THE LINUX FOUNDATION PROJECTS
Category

Monthly Newsletter

Nov 08

OpenChain Monthly Newsletter – October, 2026

By Monthly Newsletter

Welcome to OpenChain newsletter! | Community, Standards & Supply Chain Developments, CRA, 

📰October has been another exciting month for the OpenChain community! From bringing communities together to advancing standards adoption and strengthening supply chain compliance, here are five highlights from across our global ecosystem.

1️⃣ OpenChain × OSPOlogy Prague 🇨🇿

We successfully hosted the OpenChain × OSPOlogy event in Prague, bringing together industry professionals to exchange experiences and discuss the evolving landscape of open source governance and compliance.

🔗 Read the event recap: https://todogroup.org/blog/2026-10-19-openchain-ospology-prague-2026-recap/

2️⃣ OpenChain Standards Adoption 🌍

More companies across the globe are adopting OpenChain standards, reinforcing the importance of open source license compliance and security assurance throughout the software supply chain.

Explore the companies adopting OpenChain ISO 5230 and ISO 18974

3️⃣ OpenChain Community Day Japan 🇯🇵

OpenChain Community Day Japan successfully wrapped up! Thank you to all speakers, participants, and organizers for making it a great community gathering.

Missed the event? The recording is now available on YouTube.

▶️ Watch the event: https://www.youtube.com/watch?v=SLNYX-tg58s

4️⃣ Automotive SBOM Framework 1.0 Released 🚗

A significant milestone for the automotive ecosystem! Automotive SBOM Framework 1.0 has been released, supporting greater transparency and consistency in Software Bill of Materials (SBOM) practices across the automotive supply chain.

🔗 Explore the framework: https://github.com/OpenChain-Project/Automotive-SBOM/blob/develop/docs/AutomotiveSBOM_Framework.md

5️⃣ OpenChain CRA Requirements & Checklist Featured by the European Commission 🇪🇺

OpenChain’s Cyber Resilience Act (CRA) requirements and compliance checklist are now published on the European Commission’s website, alongside the OpenSSF CRA training course.

This is an important step in making practical compliance resources more accessible to the European open source and software industry.

🔗 Explore the resources: https://digital-strategy.ec.europa.eu/en/policies/cra-open-source

#OpenChain #OpenSource #OSPO #CRA #SBOM #Automotive #SoftwareSupplyChain #OpenSSF #Compliance

Oct 12

OpenChain Monthly Newsletter – September 2026

By Monthly Newsletter

Welcome to the August 2026 edition of the OpenChain newsletter. Here’s what’s new across our community, our compliance programs, and our conformant organizations.

OpenChain Community Day — Shanghai

OpenChain Community Day in Shanghai was successfully held in Byte dance Office. The gathering brought together members, contributors, and practitioners to share the latest OpenChain developments, exchange experiences, and connect with the broader open source community.

CRA Requirements and Checklist 1.0 was released on Sep 11,2026

the OpenChain CRA Requirements and Checklist Version 1.0 was just released on September 11, 2026. for more information, see https://cra-compliance.openchainproject.org/

Welcome New Members and Partners

We are pleased to welcome Anchore to the OpenChain community and CSTC as an OpenChain partner. We look forward to working together to advance open source compliance and strengthen trust across the software supply chain.

Congratulations on OpenChain Standards Achievements

Congratulations to the following organizations on their achievements in open source compliance and security assurance:

ISO 5230

ISO 18974

These achievements reflect the continued global adoption of open source compliance and security assurance practices.

Thank you to all the organizations contributing to a more trustworthy and sustainable open source ecosystem.

Sep 12

OpenChain Monthly Newsletter – August 2026

By Monthly Newsletter

Welcome to the August 2026 edition of the OpenChain newsletter. Here’s what’s new across our community, our compliance programs, and our conformant organizations.

Strengthening OpenChain Communities Across Asia

August has been an important month for OpenChain, with strong community engagement across Asia, new regional leadership, and a major milestone in our work to support organizations preparing for the EU Cyber Resilience Act.

