Shane Coughlan

Our SBOM Study Group brings all our various activities together and helps answer the question of “how do we use SBOMs in production, large-scale and complex supply chains?”

This meeting was centered on looking at SBOM challenges as a raw material in discussion about potential cross-industry, cross-format guide development. This is building on previous Guide development by the Telco Work Group on SBOM quality for their industry.

Presentation:

• https://docs.google.com/presentation/d/1FkG5VjMOkKBbWHu4sOTxGoJ0uFTOx4go/edit#slide=id.p1

GitHub Page For Comments:

• https://github.com/OpenChain-Project/SBOM-sg/discussions/categories/sbom-document-challenges

Watch the Recording:

Learn More About This Study Group:

Our new SBOM Study Group brings all our various activities together and helps answer the question of “how do we use SBOMs in production, large-scale and complex supply chains?” Our original kick-off call has all the details.

Get Involved Through Our Mailing List:

https://lists.openchainproject.org/g/sbom

✉️ We have a dedicated mailing list:
https://lists.openchainproject.org/g/sbom

🗨️ We have a dedicated Slack Channel:
https://join.slack.com/t/openchainproject/shared_invite/zt-7ayys8g2-dgijHIK_kyrhEWEknrD0cQ

💻 We have a dedicated GitHub Repo:
https://github.com/OpenChain-Project/SBOM-sg

👉 Coming later today: OpenChain SBOM Study Group Monthly Call

🕗 2025-01-22 @ 08:00 UTC / 09:00 CET / 16:00 CST / 17:00 KST + JST

Our SBOM Study Group brings all our various activities together and helps answer the question of “how do we use SBOMs in production, large-scale and complex supply chains?”

☎️ Join the call here:
https://zoom-lfx.platform.linuxfoundation.org/meeting/93693718211?password=6adbb7a3-e2be-4f44-8962-b38e0306c7a0

✉️ We have a dedicated mailing list:
https://lists.openchainproject.org/g/sbom

🗨️ We have a dedicated Slack Channel:
https://join.slack.com/t/openchainproject/shared_invite/zt-7ayys8g2-dgijHIK_kyrhEWEknrD0cQ

💻 We have a dedicated GitHub Repo:
https://github.com/OpenChain-Project/SBOM-sg

Software Security Technology (SST) is the latest official OpenChain Project partner. Their engagement with the OpenChain partner program underscores the growing maturity of the Chinese market, and its increasing adoption of ISO/IEC 5230 for open source license compliance, and ISO/IEC 18974 for open source security assurance.

“We believe the world is empowered by software and will be further innovated by hardcore technologies like AI/LLM, Autonomous driving, embodied robot, blockchain, etc; which are not only software-centric but also open source driven,” says Kelfen Yang, Co-founder, Sales VP of SST. “Compliance was never a liability in-terms of technology development, on the contrary, an accelerator;  which maximize the overall efficiency and trust relationship.  This is also the reason we seek for partnership with OpenChain, together we are hoping to help tech companies globally to build trustworthy, high quality and secure software system through our product, service and experience.”

“We are delighted to welcome Software Security Technology to the OpenChain partner program,” says Shane Coughlan, OpenChain General Manager. “The importance of choice in seeking solutions like commercial tooling is a vital part of helping to make open source compliance and security easier, quicker and more efficient for companies in the supply chain. Throughout 2025, we hope to see our official partners support the development of more automation that addresses legal and regulatory requirements.”

About Software Security Technology

Software Security Technology specializes in the areas of software quality and security testing, providing customers with a one-stop solution to software ecosystem quality and security issues tailored to their specific scenarios.  Our core team is composed of experts from leading domestic and international AST companies.  Through three years of diligent effort, we have independently developed security testing tools, including SCA, SAST, and FUZZ, and have crafted industry-specific solutions that seamlessly integrate with various business scenarios.  Our solutions have gained recognition from leading customers in fields such as automobiles, semiconductors, and communications.  With offices in Chengdu, Wuhan, Shanghai, Beijing, and Shenzhen, our company is able to provide timely and professional pre-sales and after-sales services to our clients.

