Category

News

M&A and OpenChain – OpenUK Webinar – 29th May – Noon UK Time

By Featured, News

Andrew Katz, Managing Partner at Moorcrofts and CEO of Orcro (both OpenChain partners), will lead an OpenUK webinar on the topic of OpenChain in M&A. This issue is increasingly important in our eco-system, reflecting that outside of product procurement, structured open source compliance approaches are in demand and offer significant benefits.

Learn More on the OpenUK site

OPPO Is Now An OpenChain Platinum Member

By Featured, News

MAY 27, SAN FRANCISCO – Today the OpenChain Project is delighted to announce OPPO as our latest Platinum Member. As a Platinum Member of the project OPPO will provide strategic oversight on the governing board, the steering committee and the outreach committee. While OpenChain has had an active China Work Group since 2019, OPPO is the first work group participant to join the project governing board, and their contribution will be invaluable as OpenChain becomes an ISO standard.

“The OpenChain Project has been extremely fortunate in working with a wide range of Chinese companies during the last 18 months,” says Shane Coughlan, OpenChain General Manager. “Our deep relationship with OPPO is a direct consequence of this, and with their help we are looking forward to inspiring and leading a diverse range of Chinese innovators, international manufacturers and global supply chain companies towards adoption of our industry standard. In the next few months we will see some transformative activities around OpenChain and more generally open source compliance. OpenChain will become an ISO standard. SPDX will increasingly be deployed for Software Bill of Materials. Open Source Reference Tooling will emerge for multiple sectors. I am looking forward to working with the team at OPPO to help ensure that companies of every size and in every market can continually have access to the most efficient, effective and appropriate approaches to managing open source.” 

“OPPO is delighted to join the OpenChain Project and establish a deeper engagement with the global open source community as our business and research effort grow,” Andy Wu, Vice President and President of Software Engineering Business Unit, OPPO. “With the presence of our smartphone and services in more than 40 global markets and research institutes across the world, OPPO looks forward to working with developers and partners through open source development and OpenChain Project, with its efficient and comprehensive solutions, tremendously increased the efficiency of our collaborative innovation. OPPO values openness and collaboration greatly and will be an active member in OpenChain Project to contribute to its long-term success and adoption with fellow partners.”

About OPPO

OPPO is a leading global smart device brand. Since the launch of its first mobile phone – “Smiley Face” – in 2008, OPPO has been in relentless pursuit of the perfect synergy of aesthetic satisfaction and innovative technology. Today, OPPO provides a wide range of smart devices spearheaded by the Find X and Reno series. Beyond devices, OPPO provides its users with the ColorOS operating system and internet services like OPPO Cloud and OPPO+. OPPO operates in more than 40 countries and regions, with 6 Research Institutes and 4 R&D Centers worldwide, as well as an International Design Center in London. More than 40,000 of OPPO’s employees are dedicated to creating a better life for customers around the world.

About the OpenChain Project

The OpenChain Project builds trust in open source by making open source license compliance simpler and more consistent. The OpenChain Specification defines a core set of requirements every quality compliance program must satisfy. The OpenChain Curriculum provides the educational foundation for open source processes and solutions, whilst meeting a key requirement of the OpenChain Specification. OpenChain Conformance allows organizations to display their adherence to these requirements. The result is that open source license compliance becomes more predictable, understandable and efficient for participants of the software supply chain.

About The Linux Foundation

The Linux Foundation is the organization of choice for the world’s top developers and companies to build ecosystems that accelerate open technology development and industry adoption. Together with the worldwide open source community, it is solving the hardest technology problems by creating the largest shared technology investment in history. Founded in 2000, The Linux Foundation today provides tools, training and events to scale any open source project, which together deliver an economic impact not achievable by any one company. More information can be found at www.linuxfoundation.org.

The Linux Foundation has registered trademarks and uses trademarks. For a list of trademarks of The Linux Foundation, please see our trademark usage page: https://www.linuxfoundation.org/trademark-usage

Linux is a registered trademark of Linus Torvalds.

