Nokia announces conformance with OpenChain ISO/IEC 5230:2020 to manage open source license compliance management in its supply chain. Nokia has been using and contributing to open source initiatives for decades as an active member of the open source community. Nokia implemented an open source compliance program as far back as 2004 and has had a multi-disciplined Open Source Program Office (OSPO) since 2014.

Nokia leads the Telco Working Group in the OpenChain community.

“Nokia is excited to publicly announce our conformance with OpenChain”, says Jonne Soininen, Head of Open Source Initiatives. “Nokia’s mature open source processes and tools fit well within the OpenChain requirements. We believe it is important to have industry-wide recognized standards to provide predictability to various parties in the industry and across the supply chain.”

“The adoption of ISO 5230 by Nokia is a significant step forward for the telecommunications supply chain with respect to open source,” says Shane Coughlan, OpenChain General Manager. “Firstly, it shows how one of the most experienced companies in the world in the sphere is taking a leadership position in managing open source risk and efficiency. Secondly, it is a clear signal to the broader supply chain regarding how other companies can optimize their approach as well. We welcome this development and look forward to working closely with the Nokia OSPO in the years ahead.”

About Nokia

At Nokia, we create technology that helps the world act together.

As a B2B technology innovation leader, we are pioneering networks that sense, think and act by leveraging our work across mobile, fixed and cloud networks. In addition, we create value with intellectual property and long-term research, led by the award-winning Nokia Bell Labs.

With truly open architectures that seamlessly integrate into any ecosystem, our high-performance networks create new opportunities for monetization and scale. Service providers, enterprises and partners worldwide trust Nokia to deliver secure, reliable and sustainable networks today – and work with us to create the digital services and applications of the future.

About the OpenChain Project

The OpenChain Project has an extensive global community of over 1,000 companies collaborating to make the supply chain quicker, more effective and more efficient. It maintains OpenChain ISO/IEC 5230, the international standard for open source license compliance programs and OpenChain ISO/IEC 18974, the industry standard for open source security assurance programs

About The Linux Foundation

The Linux Foundation is the world’s leading home for collaboration on open source software, hardware, standards, and data. Linux Foundation projects are critical to the world’s infrastructure, including Linux, Kubernetes, Node.js, ONAP, PyTorch, RISC-V, SPDX, OpenChain, and more. The Linux Foundation focuses on leveraging best practices and addressing the needs of contributors, users, and solution providers to create sustainable models for open collaboration. For more information, please visit us at linuxfoundation.org.

As part of their engagement with the OpenChain Project, the Nokia Open Source team have contributed the ‘openchain-telco-sbom-validator’, a script to validate SBOMs against the OpenChain Telco SBOM Guide. This reference tool is available to everyone under the Apache 2.0 license. Marc-Etienne Vargenau of Nokia, chair of the OpenChain Telco Work Group, Gergely Csatari and their colleagues have been instrumental in helping to ensure the determination of SBOM quality is easier, faster and more effective.

Check out the Telco SBOM Guide (Written Document):

• https://openchainproject.org/news/2024/07/30/openchain-telco-sbom-guide-general-availability

Access the Validator Code:

• https://github.com/OpenChain-Project/Telco-WG/tree/main/tools/openchain_telco_sbom_validator

Usage

usage: python3 openchain-telco-sbom-validator.py [options] input

positional arguments:
  input                 The input SPDX file.

options:
  -h, --help            Shows this help message and exits.
  --debug               Prints debug logs.
  --nr-of-errors NR_OF_ERRORS
                        Sets a limit on the number of errors displayed.
  --strict-purl-check   Runs a strict check on the given purls. The default behaviour is to run a non strict purl check what means that it is not checked if the purl is translating to a downloadable URL.
  --strict-url-check    Runs a strict check on the URLs of the PackageHomepages. Strict check means that the validator checks also if the given URL can be accessed. The default behaviour is to run a non strict URL check what means that it is not checked if the URL points to a valid page. Strict URL check requires access to the internet and takes some time.')

Installation of prerequisites

This script is written in python and uses a requirements.txt to list its dependencies. To install python on an Ubuntu environment run sudo apt install python3-pip.

It is usually a good practice to install Python dependencies to a Python virtual environment. To be able to manage virtual environments you need to install venv with sudo apt install python3-venv.

