Featured

IT company deepens partnership with OpenChain Project and expands open source software offering.

TIMETOACT GROUP is now an official third-party certifier for the ISO/IEC 5230 standard managed by OpenChain, enabling it to offer official certifications in addition to consulting services on open source license compliance. With the deepening of the partnership between OpenChain and TIMETOACT, customers have even more choice around services available for open source software.

The use of open source software – just like proprietary software – is based on various license terms. It is important to maintain these requirements in order to ensure smooth business operations and avoid conflicts with third parties. The OpenChain ISO/IEC 5230 international standard aims to identify the key requirements for a high-quality open source license compliance program. It enables companies to reduce their risk potential by adapting the standard through self-certification, independent assessment or third-party certification such as TIMETOACT GROUP. Within TIMETOACT GROUP, ARS software engineering specialists provide the certifications.

“We are happy to join OpenChain’s certifier network, thus providing companies of all sizes and industries with the critical components for successful open source compliance programs. This partnership grants our customers added value through the opportunity to obtain the OpenChain ISO/IEC 5230 certification seal,“ says Simon Pletschacher, Manager IT Performance Strategy at TIMETOACT GROUP.

“We are delighted to welcome TIMETOACT GROUP to our comprehensive network of certifiers, allowing us to provide companies of all sizes and industries with easy access to the essential components of superior open source compliance programs,“ says Shane Coughlan, General Manager OpenChain.

About TIMETOACT GROUP

TIMETOACT GROUP modernizes and integrates IT applications for upper mid-sized companies and corporations in order to increase their agility, efficiency and transparency. For innovative customers, TIMETOACT GROUP also develops and implements digital business models and opens up new market opportunities.

Services include: Consulting, Cloud Transformation, Data, Software and Systems Engineering in the area of Employee Experience, Business Applications and Customer Experience.

For more information see www.timetoact-group.com/en or www.timetoact-group.com/en/details/open-source-license-management 

About OpenChain

The OpenChain Project has an extensive global community that involves thousands of companies collaborating to make the supply chain quicker, more effective and more efficient. We do this by maintaining ISO/IEC 5230:2020, the International Standard for open source license compliance, and our Security Assurance Reference Specification. We also have a large global community where knowledge is shared to reduce friction and increase efficiency across all aspects of open source process management.

About The Linux Foundation

The Linux Foundation is the organization of choice for the world’s top developers and companies to build ecosystems that accelerate open technology development and industry adoption. Together with the worldwide open source community, it is solving the hardest technology problems by creating the largest shared technology investment in history. Founded in 2000, The Linux Foundation today provides tools, training and events to scale any open source project, which together deliver an economic impact not achievable by any one company. More information can be found at www.linuxfoundation.org

The Linux Foundation has registered trademarks and uses trademarks. For a list of trademarks of The Linux Foundation, please see our trademark usage page: https://www.linuxfoundation.org/trademark-usage

Linux is a registered trademark of Linus Torvalds.

Press contact TIMETOACT GROUP:

Christin Louise Weber

christin.weber@timetoact.de

OSPOCO and Taylor English are the latest participants in the OpenChain Project official partner program. OSPOCO provides on-demand, scalable open source program office support across community, technical and communication areas. Taylor English provides attorney oversight for all compliance matters and legal advice integrated with OSPOCO technical findings.

“We are delighted to work with OSPOCO on expanding the professional service ecosystem dedicated to OpenChain ISO/IEC 5230 and the OpenChain Security Assurance Specification,” says Shane Coughlan, OpenChain General Manager. “The increased awareness of predictable, sustainable open source process management in the supply chain is matched by an increased need for experienced providers. We look forward to investing time into ensuring growth in the North American market throughout 2023 matches the traction we have seen in Asia and Europe in 2022.”

“Following the OpenChain specifications is the best way for companies to understand and have control over their open source processes,” says Van Lindberg, CEO of OSPOCO and partner at Taylor English. “The OpenChain specifications are our blueprint for helping our clients mitigate supply chain risk and improve their open source ROI. We look forward to helping many more organizations achieve and maintain full compliance.”

BlackBerry Limited (NYSE: BB; TSX: BB) announces adoption of the OpenChain Security Assurance Specification 1.1, creating a series of landmarks in doing so. BlackBerry is the first whole entity to announce conformance, the first conformance in the Americas, the first multinational company conformance, and first entity to achieve conformance with both OpenChain/ISO5230:2020 and OpenChain Security Assurance 1.1 with an OpenChain Partner, OSS Consultants. This announcement builds on their previous adoption of OpenChain ISO/IEC 5230:2020, the international standard for open source license compliance. OpenChain Security Assurance Specification 1.1 is the sister standard to ISO/IEC 5230, and is also slated to become an ISO standard later in 2023.