OpenChain Community Day — Beijing

OpenChain Community Day in Beijing was successfully held ahead of the “Community over the Code” event. The gathering brought together members, contributors, and practitioners to share the latest OpenChain developments, exchange experiences, and connect with the broader open source community.

The event also provided an opportunity to listen to the community and better understand the needs and priorities of organizations in the region.

Expanding Our Southeast Asia Community

OpenChain is pleased to welcome a new Regional Chair (Jimme Wang) for Southeast Asia.

The new chair will focus on developing the OpenChain community across Southeast Asia, building connections with local organizations and practitioners, and creating a strong regional foundation from the ground up.

We look forward to supporting the growth of an active and connected OpenChain community across the region.

OpenChain in Korea

OpenChain was presented at OSS Summit Korea, where we shared OpenChain’s direction and ongoing activities with the Korean open source community.

We also had the opportunity to meet with leaders and members of the Korea OpenChain community and exchange perspectives on open source compliance, security, and the development of local community activities.

Growing Engagement in China

OpenChain continued to engage actively with the Chinese open source ecosystem, including with a number of leading technology companies.

These conversations are helping us better understand how large organizations are approaching open source compliance, software supply chain security, SBOMs, and emerging regulatory requirements.

They also reinforce the importance of connecting OpenChain’s global standards and resources with local communities and practical industry experience.

CRA Requirements and Checklist — RC1 and V1.0

Following the release of RC1 in August, the OpenChain CRA Requirements and Checklist Version 1.0 was just released on September 11, 2026.

The checklist is designed to help organizations understand and prepare for the CRA reporting obligations taking effect from September 11, while connecting regulatory requirements with established open source compliance and security practices.

Thank you to all contributors, reviewers, and community members who helped bring this work to the 1.0 release.

Looking Ahead

OpenChain’s global community continues to grow through collaboration across regions, industries, and organizations.

Our focus remains on providing practical standards, useful resources, and strong communities that help organizations build trusted and sustainable open source supply chains.

Thank you to everyone contributing to this work. We look forward to continuing to build the OpenChain community together.

Aug 04

OpenChain Monthly Newsletter – July 2026

By Featured, Monthly Newsletter, News

Welcome to the July 2026 edition of the OpenChain newsletter. Here’s what’s new across our community, our compliance programs, and our conformant organizations.

1. Join the OpenChain Business Operations Study Group

The OpenChain Business Operations Study Group is a community forum for exploring new ideas, identifying emerging requirements, and discussing potential projects that can help shape the direction of the OpenChain Project. The group is open to everyone — you’re welcome to join the discussion, share challenges and opportunities, and learn from others.

👉 Learn more and get involved: openchainproject.org/openchain-business-operations

2. CRA Requirement & Checklist Ready for Community Review

The OpenChain CRA Requirement & Checklist is now ready for review. This resource defines a compliance program for the EU Cyber Resilience Act (CRA), structured in alignment with the OpenChain Project’s adoption framework and ISO/IEC 18974 (Open Source Security Assurance). It serves as both a policy framework and a self-certification checklist.

A reminder on timing: the CRA’s main obligations apply from 11 December 2027, but reporting obligations already apply as of 11 September 2026 — so now is the time to get familiar with the checklist.

We warmly invite everyone in the community to review the document, share comments, and contribute via pull requests and issues on GitHub. If you’d like your name and company credited in the final published document, just note them in your comment.

👉 Review the checklist and CRA compliance page: openchainproject.org/cracompliance

3. Congratulations to 42dot — New ISO/IEC 5230 Conformance

We’re pleased to announce that 42dot has achieved conformance with ISO/IEC 5230, the international standard for open source license compliance developed through the OpenChain Project.

As part of this effort, 42dot strengthened its open source governance framework and improved collaboration across engineering, legal, and other key functions, resulting in a scalable compliance program that supports the responsible use of open source software throughout the organization. Open source plays a critical role in 42dot’s mobility solutions, including software-defined vehicles and connected mobility platforms.

42dot joins a growing global community of organizations that have adopted ISO/IEC 5230 as a benchmark for open source compliance and software supply chain management.