Media Contacts

Shane Coughlan
+818040358083
scoughlan@linuxfoundation.org

Yocto環境にmeta-spdxscannerを適用し、SPDX出力環境を構築する(fossdriver利用編)

By Featured, News

 

はじめに

OSSライセンス スキャナーであるFOSSologyを利用すると、OSSパッケージ毎のソース コード解析→SPDXファイルの出力が可能です。
しかし、ソース コードをパッケージ毎にWeb UIからFOSSologyへ送るのは手間がかかるため、meta-spdxscannerを利用して、Yoctoでビルドしながら、FOSSologyへソース コードを送信、解析、SPDXファイルを出力する環境の構築方法をまとめてみました。

output_spdx_environment.png

今回、構築する環境は、以下のような感じです。

ホスト環境は、Ubuntu 18.04やAWS(Amazon Linux)など、dockerが使えれば何でもよいです。
青枠がdockerコンテナです。
FOSSologyやYoctoビルド環境をdockerコンテナで構築し、Yoctoビルド環境のdocker上にFOSSologyとアクセスするためのfossdriverをインストールします。
※FOSSologyやYoctoビルド環境についての説明は割愛します。

FOSSology環境の構築

FOSSology のdockerイメージを取得します。
最新版は3.6.0版ですが、fossdriver経由で動作しないので、3.5.0版を取得します。
追記:fossdriverが、FOSSology-3.6.0に対応したようです。(https://github.com/fossology/fossdriver/commit/efbbd51ae407e78cd8f969b2cdc3c243b31ade2a)

$ sudo docker pull fossology/fossology:3.5.0

FOSSology dockerを起動します。

$ sudo docker run -d -p 8081:80 --name fossology-3.5.0 fossology/fossology:3.5.0

-p 8081:80は、外部アクセスされるポート番号:dockerコンテナ側のポート番号を指定します。
-dは、バックグラウンド実行です。

docker psで、dockerコンテナが起動したことは確認できますが、念の為、docker logsで起動状況(--tail=20で、最新ログ20行だけ)を表示します。

$ sudo docker logs --tail=20 fossology-3.5.0
 :
YYYY-MM-DD hh:mm:ss scheduler [PID1] :: NOTE: ********************************************
YYYY-MM-DD hh:mm:ss scheduler [PID1] :: NOTE: ***   FOSSology scheduler started        ***
YYYY-MM-DD hh:mm:ss scheduler [PID1] :: NOTE: ***   pid:      PID1                     ***
YYYY-MM-DD hh:mm:ss scheduler [PID1] :: NOTE: ***   verbose:  3                        ***
YYYY-MM-DD hh:mm:ss scheduler [PID1] :: NOTE: ***   config:   /usr/local/etc/fossology ***
YYYY-MM-DD hh:mm:ss scheduler [PID1] :: NOTE: ********************************************
AH00558: apache2: Could not reliably determine the server's fully qualified domain name, using 172.17.0.X. Set the …
AH00558: apache2: Could not reliably determine the server's fully qualified domain name, using 172.17.0.X. Set the …
[………] [mpm_prefork:notice] [pid PID2] AH00163: Apache/2.4.25 (Debian) configured …
[………] [core:notice] [pid PID2] AH00094: Command line: '/usr/sbin/apache2 -D FOREGROUND'

YYYY-MM-DD⇒年-月-日、hh:mm:ss⇒時:分:秒、PID1⇒FOSSologyスケジューラのpid番号
[………]⇒apacheの起動年月日と時間、PID2⇒apacheのpid番号

最後のapache2 -D FOREGROUNDのログが出ていれば、起動できています。

fossdriverのインストール

Yoctoビルド環境のdockerコンテナ上にインストールします。
今回、Yoctoビルド環境のベースとなったdockerコンテナは、Ubuntu 16.04のdockerイメージより作成しており、そのdockerイメージにはPython3.5をインストールしましたが、Python3.6でも動作可能なことは確認済です。
以下、dockerコンテナにyoctoユーザを作成し、ホーム ディレクトリ上で作業します。

$ git clone https://github.com/fossology/fossdriver.git
$ pip3 install -e /home/yocto/fossdriver

インストールされたか確認します。

$ pip3 list
beautifulsoup4 (4.7.1)
bs4 (0.0.1)
certifi (2019.6.16)
chardet (3.0.4)
command-not-found (0.3)
fossdriver (0.0.2, /home/yocto/fossdriver) ★インストールできている
:

fossdriverの設定ファイルを作成します。
冒頭で説明した環境の通り、dockerホストのポート8081経由でFOSSologyにアクセスできるので、そのように設定します。

