OSS Consultants.

“BlackBerry has long been synonymous with excellence in process management, and their engagement with OpenChain standards underlines this,” says Shane Coughlan, OpenChain General Manager. “Their previous whole-entity adoption of ISO/IEC 5230, the international standard for open source license compliance, set an important market example. Their market-leadership is continued today with the world’s first whole entity adoption of the OpenChain Security Assurance Specification, the industry standard for open source security assurance. We look forward to working closely together in continuing to drive sustainable, efficient software supply chains.”

“BlackBerry has one of the deepest commitments in this industry to bringing increased peace of mind to enterprise and governmental organizations,” said Russ Eling, CEO OSS Consultants. “This added certification highlights BlackBerry’s position as a trusted supply chain vendor and serves as an example for others to follow. BlackBerry was able to meet the specification through its existing policies and processes due to its long history and commitments to responsible management of open source. BlackBerry has a team of experts who have developed their practices, tooling, and operational capability to manage the vulnerabilities that arise within open source libraries.”

About BlackBerry

BlackBerry (NYSE: BB; TSX: BB) provides intelligent security software and services to enterprises and governments around the world. The company secures more than 500M endpoints including 215M vehicles. Based in Waterloo, Ontario, the company leverages AI and machine learning to deliver innovative solutions in the areas of cybersecurity, safety and data privacy solutions, and is a leader in the areas of endpoint security, endpoint management, encryption, and embedded systems.  BlackBerry’s vision is clear — to secure a connected future you can trust.

BlackBerry. Intelligent Security. Everywhere. 
For more information, visit BlackBerry.com and follow @BlackBerry.  

Trademarks, including but not limited to BLACKBERRY, EMBLEM Design and QNX are the trademarks or registered trademarks of BlackBerry Limited, its subsidiaries and/or affiliates, used under license, and the exclusive rights to such trademarks are expressly reserved.

About OSS Consultants:

OSS Consultants is a business dedicated to helping organizations of all sizes – from the world’s largest and well-known companies to small businesses and start-ups – design, implement, and manage the most efficient, comprehensive and robust open-source program offices and policies on the planet. Service offerings range from a scan and audit of your third-party and proprietary software to creating a full OSPO within your organization. Find more information at www.ossconsultants.com.

About the OpenChain Project

The OpenChain Project maintains the International Standard for open source license compliance. This allows companies of all sizes and in all sectors to adopt the key requirements of a quality open source compliance program. This is an open standard and all parties are welcome to engage with our community, to share their knowledge, and to contribute to the future of our standard.

About The Linux Foundation

The Linux Foundation is the organization of choice for the world’s top developers and companies to build ecosystems that accelerate open technology development and industry adoption. Together with the worldwide open source community, it is solving the hardest technology problems by creating the largest shared technology investment in history. Founded in 2000, The Linux Foundation today provides tools, training and events to scale any open source project, which together deliver an economic impact not achievable by any one company. More information can be found at www.linuxfoundation.org.

The Linux Foundation has registered trademarks and uses trademarks. For a list of trademarks of The Linux Foundation, please see our trademark usage page: https://www.linuxfoundation.org/trademark-usage.

Linux is a registered trademark of Linus Torvalds.

###

Media Contact:

OSS Consultants Media Relations
info@ossconsultants.com

Special Event: 2022 年 / 2023 年の OSS ライセンスコンプライアンス 日本と海外の最新事情 – 2023 年 2 月 2 日(木) 10:00~14:00

By News

OSS ライセンス監査ツールの FossID と OSS ライセンスコンプライアンスの ISO 標準 を推進している OpenChain が共同セミナーを開催します。このセミナーでは、OSS ラ イセンスに関する 2022 年のレビュー、2023 年の動向を通して、OSS プログラムマネ ジャー、知財エキスパート、マネジメント層のお役に立てる事を目的とします。

Oskar and Jon will be visiting Japan with other people from the newly independent FOSSID to help provide a market overview. The meeting takes place on the 2nd of February between 10:00 and 14:00 in Shinagawa. Of course I will be there with an OpenChain talk.

This will be a market strategy event, focused on getting knowledge from abroad because our travel is limited. It is also suitable for business managers and decision-makers or legal people. 

日時:

2023 年 2 月 2 日(木) 10:00~14:00

場所:

TKP 品川カンファレンスセンターANNEX カンファレンスルーム 4 東京都港区高輪3丁目13−1 高輪コート 3 階
http://www.kashikaigishitsu.net/facilitys/cc-shinagawa-annex/access/

お申し込み方法

参加される方の情報を 1 月 25 日までに E メールでお送りください。 会社・部署:
お名前・メールアドレス
ランチのご希望: はい / いいえ

送り先:

shoken.kim@fossid.com

OpenChain Monthly North America / Asia Meeting 2023-01-17 – Recording

By Featured, News

Our regular monthly call for North America / Asia saw some discussion around two key topics for the next generations of our specifications for license compliance and for security. One related to whether we need to be more prescriptive regarding the content of contribution policies, and another related to whether our existing approach to defining open source worked in both standards. The outcomes are covered in our recording and the slides from the meeting are also available.