If you do not have a virtual environment yet cretate it with python3 -m venv .env and install the dependencies with pip3 install -r requirements.txt, if you already have a virtual environment start it with . .env/bin/activate.

License

This software is Copyright Nokia and is licensed under the Apache 2.0 license.

Issues and contributions

In case of any issues please create a GitHub issue, while also any contributions are warmly welcome in the form of GitHub merge requests.

Agenda

• 13:00: Opening and introductions
  • 13:00: ‘Opening Greeting’
    • by Shane Coughlan, OpenChain and Marcel Kurzmann, Bosch
  • 13:05: ‘Round Table Introductions’
  • 13:15: ‘Welcome back to the Automotive Work Group, and update from Toyota’
    • by Masato Endo, Toyota
• 13:35: Government Regulations / Activity Impacting the Automotive Supply Chain
  • 13:35: ‘How OpenChain standards can help manage the United States Executive Order, NTIA Minimum Requirements, CRA and more’
    • by Shane Coughlan, OpenChain Project
  • 13:40: ‘The OpenChain SBOM Study Group – Rationale and Relevance’
    • by Shane Coughlan, OpenChain Project
  • 13:45: ‘The OpenChain AI Study Group – Rationale and Relevance’
    • by Shane Coughlan, OpenChain Project
  • 13:55: ‘The current EU approach to support the Open Source collaboration in the European Automotive Industry’
    • by Detlef Zerfowski, ETAS
  • 14:15: ‘Impact of regulations in the US on the Open Source Software Supply Chain’
    • by Russ Eling, OSS Consultants*
• 14:35: Pause for coffee and networking
• 14:55: End-to-End (Open Source) Software Management
  • 14:55: ‘The supply chain, tool updates and the need for standardized interfaces’
    • by Marcel Kurzmann, Bosch
  • 15:15: Catena-X / Eclipse Tractus-X – ‘Are there potential synergies with the OpenChain community and is there a supply chain for data?’
    • by Lars Geyer-Blaumeiser, Cofinity-X
  • 15:35: Linux ELISA / SPDX Safety Profile – ‘How can the safety requirements be covered along the automotive software supply chain?’
    • by Nicole Pappler, AlektoMetis
• 15:55: Pause for coffee and networking
• 16:25: Software Defined Vehicle
  • 16:25: Automotive Grade Linux and Software Defined Vehicle – Status and next steps
    • by Dan Cauchy, AGL
    • by Jan-Simon Moller, AGL
  • 16:45: Eclipse Kuksa and Software Defined Vehicle – Status and next steps
    • by Sebastian Schildt, ETAS
• 17:15: Review of Core Topic
  • 17:15: ‘ISO/IEC 5230, ISO/IEC 18974 and ISO/IEC 5962 – How updates to international standards for open source license compliance, security assurance and SBOM impact the automotive supply chain’
    • Panel: Shane Coughlan @ OpenChain Project, Marcel Kurzmann @ Bosch, Masato Endo @ Toyota
• 17:30: Open discussion and future planning
• 17:40: A Brief Word on Open Source IP Yesterday and Today
  • by Keith Bergelt, Open Invention Network
• 17:55: Close and Goodbye

Samsung SDS has adopted OpenChain ISO/IEC 18974, the international standard for open source security assurance. This builds on their previous adoption of OpenChain ISO/IEC 5230 in July 2022.

The adoption of ISO/IEC 18974 by Samsung SDS was supported by resources provided by the Linux Foundation’s OpenChain Project, founded in 2016, which maintains self-certification checklists and other materials to help global companies develop enhanced open source management processes.

“We are delighted to continue our relationship with the Samsung SDS team around the adoption and use of OpenChain standards for open source process management,” says Shane Coughlan, OpenChain General Manager. “The Samsung SDS team have long been involved with the OpenChain Korea Work Group, and provide an excellent example of how a company can have a measured, effective approach to community engagement, best practice adoption, and excellence in customer support.”

About Samsung SDS

Samsung SDS is the digital arm of the Samsung group and a global provider of cloud and digital transformation­ innovations. Samsung SDS delivers enterprise-grade solutions and services in cloud, secure mobility, analytics / AI, digital marketing and digital workspace. They enable customers in government, financial services, healthcare, and other industries to drive business in a hyper-connected economy, helping them to increase productivity, safeguard assets, and make smarter decisions.