$ vi ~/.fossdriverrc
{
        "serverUrl": "http://172.17.0.1:8081",
        "username": "fossy",
        "password": "fossy"
}

fossdriver経由で、FOSSologyへソース コードを送信してSPDXファイルを出力するテスト コードを置いたので、動作確認用にご利用ください。
使用例:

$ ./fossdriver-test.py <source-code.tar.gz> <SPDXファイル出力パス>

meta-spdxscannerレイヤ追加と設定ファイル更新

Yoctoビルド環境に、meta-spdxscannerレイヤを追加します。
以降、pokyディレクトリ以下での作業を想定しています。

$ git clone https://github.com/dl9pf/meta-spdxscanner

Yoctoのリリース版数にマッチするブランチがありますが、Sumo以降であれば、masterブランチで動作することを確認済です。
(MortyやPyroなど、古いYocto環境だと、動作しない可能性があります)

ビルド ディレクトリ配下のレイヤ設定ファイル(conf/bblayers.conf)に、meta-spdxscannerを追加します。(xxxは任意のパス)

 :
BBLAYERS ?= "\
 :
    /xxx/poky/meta \
    /xxx/poky/meta-poky \
 :
    /xxx/poky/meta-spdxscanner \  ★追加

ビルド ディレクトリ配下のYocto設定ファイル(conf/local.conf)に、fossdriverを経由して、ソース コードのスキャン&SPDXファイル出力できるよう、記述を追加します。(xxxは任意のパス)

 :
# Use spdxscanner
INHERIT += "fossdriver-host"
SPDX_DEPLOY_DIR = "/xxx/SPDX"  ★事前に作成しておいたディレクトリをfull-pathで指定

パッケージングされないOSSパッケージ(*-nativeパッケージなど)をソース コードのスキャン&SPDXファイル出力対象外にする場合は、meta/classes/nopackages.bbclass に以下を追加します。

 :
deltask do_spdx   ★最下行に追加

ここまで設定が終わったら、あとはbitbakeすると、パッチ適用されたソース コードがFOSSologyへ送信され、スキャン&SPDXファイル出力まで自動で行われます。
出力ディレクトリを確認すると、以下のようにSPDXファイルが出力されます。

$ ls -l /xxx/SPDX/
total 232200
-rw-rw-r-- 1 <user> <group>    <size> <MM DD xxxx> acl-<version>.spdx
 :
-rw-rw-r-- 1 <user> <group>    <size> <MM DD xxxx> zip-<version>.spdx
-rw-rw-r-- 1 <user> <group>    <size> <MM DD xxxx> zlib-<version>.spdx

<user> <group>ファイル所有のユーザ/グループ属性、※<size>⇒ファイル サイズ、
 <MM DD xxxx>⇒年月日/月日時、<version>⇒ソース スキャンしたパッケージ版数

一例ですが、出力されるSPDXファイル(zlib-1.2.11)は以下の通りです。
zlib-1.2.11.spdx

今回は、fossdriverを利用する方法について記述しましたが、REST API(fossdriver無し)経由でFOSSologyへソース コードを送信することが可能です。こちらについては、REST API利用編で記述します。

また、FOSSologyの問題(大きいサイズのソース コードを送ると応答がなくなる、出力されるSPDXファイルのPackage License Declaredフィールドが”NOASSERTION”になる、etc…)に関する回避策なども、別記事で記述します。

OpenChain Webinar #4: Unpacking SPDX 2 2 + SPDX Lite – Full Recording

By Featured, News

The OpenChain Project has launched a series of bi-weekly free webinars that provide access to people and knowledge that we would otherwise obtain at events. We held our fourth meeting on Monday the 18th of May at 5pm Pacific with two guest speakers.

This time we unpacked how the newly released SPDX 2.2. SPDX, as a leading industry standard for Software Bill of Materials, plays a pivotal role in the implementation of practical manual and automated compliance programs.

Kate Stewart, Sr. Director of Strategic Programs at the Linux Foundation, explained how SPDX 2.2 works and what it means for the community. Kate has been a key driver of this standard over the last 10 years and can answer all your questions about what the current standard means, what projects support it, and the current state of the tooling landscape.

