Shane Coughlan

The OpenChain Project held its annual an all-day summit adjacent to Open Source Summit Europe (OSS EU) on the 14th of September. This event featured news from our latest board meeting (including the decision to launch our new security specification), a deep dive into a significant new automation landscape to assist with license, security and export control compliance, SBOM discussions and more.

Check out the full recording below alongside copies of our excellent keynote presentation from Andrew Katz of Orcro and the automation landscape capability map presentation delivered by Jan Thielscher of EACG on behalf of the OpenChain Reference Tooling Work Group.

Here are the key takeaways:

• The OpenChain Project now maintains a family of specifications to build trust in the supply chain. We started with license compliance and now we have a sister standard for security.
• Open source automation for open source license, security and export control compliance is getting a clear capability map to guide investment of resources and save time.
• Software Bill of Materials (SBOM) has seen great progress in the last year or two, and the OpenChain Telco Work Group is working on very practical items related to market adoption.
• Open source licensing discussions have become somewhat stale and there is scope for considering the future of open source licensing approaches.

Andrew’s Keynote Slides

Open Source Software Licence Compliance: Art or science? from Shane Coughlan

The Automation Capability Map Presentation Slides

Open Source Compliance Automation Capability Map from Shane Coughlan

The OpenChain Security Assurance Specification 1.0 is now available. This is the result of over one year of work throughout the global OpenChain community. It is applicable to an open source management activity related to security compliance. We regard this as adjacent but different to license compliance.

---

The OpenChain Project’s core mission is to build trust in the supply chain. Our flagship specification, ISO/IEC 5230:2020, is International Standard for Open Source Compliance and builds trust in that domain. It defines the key requirements of a quality open source compliance program. The natural next step is to identify the key requirements of a quality open source security assurance program.

Initially the scope of this specification is limited to ensuring that an organization vets open source with regards to known publicly available security vulnerability issues (e.g., CVEs, GitHub dependency alerts, package manager alerts and so on). The security assurance specification’s scope may expand over time based on community feedback.

This specification is built from the Security Assurance Reference Guide 2.0 (Release Candidate 1) published on 2022-03-28. That completed reference specification document went through a final approval process via editing on our specification list and calls, before graduating to a governing board vote to transform into this published security specification on 2022-09-14.

Next Steps

We will proceed to ISO/IEC JTC-1 PAS submission with an estimated completion date of circa mid-2023. In the meantime, our security assurance specification is ready for market adoption as a de facto standard.

Prior to the ISO/IEC JTC-1 PAS submission, we have some time for sanity-checks and minor adjustments. We begin that process today and will complete it on October 4th 2022 (2022-10-04). There are two tasks for the community ahead of that date:

1. Check our Security Assurance Specification 1.0 against the Security Assurance Reference Guide 2.0 (Release Candidate 1) to ensure Sections 1, 2 and 3 match. You can find the Security Assurance Reference Guide 2.0 (Release Candidate 1) here:
   https://github.com/OpenChain-Project/Security-Assurance-Specification/tree/main/Security-Assurance-Guide-Depreciated/2.0
2. Check the OpenChain Security Assurance Specification 1.0 for any typographical errors that have snuck through our existing editing process. You can find the document linked at the start of this email or here:
   https://github.com/OpenChain-Project/Security-Assurance-Specification/blob/main/Security-Assurance-Specification/1.0/en/openchain-security-specification-1.0.md

You can submit issues highlighting areas you would like review on our GitHub repository. Please note, due to this being a specification, we will only accept issues for discussion. We will not accept pull requests or remixes.

---

In the coming days we will have broader distribution of the specification launch, including on social media and via blog posts. However, you can begin sharing it immediately with your teams and peers. 

Please note:

The scope of this reference specification may expand over time based on community feedback. However, comments and notes should be confined to the existing scope at this juncture. Our specification is complete barring minor adjustments for readability, editing and clarity. 

Please note:

This specification is licensed under Creative Commons Attribution License 4.0 (CC-BY-4.0). You can submit issues highlighting areas you would like review on our GitHub repository. Due to this being a specification, we will only accept issues for discussion. We will not accept pull requests or remixes. You can get more involved with our work beyond submitting issues via our community calls, mailing lists and events: https://www.openchainproject.org/community

The OpenChain Project will be featured at the Open Source2022 | OSCAR event in Mainland China. This marks another collaboration with our friends at CAICT.

Learn more and catch us at 14:00 on the 16th of September:

• https://mp.weixin.qq.com/s/aOZhJvYNr9vxaxR-qiQtuA

The OpenChain Project will hold an all-day summit adjacent to Open Source Summit Europe (OSS EU) on the 14th of September. This event will take place 3 minutes walk from the OSS EU venue. It is open to all parties regardless of LF Membership.

Location

• Orion Room 1 @ Spencer Hotel, Excise Walk, International Financial Services Centre, Dublin 1, D01 X4C9, Ireland
• 3 minutes from Dublin Convention Center (OSS EU venue).
• Google Map link

Provisional Agenda

• 11:00 to 11:30: Opening Keynote, Andrew Katz of Orcro
• 11:30 to 12:30: The OpenChain License Compliance and Security Compliance specification material
• 12:30 to 14:30: Open source tooling for open source compliance (automation for everyone)
• 14:30 to 15:30: SBOM Deep Dive – Telco and More
• 15:30 to 16:30: OSPO and other activities (theory, practice and what is actually happening in market)
• 16:30 to 17:00: Summary Session

Join via Zoom:

• https://zoom.us/j/4377592799

The OpenChain Project had the pleasure of working with the FOSSA team for another webinar explaining aspects of open source license compliance. This time, the practical way you actually adopt ISO/IEC 5230, the international standard for compliance.

Check out the webinar:

• https://www.brighttalk.com/webcast/17752/554463?utm_source=FOSSA&utm_medium=outreach&utm_campaign=554463

Get the slide deck:

• https://docs.google.com/presentation/d/18uKp22XvwmHbVgrQhFox0_w7kAPxpbtyTSs38jwXtbw/edit?mkt_tok=MjQ2LUpWQS04MDQAAAGGlr0KRnO0bKPXREUoYsyYE_flUgjM5hFTNYWol6eluaHERxFiqiOWrCgfmAIYOo86OFGfimCinP4bW8ampltVKgiLM5NEKzDqAzN7QzWQwQ#slide=id.g112aba54042_0_62

While you are reviewing FOSSA webinars you may also want to check out ‘The Lawyer’s Guide to OSS License Compliance Tools, Featuring Heather Meeker.’ Heather has long been one of the main lawyers providing useful, practical insight into industry optimization around open source. You will find it here:

• https://www.brighttalk.com/webcast/17752/547934?utm_source=brighttalk-portal&utm_medium=web&utm_campaign=channel-feed