Congratulations to the 42dot team on this milestone! 🎉

Jun 16

OpenChain Newsletter #87

By Monthly Newsletter
The OpenChain Newsletter provides a monthly summary of our work. It contains an overview of what we are doing to build trust around license compliance and security in the open source supply chain. We accept suggestions and ideas. Feel free to mail us at any time.

This month’s update highlights significant momentum in global adoption, alongside a big ‘Open Chain and Friends’ event with many tracks including Compliance, AI, CRA, Automotive, Education, and so on.

April has been a productive month for the OpenChain Project, with strong engagement across the Linux Foundation ecosystem, new working group activities, and continued progress on key deliverables that support software supply chain trust and compliance.

What happened in April? See the highlights below.

Welcome OpenChain New Board Member-Yoshiyuki Ito From Renesas

Welcome OpenChain New Board Member: Yoshiyuki Ito From Renesas.
We are pleased to welcome Yoshiyuki Ito from Renesas as a new member of the OpenChain Board. His experience and leadership in semiconductor and embedded systems will further strengthen OpenChain’s global governance and ecosystem collaboration.

OpenChain Engagement with COPU in Beijing

OpenChain Engagement with COPU in Beijing
OpenChain recently visited Professor Lu, founder of COPU in Beijing, and both parties look forward to strong future collaboration in advancing open source governance and ecosystem development.

The Teoresi Group Approach to Open Source Governance

The Teoresi Group continues to strengthen its structured approach to open source governance, focusing on compliance, security, and sustainable software supply chain practices across its engineering activities. for more information, see https://openchainproject.org/news/2026/05/05/the-teoresi-group-approach-to-open-source-governance

 

OpenChain Community Day in Tokyo

OpenChain Community Day was successfully hosted at the Sony office in Tokyo, with around 60 participants in attendance. The event featured discussions on OpenChain ISO standards, OSPO experiences in the automotive industry, as well as emerging topics such as CRA and AI.

OpenChain Beijing 2026 and Ospology Live in Beijing

OpenChain Beijing and OSpology Live were successfully held in Beijing in May, bringing together the community to exchange insights on open source governance, compliance, AI, Agentic AI  and ecosystem collaboration.

Apr 03

OpenChain Newsletter #85

By Monthly Newsletter, News

The OpenChain Newsletter provides a monthly summary of our work. It contains an overview of what we are doing to build trust around license compliance and security in the open source supply chain. We accept suggestions and ideas. Feel free to mail us at any time.

This month’s update highlights significant momentum in global adoption, alongside a big ‘Open Chain and Friends’ event with many tracks including Compliance, AI, CRA, Automotive, Education, and so on.

New Executive Director on Board

We are pleased to announce that Mary Meixia Wang has joined the OpenChain Project as our new Executive Director.

We extend our sincere gratitude to our board members and contributors for their continued dedication and support. We would also like to recognize the pioneering leadership of Shane Coughlan whose vision and commitment have been instrumental in establishing OpenChain’s global success. For  more information, see https://openchainproject.org/news/2026/03/05/our-new-executive-director-for-openchain

New Adopters (ISO/IEC 5230, ISO 18974)

The ecosystem continues to expand with major industry players announcing conformance. This is a strong signal for supply chain managers to review their own vendor requirements.

Event

Open Chain and Friends event in Stuttgart

“OpenChain and Friends” is an in-person community event focused on open source software supply chain management, compliance, and collaboration. It’s organized by the OpenChain Project in partnership with local and international communities, such as The FOSS-LÄND Community. The event takes place in Stuttgart, Germany and gathers people working with open source across different industries.

for more information, see https://openchainproject.org/news/2025/12/09/openchain-and-friends-2026

For blogs, see https://openchainproject.org/news

SBOM Document Quality Guideline

We are announcing a public comment period for the SBOM Document Quality Guide that has been developed by the OpenChain SBOM Work Group.SBOM Document Quality Guide: https://lnkd.in/dhe3gFVW

Read Previous Newsletters:

Dec 17

OpenChain Newsletter #84

By Monthly Newsletter, News

Newsletter – Issue 84 – November 2025

The OpenChain Newsletter provides a monthly summary of our work. It contains an overview of what we are doing to build trust around license compliance and security in the open source supply chain. We accept suggestions and ideas. Feel free to mail us at any time.