Yoshiyuki Ito, Principal Expert at RENESAS Electronics, provided an overview of SPDX Lite. This is a “Profile” for the SPDX 2.2 standard that helps companies deploy the Software Bill of Materials to match certain workflows, particularly with respect to suppliers to large companies using existing processes. Ito San and others in the OpenChain Japan Work Group created SDPX Lite to help ensure that the standard could seek adoption in as many production environments as possible with minimal friction.

Check Out the Full Series

Joint Development Foundation recognized as an ISO/IEC JTC 1 PAS submitter and submits OpenChain for international review

By Featured, News

In the last few days Linux Foundation has publicly announced Joint Development Foundation (JDF) as an ISO/IEC JTC 1 PAS submitter and provided more information on how JDF will support OpenChain and other specifications to become ISO standards moving forward. This is an extremely important media inflection point for our community and for the broader global collaborations creating effective, adopted and mature de facto standards.

While the basic news is not new to the OpenChain community (you know we are using JDF to submit a ISO standard and you know that OpenChain is the first standard going this route), blog posts by The Linux Foundation and the media coverage is very useful for helping to explain our work to others. Some key excerpts below.

“This week, we are proud to announce that the Joint Development Foundation (JDF), which became part of the Linux Foundation family in 2019, has been accepted as an ISO/IEC JTC 1 PAS (“Publicly Available Specification”) Submitter. The OpenChain Specification is the first specification submitted for JTC 1 review and recognition as an international standard. The JDF was formed to simplify the process of creating new technical specification collaboration efforts.  Standards and specifications are vitally important for the creation or advancement of new technologies, ensuring that the resulting products are well defined, provide predictable performance and that different implementations can interoperate with one another.”

Read More

Read More in Japanese

We have seen some great media coverage. One of the best articles can be found in Linux Insider. A key quotation below:

“JDF projects now have a clear path from open source project or specification to an internationally recognized standard. The OpenChain specification is JDF’s first standard to be submitted. The OpenChain standard is a specification that identifies the key requirements of an open source compliance program. It is designed to build trust between companies in the supply chain while reducing internal resource costs. The outcome is increased trust and consistency in open source software across the supply chain. International standardization will help to guide the evolution of the OpenChain Specification from de facto to de jure standard, a process that will assist procurement, sales and other departments to engage with OpenChain-related activities, according to [Seth Newberry, executive director of the JDF].”

Read the Full Article

Finally, if you are wondering why OpenChain is talking about this PR now, about seven days from release, the answer is pretty simple. I (Shane Coughlan, General Manager) wanted to check out the media coverage and select the most concise, clearly messaged article to share. I believe this blog post and mailing list post, and the links it references, provide an excellent on-boarding point for a wider audience. People in procurement. People in sales. People in marketing. Please do share this message.

I am happy to take questions at any time at scoughlan@linuxfoundation.org or via a scheduled call using the link below.

Japan WG全体会合について

By Featured, News

Introduction

本日はOpenChain Japan Workgroupで開催している全体会合について紹介します。私は、Planning subgroupのリーダーを担当している福地と申します。Planning subgroupは毎回全体会合を企画しています。

My name is Hiro Fukuchi, I am the leader of the planning subgroup. This article introduces the all member meeting held by the OpenChain Japan workgroup. The planning subgroup plans the meeting every time.

全体会合

All member meeting

開催状況

Active and inclusive meetings

OpenChain Japan workgroupでは、2、3か月に1回の割合で全体会合を開催し続けています。誰でも参加できるオープンな会合です。workgroupに参加されている企業が自発的にホストを申し出て下さり、2017年12月のworkgroup開始時から2019年9月までに11回の会合を開催することができました。この間には、小規模のAd Hoc会合も3回開催しています。

The OpenChain Japan workgroup have been continuing to hold an all member meeting every two to three months since its beginning. Everyone can join the meeting. Member companies of the Japan workgroup hosted the meetings. From December 2017 to December 2019, we had 12 meetings and 3 ad hoc meetings.