Learn more: https://www.softsec-tech.cn/

About the OpenChain Project:

The OpenChain Project has an extensive global community of over 1,000 companies collaborating to make the supply chain quicker, more effective and more efficient. It maintains OpenChain ISO/IEC 5230, the international standard for open source license compliance programs and OpenChain ISO/IEC 18974, the industry standard for open source security assurance programs.

About The Linux Foundation:

The Linux Foundation is the world’s leading home for collaboration on open source software, hardware, standards, and data. Linux Foundation projects are critical to the world’s infrastructure, including Linux, Kubernetes, Node.js, ONAP, PyTorch, RISC-V, SPDX, OpenChain, and more. The Linux Foundation focuses on leveraging best practices and addressing the needs of contributors, users, and solution providers to create sustainable models for open collaboration. For more information, please visit us at linuxfoundation.org.

What We Will Cover:

CRA is coming. And this European regulation will impact software development worldwide. Organizations (and projects) of all sizes need efficient compliance processes to correctly identify software components and strengthen cybersecurity efforts.

The AboutCode stack of 100% open source tools and open data is engineered to automate compliance, with a practical approach. Tools like ScanCode and DejaCode paired with aggregated open databases like PurlDB and VulnerableCode ensure accurate origin, licensing, vulnerability detection, and comprehensive SBOM management. Newer projects like Massive FOSS Scan, CRAVEX, and AI-Generated Code Search deliver new performance improvements and advanced capabilities to improve the automation of compliance processes.

In this presentation, AboutCode lead maintainer Philippe Ombredanne will share the latest updates on how to use the AboutCode stack for better, faster, and more efficient license and security compliance automation.

How To Join:

• https://zoom-lfx.platform.linuxfoundation.org/meeting/92010703079?password=7b2959f0-4478-4da6-9076-ddb96cafe30c

or

• One tap mobile:
  • US (iOS): +12532158782,,92010703079#,,,,209683#
  • US (Android): +12532158782;92010703079#;209683#

or

• International numbers: https://zoom.us/u/alwnPIaVT

Meeting ID: 92010703079
Meeting Passcode: 209683

Check Out The Rest Of Our Webinars

• https://www.openchainproject.org/webinars

Our second meeting of the Specification and Education Work Groups was a Europe and Asia call.

Check out the Meeting Slides:

• https://github.com/OpenChain-Project/Meeting-Minutes/tree/main/Slides/2025

Watch the Recording:

Specification Work Group:

We covered:

1. The end of the comment period for proposed updates to ISO/IEC 5230 and ISO/IEC 18974 (2024-06-19 ~ Ending 2024-12-19) [1]
2. What happens next in the three-month Freeze Period [2]
3. What to expect from the Steering Committee meeting to review the Specification Drafts on 2025-02-03 adjacent to the Q1 2025 Governing Board Meeting in Brussels
4. What is happening with the separate ISO/IEC 5230 periodic review at ISO as it reaches five years of age, and what to expect next

[1] https://hubs.la/Q031H2V_0
[2] https://hubs.la/Q031H12h0

Education Work Group:

We covered:

1. What happens next with the OpenChain Explainer Series – Documents (Release) and Videos (Beta) [3]
2. The status of the Capability Model and what to expect next [4]
3. A proposal to consider where we can go with online training for ISO/IEC 5230 (LFC 193 and LFC 194 refresh with LF Training?) and ISO/IEC 18974 (New LFC courses with LF Training?)