About the OpenChain Project

The OpenChain Project has an extensive global community of over 1,000 companies collaborating to make the supply chain quicker, more effective and more efficient. It maintains OpenChain ISO/IEC 5230, the international standard for open source license compliance programs and OpenChain ISO/IEC 18974, the industry standard for open source security assurance programs

About The Linux Foundation

The Linux Foundation is the world’s leading home for collaboration on open source software, hardware, standards, and data. Linux Foundation projects are critical to the world’s infrastructure, including Linux, Kubernetes, Node.js, ONAP, PyTorch, RISC-V, SPDX, OpenChain, and more. The Linux Foundation focuses on leveraging best practices and addressing the needs of contributors, users, and solution providers to create sustainable models for open collaboration. For more information, please visit us at linuxfoundation.org.

dSPACE GmbH, a global leader in simulation and validation, has adopted ISO/IEC 5230:2020 via completed third-party certification provided by TÜV SÜD. TÜV SÜD is an official OpenChain Partner and is a well-known certification provider. 

“This certification is another important building block in dSPACE’s compliance management system,” says Stefan Schukat, Software Compliance Manager at dSPACE, “and the commitment to a sustainable, meaningful and compliant use of Open Source as well as the support of Open Source projects. We chose third-party certification via TÜV SÜD to ensure our adoption had assessment from independent, accredited experts, and to support the highest possible quality in our process management.”

“The adoption of ISO/IEC 5230 by dSPACE GmbH and their choice of third- party certification is a notable milestone in the increasing maturity of the open source supply chain,” says Shane Coughlan, OpenChain General Manager. “Our goal has always been to link more and more companies via trusted, reliable and consistent process management. This is an excellent example. Incidentally, the first OpenChain third-party certification was provided by TUV SUD to Hitachi in 2018. We are delighted to see the continuation of their service provision to the market, and our continued momentum in this domain.”

You can view the TUV SUD certificate for dSpace at this link:

• https://www.tuvsud.com/ps-cert?q=Q4B+071483+0013+Rev.+00

About dSPACE

dSPACE is a leading provider of simulation and validation solutions worldwide for developing connected, autonomous, and electrically powered vehicles. The company’s range of end-to-end solutions are used particularly by automotive manufacturers and their suppliers to test the software and hardware components in their new vehicles long before a new model is allowed on the road. Not only is dSPACE a sought-after partner in vehicle development, but engineers also rely on dSPACE  know-how  when it comes to aerospace and industrial automation. The dSPACE portfolio ranges from end-to-end solutions for simulation and validation to engineering and consulting services as well as training and support. With more than 2,600 employees worldwide, dSPACE is headquartered in Paderborn, Germany; has three project centers in Germany; and serves customers through its regional companies in the USA, the UK, France, Japan, China, Croatia, Korea, India, and Sweden.

About the OpenChain Project

The OpenChain Project has an extensive global community of over 1,000 companies collaborating to make the supply chain quicker, more effective and more efficient. It maintains OpenChain ISO/IEC 5230, the international standard for open source license compliance programs and OpenChain ISO/IEC 18974, the industry standard for open source security assurance programs

About The Linux Foundation

The Linux Foundation is the world’s leading home for collaboration on open source software, hardware, standards, and data. Linux Foundation projects are critical to the world’s infrastructure, including Linux, Kubernetes, Node.js, ONAP, PyTorch, RISC-V, SPDX, OpenChain, and more. The Linux Foundation focuses on leveraging best practices and addressing the needs of contributors, users, and solution providers to create sustainable models for open collaboration. For more information, please visit us at linuxfoundation.org.

IAV GmbH has announced adoption of ISO/IEC 5230:2020 via third-party certification provided by TimeToAct. Adjacent to this, IAV and TimeToAct are collaborating with the OpenChain Project on a webinar and case study about the certification rationale and process.