全体会合では、OpenChainプロジェクトおよびJapan workgroupの紹介、サブグループ活動の紹介、ゲストスピーカーによる講演、ライトニングトークを中心にした全員参加の議論などを行なっています。各回およそ50~60名の方が参加され、フレンドリーな雰囲気の中で熱のこもった議論が行われています。

At the all member meetings, there are sessions such as, introduction to the OpenChain project, the Japan workgroup and the subgroup activities, a keynote speech by a guest speaker, lightning talk. Every time, we received 50 to 60 attendees. We have successfully made the meetings friendly and inclusive.

ボランティア企業がホスト

Hosting by a member company

各参加企業がオフィスを会場として提供して下さり、開催場所は品川、新宿、蒲田、八王子、川崎、大阪、名古屋、神戸と全国に広がっています。

The venues of the meeting are spread over Japan, such as Tokyo (Shinagawa, Shinjuku, Kamata, Hachioji), Kawasaki, Osaka, Nagoya, Kobe.

多くの企業にホストしていただくのは重要なことだと私は考えています。企業としてホストすることで、担当者個人の活動から企業の活動に相変化が起きることが多くあります。実際に準備作業に参加したり、他企業の活動や担当者の熱心さを自分自身で感じることで、改めて自分たちの活動を振り返る良い機会になります。これを起点として組織の活動を再検討されるようです。更に、オープンソースに対する企業の姿勢を社内外へ発信する良い機会でもあります。

Hosting a meeting by a member company is very important for Japan workgroup to promote our activity in Japan. Hosting a meeting needs an organizational support from a company. In many cases, throughout the preparation of a meeting or watching other companies’ activities, the company had a significant recognition of the importance of our activity. Sometimes, we saw a personal activity changed to an organizational activity. Hosting a meeting is a good opportunity to show a company’s attitude toward open source.

グローバルに発信

Regional and global activity.

Japan workgroupはオープンソースの活動ですから、日本に閉じて孤立したものにならないように、英語でグローバルに情報発信することを心がけています。全体会合は日本語で行われますが、使われた資料は英語に翻訳してwikiGitHubに掲載されます。

Japan workgroup is regional and global activity. We discuss in Japanese language, but we are publishing our outcomes in Japanese and English language via the website and the GitHub site.

全体会合の意味

Meaning of the all member meeting

信頼関係

Building trust

全体会合は、活力あるコミュニティを形成し維持していくために非常に重要な活動です。特にメンバー間の信頼関係を作るのに重要です。というのも、信頼関係は、オープンソースと言えども、直接会うことで構築されていくと考えているからです。自分の考えをお互いに共有し合い、議論をし、新しいアイディアを生み出していくことができます。この過程を通して相手への信頼が生まれます。

The all member meeting is of critical importance for the Japan workgroup to foster an active and inclusive community, because meeting in person builds trust between members in an open source community. A physical meeting gives an opportunity to share thoughts and feelings, discuss honestly and create a new idea. This process builds trust each other.

サプライチェーンは信頼関係の上にこそ成り立つ仕組みです。信頼できるサプライチェーンの実現を目指すOpenChainプロジェクトにとって、信頼関係を作る仕組みは根幹であると思います。同じ考えを持つ他社の方々と語り合うのは楽しく有意義な時間です。この時間を共有することで信頼関係は深められていくと思います。割と短い間隔で全体会合を開催しているのも、強い信頼関係を維持するのに必要だと考えているからです。

The OpenChain Project aims to build the trusted supply chain. The supply chain requires trusted relationship between suppliers and recipients. For the OpenChain Project, building trust is of critical importance.

海外との交流

Global communication

サプライチェーンは海外にも広がっているのですから、信頼関係の構築は国内だけに限りません。私たちは、海外のゲストを全体会合に招待して講演してもらいますし、Japan workgroupのメンバーが中国、台湾で開催されるWorkshopに参加して自分たちの経験を発表することもあります。こうして、海外とも相互の関係が深まっています。

The supply chain extends globally, so that we need to build trust with the global community. The Japan workgroup invited guest speakers from Europe, Korea and Taiwan to our all member meetings. The Japan workgroup members visited workshops held in China and Taiwan to share our experiences.

継続は活力

Continuation is power

継続することで、活動に活力と慣性が生まれます。活力と慣性が、活動を広げるエネルギーとなり、新しい人を呼び込み、更に新しい交流が生まれていくと私は考えています。

Continuing meetings gives power and momentum to the activity. Power and momentum give energy to our activity, and to invite new people. Meeting with new people begins a new relationship, so that our activity will be able to continue to expand.