This month’s update highlights significant momentum in global adoption, particularly in the semiconductor and logistics sectors, alongside a wealth of educational resources regarding AI, SBOMs, and container compliance.

Strategic Updates

The Governing Board has released a special message regarding the project’s direction. Additionally, for those who missed it, the full recording of the OpenChain Mini-Summit from OSS Europe is now available.

New Adopters (ISO/IEC 5230)

The ecosystem continues to expand with major industry players announcing conformance. This is a strong signal for supply chain managers to review their own vendor requirements.

Knowledge Base & Webinars

Three critical topics were covered this month: Software identification, patent non-aggression (OIN), and container compliance.

Work Group Recordings & Deep Dives

If you are actively building compliance programs, these recordings provide insight into current best practices for AI, Telco, and SBOMs.

Community & Ecosystem News

  • New Partner: Sun Square is now an official OpenChain Partner. Read More

  • Survey Data: OpenChain featured in the Deloitte Global ITAM Survey 2025. Read More

  • Event Recaps:

Actionable Items for Readers

  1. Assess Your Container Strategy: With the new webinar on “Containers and Compliance,” now is a good time to review how your organization handles license compliance within containerized environments.

  2. Review AI Governance: The AI Work Group is highly active. If your organization is integrating AI, reviewing the “Asia Sync” or “NA/Europe Workshop” recordings is recommended to stay ahead of upcoming specification adjustments.

  3. Benchmarking: Review the Deloitte Global ITAM Survey to see how your asset management and compliance practices compare to global standards.

Get Involved: Future Meetings

The recordings listed above represent recurring monthly work groups. To influence the direction of OpenChain standards (particularly in AI and SBOMs), you are encouraged to attend the next live sessions.

  • For Automotive: Look for the next Automotive WG Workshop to discuss supply chain specifics.

  • For AI Policy: Join the next monthly workshop (split by region) to contribute to the AI compliance roadmap.

  • For General Education: The Monthly Specification and Education calls are the best entry point for newcomers.

To find the schedule for the next meetings and join the mailing lists, please visit: https://openchainproject.org/participate

Note: This newsletter usually only contains primary meetings. Some community meetings are not recorded or are released through other channels.

Read Previous Newsletters:

AI Usage:

This newsletter is created by using a template, curating links from a month of OpenChain news posted on the blog and using these prompts on Google Gemini to fill out the central news:

  • “Summarize the following newsletter for folks interested in the open source compliance to learn the latest changes in the space and find possible items that can act on. Include the links in this newsletter. Add notes on potential further actions by readers, particularly around attending future meetings. Direct people to this link to participate further: https://openchainproject.org/participate”

The newsletter is then subject to an edit cycle. If you spot any errors we missed, please contact us.

Nov 13

OpenChain Newsletter #83

By Monthly Newsletter, News

Newsletter – Issue 83 – October 2025

The OpenChain Newsletter provides a monthly summary of our work. It contains an overview of what we are doing to build trust around license compliance and security in the open source supply chain. We accept suggestions and ideas. Feel free to mail us at any time.

Headline News

Conformance Announcements

Two more companies have announced conformance with OpenChain ISO/IEC 5230, strengthening their software supply chain management:

Recorded Meetings

Several working group and specification calls were recorded. You can watch these to catch up on detailed discussions across various compliance topics.

OpenChain @ Events

OpenChain continues to have a strong presence at global events, discussing compliance, data protection, and open source management.

New Partner Announcements

The OpenChain ecosystem continues to grow with new partners.

Get Involved

  • Potential Action: The numerous recorded meetings from the AI, SBOM, and Telco work groups highlight the ongoing discussions in the community. You can join these future meetings to stay current and contribute.
  • To participate in the working groups, join mailing lists, and attend calls, visit: https://openchainproject.org/participate

Note: This newsletter usually only contains primary meetings. Some community meetings are not recorded or are released through other channels.