“The exceptional progress of OpenChain ISO/IEC 5230 in improving trust in the open source supply chain has been felt in many industries,” says Shane Coughlan, OpenChain Project General Manager. “However, automotive is perhaps where we have had the largest and broadest impact. In a sector with a high degree of regulation, our ISO standard for open source license compliance offers a clear, effective and efficient method of containing risk. We are delighted to welcome IAV GmbH to our community of conformance, and to have had the opportunity to collaborate with our official partner TimeToAct on sharing this news with others. Our forthcoming webinar and case study adjacent to the certification provides a useful tool for other companies seeking to align behind international standards for open source business process management.”

The case study will be released and the webinar will take place at 10:00 CEST on the 16th of July. Learn more about this from the OpenChain Global Calendar on our participation page.

---

There is no need to register for this webinar. Simply follow the Zoom link in the OpenChain Global Calendar.

About IAV GmbH

IAV Automotive Engineering is a developer of computer app systems for the automotive industry. The company offers services in the areas of light vehicles, such as chassis, cockpit, combustion engine, E-Traction, exterior, gaseous-fuel vehicle, hybrid, interior, mobility, powertrain concept and integration, powertrain electronic, product life cycle,transmission, vehicle electronic, vehicle function, and vehicle safety services; commercial vehicles and work machines, including cabin, CO2 efficiency, driver assistance, functional architecture, powertrain, transportation and logistics, and work and agricultural machines; energy supply aspects; and methods and test facilities.

About TimeToAct

TIMETOACT GROUP modernises and integrates IT applications for upper midmarket companies, fortune 500 enterprises and the public sector, with the goal of increasing their agility, efficiency, and transparency and to reduce costs and risks. In addition, TIMETOACT GROUP designs and implements digital business models, opening up new market opportunities for its innovative customers. Its services include consulting and cloud transformation as well as data, software and system engineering in the fields of employee experience, business applications, and customer experience.

About the OpenChain Project

The OpenChain Project has an extensive global community of over 1,000 companies collaborating to make the supply chain quicker, more effective and more efficient. It maintains OpenChain ISO/IEC 5230, the international standard for open source license compliance programs and OpenChain ISO/IEC 18974, the industry standard for open source security assurance programs

About The Linux Foundation

The Linux Foundation is the world’s leading home for collaboration on open source software, hardware, standards, and data. Linux Foundation projects are critical to the world’s infrastructure, including Linux, Kubernetes, Node.js, ONAP, PyTorch, RISC-V, SPDX, OpenChain, and more. The Linux Foundation focuses on leveraging best practices and addressing the needs of contributors, users, and solution providers to create sustainable models for open collaboration. For more information, please visit us at linuxfoundation.org.

The OpenChain Project collaborated with LF Training on Introduction to Open Source License Compliance Management (LFC193), a free online training course intended to help people build the basic knowledge needed to get started in open source licensing management. Martin Yagi from the OpenChain UK Work Group has created a series of bite-sized videos to help summarise key points from the course. You can view them all below.

---

---

Chapter 0: Introduction

Chapter 1: Rights and Licensing

Chapter 2 Part 1: Introduction to Open Source Licenses

Chapter 2 Part 2: Introduction to Open Source Licenses

Chapter 3 Part 1: Introduction to Open Source Compliance

Chapter 3 Part 2: Introduction to Open Source Compliance

Chapter 4: Codebuilding and Distribution

Chapter 5: Bringing it all Together

Huge thanks for Martin for all his hard work!

---

---

The OpenChain Project also has a more advanced course created in collaboration with LF Training called Implementing Open Source License Compliance Management (LFC194).

---

The OpenChain AI Study Group held its regular monthly workshop on the 2nd of July. This workshop included an overview of outcomes from the recent OpenChain Governing Board meeting regarding the AI Study Group, a presentation by Laurie Grant @ Qualcomm on ISO/IEC 42001, as well as other discussions to narrow down areas of shared concern and interest regarding AI compliance in the supply chain.

Track This Work

You can follow and contribute to the work of the OpenChain AI Study Group through its dedicated mailing list. This is open to everyone regardless of industry vertical or speciality. You will find it here:

• https://lists.openchainproject.org/g/ai

Attend Future Meetings

You can find and get the dial-in details for all future AI Study Group meetings from our participate page here:

• https://www.openchainproject.org/participate

We held our regular Monthly North America and Europe Call this week. The focus was on discussing the Public Comment period for our draft proposed updates to the licensing and security specifications.

