Shane Coughlan

What Is Happening?

The OpenChain SBOM Study Group has covered a lot of ground since it was formed in July 2024. After just over a year of work, and with a detailed examination of what is needed for quality cross-industry Software Bill of Materials, the Governing Board has voted to turn it into a Work Group.

The full details of Study Groups vs Work Groups can be found in our FAQ, but the short version is that a Study Group *thinks* about something, and a Work Group *works* on something.

The SBOM Study Group has prepared detailed conceptual information for a ‘SBOM Document Quality Guide’

The newly formed SBOM Work Group will turn this into a completed, formal OpenChain Guide. You can read about the future guide in detail from a special post we wrote on the subject.

How Can I Help?

The next step is to close all the comments on the draft document… or add your own! You will find it here:

• https://docs.google.com/document/d/1iuXX8j10N70dfce1-CZFWhW6S2jEqc–flcCgXMMdjg/edit?usp=sharing

Special Study Group > Work Group FAQ

Q: Does this mean links will change to the mailing list or GitHub repo?

A: No, nothing will change at this time.

Q: Does this mean leadership of the SBOM activity will change?

A: No, nothing will change at this time.

Q: Does this mean all the participants are even cooler than before?

A: Yes.

We Discussed:

Quite a few things! Lead by Chris Wood (Chair, Specification Work Group) and Martin Yagi (Chair Education Work Group), the call covered the following agenda:

• OpenChain Project News
• Open Compliance Summit – Call for Papers
• Specification Work Group – Some Questions for the Community
• Education Work Group – Update on Status and Community Work Items
• Any Other Business?

A reminder for those in Asia – while this edition of the monthly call is happening in the darkest hours of the night (01:30 in Japan!), we also have a monthly Europe / Asia call that works better for those in Eastern time zones. Check out the schedule for this and all our other meetings here:
https://openchainproject.org/participate

Watch the Recording:

Check out the Meeting Slides:

• https://github.com/OpenChain-Project/Meeting-Minutes/tree/main/Slides/2025

Coming Next:

• A ton of work pending on education, and a survey to be released for the spec. Expect a strong focus on looking at what we have accomplished, looking at feedback, and making it better.

Join Our Work:

Everyone is welcome to be part of the Specification Work Group. You can join their mailing list here:
https://lists.openchainproject.org/g/specification/

You can find and be part of all OpenChain calls through our participation page here:
https://openchainproject.org/participate

We held our regular OpenChain AI Work Group Asia Sync on the 11th of September. This meeting focused on reviewing comments around the AI Compliance Guide, which recently completed its public comment period and approval by the Governing Board.

The specific comments addressed were:

1. https://github.com/OpenChain-Project/Reference-Material/issues/101
2. https://github.com/OpenChain-Project/Reference-Material/issues/102
3. https://github.com/OpenChain-Project/Reference-Material/issues/107
4. https://github.com/OpenChain-Project/Reference-Material/issues/108
5. https://github.com/OpenChain-Project/Reference-Material/issues/109

Watch the Recording:

Get Involved:

Everyone is welcome to be part of this activity! OpenChain has free, open access to all its work groups and study groups. Just turn up, and listen in, and contribute comments, ideas and suggestions.

✉️ We have a dedicated mailing list for the AI Work Group: https://lists.openchainproject.org/g/ai

Attend Future Meetings:

You can find and get the dial-in details for all future meetings from our participate page here: https://www.openchainproject.org/participate

This Meeting Had A Packed Agenda:

• Review the document recently published by CISA on minimum elements:
  https://www.cisa.gov/sites/default/files/2025-08/2025_CISA_SBOM_Minimum_Elements.pdf
• Discuss what happened during the Open Source Summit Europe in Amsterdam last week:
  • Bosch talk about SEPIA: https://github.com/OpenChain-Project/SBOM-sg-SEPIA
  • Automotive SBOM work group
  • SBOM work group
  • PackageURL
• Proposal from Jimmy about SBOM encryption:
  https://github.com/OpenChain-Project/Telco-WG/issues/155
  https://github.com/OpenChain-Project/Telco-WG/pull/214

Watch the Recording:

Be part of this:

Everyone is welcome to be part of this study group! OpenChain has free, open access to all its work groups and study groups. Just turn up, and listen in, and contribute comments, ideas and suggestions.