OpenChain has a collaborative global community of companies working to build a more effective and efficient supply chain to create trust between entities around open source; working to increase trust in the open source supply chain. With thousands of people from hundreds of companies actively involved, it is a key part of the governance fabric behind open source technology. BlackBerry is the first company in North America to gain company-wide OpenChain Security Assurance conformance, and the first to collaborate with an official OpenChain Partner Company, OSS Consultants.

“BlackBerry has long been synonymous with excellence in process management, and their engagement with OpenChain standards underlines this,” says Shane Coughlan, OpenChain General Manager. “Their previous whole-entity adoption of ISO/IEC 5230, the international standard for open source license compliance, set an important market example. Their market-leadership is continued today with the world’s first whole entity adoption of the OpenChain Security Assurance Specification, the industry standard for open source security assurance. We look forward to working closely together in continuing to drive sustainable, efficient software supply chains.”

“BlackBerry has one of the deepest commitments in this industry to bringing increased peace of mind to enterprise and governmental organizations,” said Russ Eling, CEO OSS Consultants. “This added certification highlights BlackBerry’s position as a trusted supply chain vendor and serves as an example for others to follow. BlackBerry was able to meet the specification through its existing policies and processes due to its long history and commitments to responsible management of open source. BlackBerry has a team of experts who have developed their practices, tooling, and operational capability to manage the vulnerabilities that arise within open source libraries.”

About BlackBerry

BlackBerry (NYSE: BB; TSX: BB) provides intelligent security software and services to enterprises and governments around the world. The company secures more than 500M endpoints including 215M vehicles. Based in Waterloo, Ontario, the company leverages AI and machine learning to deliver innovative solutions in the areas of cybersecurity, safety and data privacy solutions, and is a leader in the areas of endpoint security, endpoint management, encryption, and embedded systems.  BlackBerry’s vision is clear — to secure a connected future you can trust.

BlackBerry. Intelligent Security. Everywhere. 
For more information, visit BlackBerry.com and follow @BlackBerry.  

Trademarks, including but not limited to BLACKBERRY, EMBLEM Design and QNX are the trademarks or registered trademarks of BlackBerry Limited, its subsidiaries and/or affiliates, used under license, and the exclusive rights to such trademarks are expressly reserved.

About OSS Consultants:

OSS Consultants is a business dedicated to helping organizations of all sizes – from the world’s largest and well-known companies to small businesses and start-ups – design, implement, and manage the most efficient, comprehensive and robust open-source program offices and policies on the planet. Service offerings range from a scan and audit of your third-party and proprietary software to creating a full OSPO within your organization. Find more information at www.ossconsultants.com.

About the OpenChain Project

The OpenChain Project maintains the International Standard for open source license compliance. This allows companies of all sizes and in all sectors to adopt the key requirements of a quality open source compliance program. This is an open standard and all parties are welcome to engage with our community, to share their knowledge, and to contribute to the future of our standard.

About The Linux Foundation

The Linux Foundation is the organization of choice for the world’s top developers and companies to build ecosystems that accelerate open technology development and industry adoption. Together with the worldwide open source community, it is solving the hardest technology problems by creating the largest shared technology investment in history. Founded in 2000, The Linux Foundation today provides tools, training and events to scale any open source project, which together deliver an economic impact not achievable by any one company. More information can be found at www.linuxfoundation.org.

The Linux Foundation has registered trademarks and uses trademarks. For a list of trademarks of The Linux Foundation, please see our trademark usage page: https://www.linuxfoundation.org/trademark-usage.

Linux is a registered trademark of Linus Torvalds.

###

Media Contact:

OSS Consultants Media Relations
info@ossconsultants.com

Our regular monthly call for North America / Asia saw some discussion around two key topics for the next generations of our specifications for license compliance and for security. One related to whether we need to be more prescriptive regarding the content of contribution policies, and another related to whether our existing approach to defining open source worked in both standards. The outcomes are covered in our recording and the slides from the meeting are also available.

Philippe Ombredanne from nexB will lead a technical deep dive into VulnTotal on the 7th of February at 09:00 CET (08:00 UTC). Join us in our usual room here:

• https://zoom.us/j/4377592799

This deep dive is about an aspect of the AboutCode Project, with VulnerableCode providing tools to collect, aggregate and refine software vulnerability information from more than 20 sources and tools to quickly create new “importers”. VulnTotal is something that came out of Google Summer of Code 2022:

VulnTotal: Cross-validate vulnerability coverage of VulnerableCode (Keshav Priyadarshi)

VulnerableCode is a unique project that collates and cross-references FOSS vulnerability data from multiple sources. Inspired by the VirusTotal multi-scanner virus scanning service, the VulnTotal project will cross-validate the vulnerability coverage of VulnerableCode against other publicly available vulnerability check tools and databases. For instance, a package may be reported as vulnerable by one tool or database but not by another. We can gradually work with these tool providers to keep each other apprised about newly discovered vulnerabilities, making FOSS more secure.