参加募集

Please join our activity

全体会合に参加してJapan workgroup活動の雰囲気を自分自身で体験し、活動の輪に加わって頂ければ幸いです。新しく参加された方が会合での発言をきっかけに活動に深く関わられることも多いです。OpenChain Japan workgroupの活動を通じて、信頼できるサプライチェーンが実現されていくことを願っています。

It is our pleasure if we can provide an opportunity for newcomers to join our all member meeting and experience the active and inclusive atmosphere by themselves.

ご興味のある方はこちらから是非ご参加ください:
 OpenChain Japan WG wiki
 OpenChain Japan WG ML
 OpenChain Japan WG slack

Please visit our resources:
 OpenChain Japan WG wiki
 OpenChain Japan WG ML
 OpenChain Japan WG slack

明日のテーマ

Tomorrow’s theme:

明日は富士通コンピュータテクノロジーズの芦塚さんから、Yocto環境にmeta-spdxscannerを適用しSPDX出力環境を構築する手順を紹介してもらいます。

Ashizuka-san from Fujitsu Computer Technologies explains the meta-spdxscanner, that is a tool to output SPDX files in a Yocto environment.

OpenChain Webinar #4: Unpacking SPDX 2.2 + SPDX Lite – Coming May 18th

By Featured, News

The OpenChain Project has launched a series of bi-weekly free webinars that provide access to people and knowledge that we would otherwise obtain at events. We hold our fourth meeting on Monday the 18h of May at 5pm Pacific with two guest speakers.

This time we are unpacking the newly released SPDX 2.2. SPDX, as a leading industry standard for Software Bill of Materials, plays a pivotal role in the implementation of practical manual and automated compliance programs.

Kate Stewart, Sr. Director of Strategic Programs at the Linux Foundation, will explain how SPDX 2.2 works and what it means for the community. Kate has been a key driver of this standard over the last 10 years and can answer all your questions about what the current standard means, what projects support it, and the current state of the tooling landscape.

Yoshiyuki Ito, Principal Expert at RENESAS Electronics, will provide an overview of SPDX Lite. This is a “Profile” for the SPDX 2.2 standard that helps companies deploy the Software Bill of Materials to match certain workflows, particularly with respect to suppliers to large companies using existing processes. Ito San and others in the OpenChain Japan Work Group created SDPX Lite to help ensure that the standard could seek adoption in as many production environments as possible with minimal friction.

Each talk will run for 10~15 minutes and there will be plenty of time for questions, comments and suggestions. As with all OpenChain Project activities, our goal is to facilitate knowledge-sharing between peers.

Everyone is invited to join this free webinar via zoom. It will also be recorded and made available later on our website.

Join Our Zoom Meeting

Password *

  • 123456

One Tap Telephone (no screensharing)

  • +358 9 4245 1488,,9990120120# Finland
  • +33 7 5678 4048,,9990120120# France
  • +49 69 7104 9922,,9990120120# Germany
  • +852 5808 6088,,9990120120# Hong Kong
  • +39 069 480 6488,,9990120120# Italy
  • +353 6 163 9031,,9990120120# Ireland
  • +81 524 564 439,,9990120120# Japan
  • +82 2 6105 4111,,9990120120# Korea
  • +34 917 873 431,,9990120120# Spain
  • +46 850 539 728,,9990120120# Sweden
  • +41 43 210 71 08,,9990120120# Switzerland
  • +44 330 088 5830,,9990120120# UK
  • +16699006833,,9990120120# US (San Jose)
  • +12532158782,,9990120120# US

Find your local number: https://zoom.us/u/abeUqy3kYQ
Not all countries have available numbers.

After dialing the local number enter 9990120120#

OpenChain Webinar 3 – Presentation Slides

By Featured, News

OpenChain Webinar 3 was held on the First Monday of May 2020 and featured talks on contribution policies, M&A and due diligence.

View the Webinar

The speakers have made their slides available to the community. Please find the slides below in the order which they were presented.

Contribution Policies (Tobie @ UnlockOpen)

M&A (Leon and Tony at GTC Law)

Due Diligence (Andrew @ Orcro)