[3] https://hubs.la/Q031H0dQ0 (YouTube: https://tinyurl.com/5n7bja9d)
[4] https://tinyurl.com/358s8smy

Other Items:

A note on the timing of the call, and sustainability:

This call takes place between 01:30 and 02:30 in Japan to allow North American and European participants to collaborate. However, this makes it difficult for the General Manager to attend. There is a request to action one of two things:

1. Move the meeting to a North America / Asia schedule, complementary with the other OpenChain Monthly Specification and Education Call (Europe / Asia) on 3^rd Wednesdays or
2. A community volunteer to run the meeting on a regular basis

Issue to be discussed further.

Coming Next:

We will be following up on the activities outlined above on the mailing lists, and we will continue our regular series of calls and meetings throughout the year.

Join Our Work:

Everyone is welcome to be part of the Specification Work Group. You can join their mailing list here:
https://lists.openchainproject.org/g/specification/

You can find and be part of all OpenChain calls through our participation page here:
https://openchainproject.org/participate

We held the first monthly workshop for the OpenChain AI Work Group in 2025. It was a two-hour session to allow topics related to AI compliance to be discussed, explored and defined. The key focus for the Work Group is to develop and finalize a Guide to AI Bill of Material Compliance in the Supply Chain, and there is active drafting going on during each meeting.

The Draft Guide:

• https://docs.google.com/document/d/1g1kdmx1bDlQ0feSeW-ZY5JRFAF-HC30a/edit

Full Recording:

The Draft Guide:

https://docs.google.com/document/d/1g1kdmx1bDlQ0feSeW-ZY5JRFAF-HC30a/edit

Track This Work:

You can follow and contribute to the work of the OpenChain AI Work Group through its dedicated mailing list. This is open to everyone regardless of industry vertical or speciality. You will find it here:

• https://lists.openchainproject.org/g/ai

Attend Future Meetings:

You can find and get the dial-in details for all future AI Work Group meetings from our participate page here:

• https://www.openchainproject.org/participate

Our first meeting of the Specification and Education Work Groups started with a North America and Europe call.

Check out the Meeting Slides:

• https://github.com/OpenChain-Project/Meeting-Minutes/tree/main/Slides/2025

Watch the Recording:

Specification Work Group:

We covered:

1. The end of the comment period for proposed updates to ISO/IEC 5230 and ISO/IEC 18974 (2024-06-19 ~ Ending 2024-12-19) [1]
2. What happens next in the three-month Freeze Period [2]
3. What to expect from the Steering Committee meeting to review the Specification Drafts on 2025-02-03 adjacent to the Q1 2025 Governing Board Meeting in Brussels
4. What is happening with the separate ISO/IEC 5230 periodic review at ISO as it reaches five years of age, and what to expect next

[1] https://hubs.la/Q031H2V_0
[2] https://hubs.la/Q031H12h0

Education Work Group:

We covered:

1. What happens next with the OpenChain Explainer Series – Documents (Release) and Videos (Beta) [3]
2. The status of the Capability Model and what to expect next [4]
3. A proposal to consider where we can go with online training for ISO/IEC 5230 (LFC 193 and LFC 194 refresh with LF Training?) and ISO/IEC 18974 (New LFC courses with LF Training?)

[3] https://hubs.la/Q031H0dQ0 (YouTube: https://tinyurl.com/5n7bja9d)
[4] https://tinyurl.com/358s8smy

Other Items:

A note on the timing of the call, and sustainability:

This call takes place between 01:30 and 02:30 in Japan to allow North American and European participants to collaborate. However, this makes it difficult for the General Manager to attend. There is a request to action one of two things:

1. Move the meeting to a North America / Asia schedule, complementary with the other OpenChain Monthly Specification and Education Call (Europe / Asia) on 3^rd Wednesdays or
2. A community volunteer to run the meeting on a regular basis

Issue to be discussed further.

Coming Next:

We will be following up on the activities outlined above on the mailing lists, and we will continue our regular series of calls and meetings throughout the year.

Join Our Work:

Everyone is welcome to be part of the Specification Work Group. You can join their mailing list here:
https://lists.openchainproject.org/g/specification/

You can find and be part of all OpenChain calls through our participation page here:
https://openchainproject.org/participate