Check Out The Recording

We keep all the slides from our monthly calls online and they can be a useful way to access direct links and more details:

• https://github.com/OpenChain-Project/Meeting-Minutes/tree/main/Slides

Overview of the Public Comment Period

OpenChain Project Announces Public Comment Period for Draft Updates to Compliance and Security Specifications

Starting 2024-06-19 ~ Ending 2024-12-19

The OpenChain Project has announced the beginning of its six month Public Comment Period for proposed draft updates to the open source license compliance (ISO/IEC 5230:2020) and open source security assurance (ISO/IEC 18974:2023) specifications.

As per our specification development process outlined in the project FAQ, this Public Comment Period will run for six months, and it will be followed by a three month Freeze Period.

During the Public Comment Period everyone is invited to review and comment on the specifications. As an open project developing open standards, we host the draft documents on our GitHub repositories.

Learn More:

• https://openchainproject.org/featured/2024/06/19/public-comment-period-2024

You can comment on this process by joining our monthly calls or via our Specification Mailing list. You can also leave comments via GitHub issues as detailed below.

• Visit Our Participation Page

Starting 2024-06-19 ~ Ending 2024-12-19

The OpenChain Project has announced the beginning of its six month Public Comment Period for proposed draft updates to the open source license compliance (ISO/IEC 5230:2020) and open source security assurance (ISO/IEC 18974:2023) specifications.

As per our specification development process outlined in the project FAQ, this Public Comment Period will run for six months, and it will be followed by a three month Freeze Period.

During the Public Comment Period everyone is invited to review and comment on the specifications. As an open project developing open standards, we host the draft documents on our GitHub repositories.

You can comment on this process by joining our monthly calls or via our Specification Mailing list. You can also leave comments via GitHub issues as detailed below.

---

Current Published Specifications

• Licensing (ISO/IEC 5230:2020):
  https://github.com/OpenChain-Project/License-Compliance-Specification/blob/master/ISO-5230-2020/en/ISO-5230-2020.md

---

---

• Security (ISO/IEC 18974:2023):
  https://github.com/OpenChain-Project/Security-Assurance-Specification/blob/main/Security-Assurance-Specification/ISO-18974/en/ISO-18974.md

---

Proposed Draft Updates to the Specifications

• Open Source License Compliance (ISO/IEC 5230:?):
  https://github.com/OpenChain-Project/License-Compliance-Specification/blob/master/3.0/en/openchain-license-compliance-3.0.md
• You can leave comments by opening an issue:
  https://github.com/OpenChain-Project/License-Compliance-Specification/issues

---

• Open Source Security Assurance (ISO/IEC 18974:?):
  https://github.com/OpenChain-Project/Security-Assurance-Specification/blob/main/Security-Assurance-Specification/2.0/en/openchain-security-specification-2.0.md
• You can leave comments by opening an issue:
  https://github.com/OpenChain-Project/Security-Assurance-Specification/issues

More Details On The Process

Full details can be found in the specification development process outlined in the project FAQ.

A brief outline of our current steps is that the project will:

• Open a Public Comments Period nine months before our target completion date. This runs for 6 months and only accepts minor updates such as typos or grammar corrections that do not change the requirements of the content. We do not accept any material changes during this period. All other feedback and recommendations are queue for consideration during the next version release cycle.
• Open a Freeze Period three months before our target completion date to allow a 3 month review of any changes made during the Public Comments Period.
• If a consensus expresses concerns over any changes made during the Public Comments period we would
  • i) make changes to accommodate those concerns followed by
  • ii) an additional 14 day Public Comments period; followed by
  • iii) another 14 day Freeze period. Anyone with significant reservations on the final draft should state their position/concerns via the spec mailing list. The changes will be accepted once we achieve consensus for the final draft.
• In the event we do not have consensus on the final version – we would repeat the following cycle until we have consensus:
  • i) accommodate changes to address majority concerns;
  • ii) 14 day Public Comments period; followed by
  • iii) a 14 day Freeze period cycle.
• Send the completed draft specification to the OpenChain Steering Committee for formal review and a vote on whether to accept the community recommendations for an updated or new specification.
• In principle, we target updates to our ISO standards once every five years

Please Note: the final decision on content and release of OpenChain Project specifications lies with the OpenChain Steering Committee.