Bitsea, a service provider specialized in software auditing and based in Germany, today announces support for the OpenChain Security Assurance Specification 1.1. They can help companies understand and adopt this standard for open source security in Germany and beyond. As a sister standard to OpenChain ISO/IEC 5230 – the international standard for open source license compliance – the OpenChain Security Assurance Specification 1.1 offers the same type of support for building a quality security assurance program.

“For over 10 years Bitsea has provided services to help organizations identifying hidden risks in software systems and managing their open source software supply chain,” says Dr. Andreas Kotulla, Founder and CEO of Bitsea. “Our services guide organizations to adopt and conform to both ISO 5230 OpenChain and OpenChain Security Assurance.”

“Bitsea has long been a provider of excellent reputation in the open source area,” says Shane Coughlan, OpenChain General Manager. “Their new services to support adoption of the OpenChain Security Assurance Specification 1.1 are a timely and useful contribution to the community in Germany and beyond. Open source security is a vital part of the global supply chain, and solid process management is key to addressing the ongoing challenges.”

About Bitsea

Big software systems are like a wild wide ocean of bits – our passion is to analyse and visualize software structure. We are keen to help our customers how to stabilize and optimize their systems. We assess software. We analyze, evaluate and optimize your development processes, software architecture and software design. We perform the technical due diligence for company takeovers. We reduce the economic risk by assessing open source components and ensure license compliance.

Our references include well-known Fortune 500 companies in communications, automotive, logistics, retail and aerospace industries. Highest standard for information security: We are VDA/ISA Tisax-certified since 2020. All data of our customers remain in Germany or, if required, in the territory of our customers. We are involved in the Bitkom Open Source working group. Bitsea is part of the OpenChain Community. We guarantee strictly confidential consulting in the context of technical due diligence for M&A activities. 

Learn more:
https://bitsea.de/en/

About the OpenChain Project

The OpenChain Project has an extensive global community that involves thousands of companies collaborating to make the supply chain quicker, more effective and more efficient. We work together to create trust between entities around open source. Our job is to increase trust in the open source supply chain. We do this by maintaining ISO/IEC 5230:2020, the International Standard for open source license compliance, and our Security Assurance Reference Specification. We also have a large global community where knowledge is shared to reduce friction and increase efficiency across all aspects of open source process management.

Learn more:
https://www.openchainproject.org

About The Linux Foundation

The Linux Foundation is the world’s largest non-profit connecting global technical experts, and providing them with a neutral and trusted platform to develop open source projects. Founded in 2000 as the home of the Linux Kernel, the Linux Foundation has grown to host hundreds of open source projects, with a community spanning 2,950+ members, 540,000+ contributing developers, and 19,000+ contributing companies.

Learn more:
https://www.linuxfoundation.org

The next OpenChain Webinar will feature OSSelot, an open source curation database recently launched by OSADL in Germany. This project features one of the most requested features around open source automation for open source compliance: an open, public database supporting SBOM (via SPDX ISO/IEC 5962) for common software packages. This could be a game-changer.

Learn more at 09:00 CET (08:00 UTC) on the 24th of January.

This webinar will be held in the OpenChain Project Zoom room:
https://zoom.us/j/4377592799

Check your timezone:
PDT United States Pacific UTC-07:00
UTC Coordinated Universal Time UTC
CET Central European Time UTC+01:00
IST India Standard Time UTC+05:30
CST China Standard Time UTC+08:00
KST Korea Standard Time UTC+09:00
JST Japan Standard Time UTC+09:00

Compare timezones:
https://www.worldtimebuddy.com

Join via one tap mobile:
+86 10 8783 3177,,4377592799# Mainland China
+33 1 8699 5831,,4377592799# France
+49 69 7104 9922,,4377592799# Germany
+81 524 564 439,,4377592799# Japan
+82 2 3143 9612,,4377592799# Korea
+91 80 71 279 440,,4377592799# India
+886 (2) 7741 7473,,4377592799# Taiwan
+44 330 088 5830,,4377592799# UK
+13017158592,,4377592799# USA

Find your local country number: 
https://zoom.us/u/awFnORNiA
Meeting ID: 437 759 2799

Our first monthly meeting of the year contained some great discussion about the spec with oversight by Co-Chair Helio (we worked on issues as usual) and Nathan also set the tone for future plans around the Education Work Group. It was a relatively small group due to the new year vacation ending unevenly around the world, but some substantive material was covered.

Please note that we also had a ton of interesting news to cover. Check out the slides for the details and the links to each item.

Watch The Recording

Check Out The Slides