Read Previous Newsletters:

AI Usage:

This newsletter is created by using a template, curating links from a month of OpenChain news posted on the blog and using these prompts on Google Gemini to fill out the central news:

  • “Summarize the following newsletter for folks interested in the open source compliance to learn the latest changes in the space and find possible items that can act on. Include the links in this newsletter. Add notes on potential further actions by readers, particularly around attending future meetings. Direct people to this link to participate further: https://openchainproject.org/participate”

The newsletter is then subject to an edit cycle. If you spot any errors we missed, please contact us.

Oct 03

OpenChain Newsletter #82

By Monthly Newsletter, News

Newsletter – Issue 82 – September 2025

The OpenChain Newsletter provides a monthly summary of our work. It contains an overview of what we are doing to build trust around license compliance and security in the open source supply chain. We accept suggestions and ideas. Feel free to mail us at any time.

Key Announcements and Updates

  • Seven Services Announces OpenChain ISO/IEC 5230 Conformant Program: Seven Services has announced a new program to help organizations conform to the OpenChain ISO/IEC 5230 standard for open source license compliance. You can learn more about this announcement here.
  • OpenChain ISO/IEC 18974 and the Cyber Resilience Act (CRA): The OpenChain security standard, ISO/IEC 18974, has been referenced in the EU Cyber Resilience Act (CRA) harmonized standards discussion. This is a significant development for the project and its role in the future of cybersecurity. Read the full update here.
  • Introducing the OpenChain Ambassador Program: A new Ambassador Program has been launched to recognize and support community members who are actively promoting OpenChain. Learn more about the program and how to get involved here.
  • SBOM Study Group Becomes a Work Group: The successful SBOM Study Group has now transitioned into a formal SBOM Work Group. This change reflects the group’s focus on producing tangible outputs, starting with a new guide to SBOM quality. You can find more information here.
  • Developing a New Guide to SBOM Quality: The SBOM Work Group is developing a new, cross-industry guide to SBOM quality. You can review the draft and contribute your feedback here.

Community Insights

  • OpenChain at Open Source Summit North America: A presentation at OSS NA by representatives from Sony Group Corporation highlighted the challenges and importance of managing a global community, with a focus on language and cognitive load. This is a must-read for anyone involved in international open source projects. You can find the details here.

Recent Meeting Recordings

For those who missed recent meetings, recordings are available:

  • OpenChain Monthly Specification and Education Call (Europe / Asia) – 2025-09-17: Recording
  • OpenChain Monthly Specification and Education Call (North America – Europe) – 2025-09-10: Recording
  • OpenChain SBOM Work Group – Monthly Meeting – 2025-09-24: Recording
  • OpenChain AI Work Group – Asia Sync – 2025-09-11: Recording
  • OpenChain Telco Work Group – September – 2025-09-04: Recording
  • OpenChain AI Work Group – Monthly Workshop for North America and Europe – 2025-09-02: Recording

Recent Webinars

  • Webinar: Introduction to the Cyber Resilience Act (CRA): An overview of the new EU law covering “products with digital elements.” You can watch the webinar here.
  • Webinar: Compliant containers with the OSADL Base Image: Learn how to manage FOSS license obligations for containers using the OSADL Base Image. The webinar recording is available here.

Potential Further Actions

  • Get Involved with the SBOM Work Group: With the SBOM Study Group now a Work Group, this is an excellent opportunity to contribute to the development of a crucial industry guide.
  • Attend Future Meetings: The best way to stay informed and contribute is to attend the various work group and specification calls. The schedule and connection details for all meetings can be found on the OpenChain participation page.
  • Watch Past Recordings: If you are new to a topic or a working group, watching the past recordings is a great way to get up to speed.

To participate further in the OpenChain Project, including joining mailing lists and attending meetings, please visit: https://openchainproject.org/participate

Note: This newsletter usually only contains primary meetings. Some community meetings are not recorded or are released through other channels.

Read Previous Newsletters:

AI Usage:

This newsletter is created by using a template, curating links from a month of OpenChain news posted on the blog and using these prompts on Google Gemini to fill out the central news:

  • “Summarize the following newsletter for folks interested in the open source compliance to learn the latest changes in the space and find possible items that can act on. Include the links in this newsletter. Add notes on potential further actions by readers, particularly around attending future meetings. Direct people to this link to participate further: https://openchainproject.org/participate”

The newsletter is then subject to an edit cycle. If you spot any errors we missed, please contact us.