✉️ We have a dedicated mailing list:
https://lists.openchainproject.org/g/telco

💻 We have a dedicated GitHub Repo:
https://github.com/OpenChain-Project/Telco-WG

You are also welcome to participate in any of our other working groups around the world:

• https://openchainproject.org/participate

Our next webinar will be entitled ‘Introduction to the Cyber Resilience Act (CRA)’ and will be delivered by our very own David A. Wheeler, Director of Open Source Supply Chain Security at the Linux Foundation. This will be a great starting point for people getting up-to-speed around the current situation.

About This Webinar:

The European Union (EU) Cyber Resilience Act (CRA) is a new law that covers almost all “products with digital elements”, including software, released in the EU. Enforcement will begin in 2026, even on organizations who aren’t based in the EU. This presentation will briefly explain the scope and requirements of the CRA. This webinar will be lead by David A. Wheeler, Director of Open Source Supply Chain Security at the Linux Foundation.

We start at 17:00 EDT 2025-09-11. All welcome, no registration needed.

Join here at the start time:

• https://zoom-lfx.platform.linuxfoundation.org/meeting/91276165536?password=4f029434-530b-4f19-b7c9-7a953f93c83d

Our next webinar will be entitled ‘Compliant containers with the OSADL Base Image’ and will be delivered by Caren Kresse of OSADL. This will address one of the hottest topics in compliance: “how do you make containers compliant?”

About This Webinar:

While containers certainly simplify deploying software, fulfilling FOSS license obligations for containers is made difficult by their layered structure and the lack of compliance material in public repositories. Although every container is customized for its particular use and therefore comprises different software components, many are built on a base image that provides essential system components. It seems obvious to apply the Open Source principle of sharing development of non-differentiating technologies and services to license obligations of container base images. Therefore, OSADL offers the so called OSADL Base Images that are provided together with all required legal information and material needed to be distributed compliantly. A company may build their individual container images on top of the OSADL Docker Base Image and use the provided instructions to fulfill license obligations for the additional software to achieve license compliant container distribution. This presentation will explain how the base images and in particular the license compliance material are created, list what flavors, versions and variants are available and show how they can be used to facilitate licensing of individual containers.

Project page: https://www.osadl.org/base-image
Docker Hub: https://hub.docker.com/r/osadl/

We start at 09:00 CEST 2025-09-10. All welcome, no registration needed.

Join here at the start time:

• https://zoom-lfx.platform.linuxfoundation.org/meeting/98100842857?password=58e60da7-867b-49ce-8ba3-bb8ee492839d

More About Our Webinars:

There was a significant market impact with the release of Version 1.1 of the Telco SBOM Quality Guide:
https://openchainproject.org/featured/2025/05/09/openchain-telco-sbom-guide-version-1-1-now-available

This lead to discussions about how we can make an explicitly cross-industry guide covering the topics of *how* we determine what is quality, and *how* we manage this across multiple industries. This lead to the development of a ”thinking” document considering how a cross-industry, cross-format SBOM quality could be structured:
https://github.com/OpenChain-Project/SBOM-sg/blob/main/Cross-Industry-SBOM-Quality-Guide/en/Cross-Industry-SBOM-Quality-Guide.md

As of last week, permission was given by the OpenChain Governing Board for the SBOM Study Group to turn into a full OpenChain Work Group, and to explicitly work on turning the thinking document into an official OpenChain guide for everyone. The formal announcement regarding the SBOM Study Group evolution will be made later this week, and meanwhile, you can check out a detailed presentation on the topic of a cross-industry SBOM Quality Guide in the slides below.

Check Out The Slides:

Learn More About This Study (and soon Work) Group:

Our SBOM Study Group brings all our various SBOM-related activities together and helps answer the question of “how do we use SBOMs in production, large-scale and complex supply chains?” Our original kick-off call has all the details.

Get Involved:

Everyone is welcome to be part of this study group! OpenChain has free, open access to all its work groups and study groups. Just turn up, and listen in, and contribute comments, ideas and suggestions.

✉️ We have a dedicated mailing list:
https://lists.openchainproject.org/g/sbom

💻 We have a dedicated GitHub Repo:
https://github.com/OpenChain-Project/SBOM-sg

Attend Future Meetings:

You can find and get the dial-in details for all future meetings from our participate page here:
https://www.openchainproject.org/participate