Sep 29

OpenChain Newsletter #81

By Monthly Newsletter, News

Newsletter – Issue 81 – August 2025

The OpenChain Newsletter provides a monthly summary of our work. It contains an overview of what we are doing to build trust around license compliance and security in the open source supply chain. We accept suggestions and ideas. Feel free to mail us at any time.

Key Updates and Announcements

  • AI System Bill of Materials Guide: The public comment period for the “Artificial Intelligence System Bill of Materials – Compliance Management Guide for the Supply Chain” has now closed. The AI Work Group, Governing Board, and Steering Committee are reviewing the feedback received. You can follow the progress and view the draft guide here.
  • OpenChain at Open Source Summit Europe: The OpenChain Project had a strong presence at the recent Open Source Summit Europe, with talks and panels from board members and work group chairs. A mini-summit was also held to share knowledge on license, security, and regulatory compliance. You can learn more about the event here.
  • Call for Translation Collaboration: The OpenChain Project is seeking community assistance in translating the self-certification materials for ISO/IEC 5230 (Open Source License Compliance) and ISO/IEC 18974 (Open Source Security Assurance) into German, Japanese, Korean, and Chinese (Simplified and Traditional). If you are fluent in these languages, you can contribute to this important effort. Draft machine translations are available on GitHub to get you started. Find out more here.
  • Improved Self-Certification: The online self-certification process for both OpenChain ISO/IEC 5230 and OpenChain ISO/IEC 18974 has been updated and improved, making it easier for organizations to assess and declare their conformance. Check out the updates here.
  • OpenChain in China: A successful mini-summit on “Open Source Software Supply Chain Security Compliance in the AI Era” was held at the 2025CCF China Open Source Conference in Shanghai. The event was led by the OpenChain China Work Group and covered both legal and technical aspects of compliance. Read more about it here.
  • Understanding the CHAOSS Project: A recent webinar explored the CHAOSS (Community Health Analytics for Open Source Software) project, a Linux Foundation initiative focused on developing metrics and software to better understand the health of open source communities. You can find more information about this informative session here.

Recent Meeting Recordings

For those who missed them, recordings of recent OpenChain meetings are now available:

  • Monthly Specification and Education Call (North America – Europe) – August 13, 2025: This call covered the latest project news, a call for papers for the Open Compliance Summit, and updates from the Specification and Education Work Groups. You can watch the recording here.
  • OpenChain Japan Community Day #34 at Mitsubishi Electric: Recordings from this two-day event, featuring discussions on OSPO activities, preventing common licensing mistakes, and an introduction to OSS compliance for beginners, are now online. Access the recordings here.

Potential Further Actions for Readers

  • Attend Future Meetings: The best way to stay informed and contribute is to participate in the various OpenChain work group calls. The monthly Specification and Education calls, along with other topical and regional meetings, are open to everyone. You can find the full schedule of upcoming meetings and information on how to join on the OpenChain participation page.
  • Contribute to Translations: If you have language skills, your contribution to the translation of self-certification materials would be highly valuable. This is a practical way to help the global community adopt OpenChain standards.
  • Engage with Work Groups: Consider joining the mailing lists of the work groups that align with your interests, such as the AI Work Group, Specification Work Group, or Education Work Group. This will allow you to follow discussions and contribute your expertise.

To get more involved in any of these activities and to help build a more trusted open source supply chain, please visit: https://openchainproject.org/participate

Note: This newsletter usually only contains primary meetings. Some community meetings are not recorded or are released through other channels.

Read Previous Newsletters:

AI Usage:

This newsletter is created by using a template, curating links from a month of OpenChain news posted on the blog and using these prompts on Google Gemini to fill out the central news:

  • “Summarize the following newsletter for folks interested in the open source compliance to learn the latest changes in the space and find possible items that can act on. Include the links in this newsletter. Add notes on potential further actions by readers, particularly around attending future meetings. Direct people to this link to participate further: https://openchainproject.org/participate”

The newsletter is then subject to an edit cycle. If you spot any errors we missed, please contact us.