News

After a successful first #openchainandfriends – event this year, we plan to have our next event for 2026.

So mark the 24^th , 25^th and 26^th of march 2026 in your calendars and prepare to join us in Stuttgart and talk about “Supply Chain (Chances and) Risk Management and beyond!”

We enhance our open source process management and automation topics with a dedicated stream for Open Source education and will have additional topic streams about Artificial Intelligence, CyberSecurity and Digital Sovereignty. We will explore Automotive / SDV and Embedded and OpenHW topics and discuss potential Open Source business opportunities for small- and medium-sized enterprises.

The program is collaboratively developed by the contributing communities so please regularly visit our event website to monitor the progress or even get involved yourself!:

https://openchainproject.org/news/2025/12/09/openchain-and-friends-2026

Big thanks to our friends at The FOSS-LÄND Community (https://github.com/the-foss-laend) for helping to make this happen and also supporting us again in the next year.

Registration will open in early January – Stay tuned!

We wish everyone a great holiday season and hope to see you in our event in 2026!

We Discussed:

Lead by Chris Wood (Chair, Specification Work Group) and Martin Yagi (Chair Education Work Group), the call covered the following topics:

Survey results around the OpenChain ISO standards, the final draft of the new online training course material, and next steps to encourage community feedback.

Watch the Recording:

Check out the Meeting Slides:

• https://github.com/OpenChain-Project/Meeting-Minutes/tree/main/Slides/2025

Coming Next:

• A ton of work pending on education, and a survey to be released for the spec. Expect a strong focus on looking at what we have accomplished, looking at feedback, and making it better.

Join Our Work:

Everyone is welcome to be part of the Specification Work Group. You can join their mailing list here:
https://lists.openchainproject.org/g/specification/

You can find and be part of all OpenChain calls through our participation page here:
https://openchainproject.org/participate

Our regular OpenChain AI Work Group Asia Sync took place with participants from Europe and Asia, and with a focus on discussing next steps with the AI System Bill of Materials Compliance Guide. We are encouraging more market feedback to inform future development.

Watch the Recording:

Get Involved:

Everyone is welcome to be part of this activity! OpenChain has free, open access to all its work groups and study groups. Just turn up, and listen in, and contribute comments, ideas and suggestions.

✉️ We have a dedicated mailing list for the AI Work Group: https://lists.openchainproject.org/g/ai

Attend Future Meetings:

You can find and get the dial-in details for all future meetings from our participate page here: https://www.openchainproject.org/participate

Attendees:

• Jimmy Ahlberg, Ericsson
• Takashi Ninjouji, Honda
• Marc-Etienne Vargenau, Nokia

We show the anti-trust notice https://github.com/OpenChain-Project/Reference-Material/tree/master/OpenChain-Templates/Work-Group-Slide-Template as reminded by Shane.

Jimmy is back from his Asia trip. He will go in Japan for the Open Source and Compliance summits.

Jimmy has concerns about the recently released version 1.7 of the CycloneDX standard. CycloneDX v1.7 introduces first-class support for patents and patent families. These new fields could be used by patent trolls.

Shane will be leaving his role as OpenChain General Manager. His last day will be the 12^th of December. There is no replacement for him yet. It might take some time. Everyone is welcome to propose candidates.

We have no news from CISA about their Minimum Elements document. Nokia comments were provided, but they are still not visible at https://www.regulations.gov/document/CISA-2025-0007-0001/comment. So we have no idea when the final version of the document will be published.

The Python ntia-conformance-checker https://pypi.org/project/ntia-conformance-checker/ has been updated. It is now possible to check also conformance to the CISA document, meaning checking also Licenses and Copyright Holder. But the default is still to check NTIA, an option has to be added to check for CISA. So it has no impact on the openchain-telco-sbom-validator that uses this library.

It is now also possible to check conformance for SPDX 3 SBOMs. But we have not yet tested this capability.

A new release 0.3.3 of the openchain-telco-sbom-validator has been published. It only fixes a very small bug in the handling of the CISA SBOM type when followed by more text in the comment.

Nokia has published a new Python tool https://pypi.org/project/pypispdx/ to create SBOMs for Python packages available on https://pypi.org/. It will create an SBOM in multiple SPDX 2.3 formats (tag:value, JSON, RDF, XML, YAML). The SBOM will be compliant with the OpenChain Telco SBOM Guide. It includes the recursive dependencies of the package. For every package, it contains the PackageDownloadLocation, the PackageChecksum in both SHA256 and MD5 and the licenses when available.

Takashi-san reminds that the last version of the German BSI document requires SPDX in version 3, whereas the previous version required only SPDX 2. Most tools, including for example Black Duck, produce only SPDX 2 for the moment. We do not know the reason why the BSI requires it. In practice, the simplest solution could be to convert SPDX 2 to SPDX 3 using the Java tools https://github.com/spdx/tools-java.

Takashi-san shows the work done by the automotive group about SPDX 3.

The OpenChain automotive work group handles SPDX 3 generate by Yocto and would like to validate it against the Telco Guide. Currently, the validator can only handle SPDX 2, as the Python library it uses (https://github.com/spdx/tools-python/) cannot parse SPDX 3. The last release of this library is more that one year old. A new maintainer has been nominated, so we hope to have a new release that can handle SPDX 3, but we have no date.

We can start to think to an update of the SBOM Guide to allow SPDX 3. The OpenChain SBOM work group has produced in its document a mapping table of the Telco Guide between SPDX 2 and SPDX 3.

Jimmy will provide a better wording of the paragraph about encryption (see https://github.com/OpenChain-Project/Telco-WG/pull/214).

Watch the Recording:

Be part of this:

Everyone is welcome to be part of this study group! OpenChain has free, open access to all its work groups and study groups. Just turn up, and listen in, and contribute comments, ideas and suggestions.

✉️ We have a dedicated mailing list:
https://lists.openchainproject.org/g/telco

💻 We have a dedicated GitHub Repo:
https://github.com/OpenChain-Project/Telco-WG

You are also welcome to participate in any of our other working groups around the world:

• https://openchainproject.org/participate

We continued to explore the question of how to address the intersection of open source, AI and process management in our regulation OpenChain AI Work Group Workshop for North America and Europe. Chaired by Matthew Crawford of Arm and Dave Marr of Qualcomm, this work group is building on the knowledge gathered and deployed to market in the OpenChain AI System Bill of Materials Compliance Guide.

Watch the Recording:

Get Involved:

Everyone is welcome to be part of this activity! OpenChain has free, open access to all its work groups and study groups. Just turn up, and listen in, and contribute comments, ideas and suggestions.

✉️ We have a dedicated mailing list for the AI Work Group: https://lists.openchainproject.org/g/ai

Attend Future Meetings:

You can find and get the dial-in details for all future meetings from our participate page here: https://www.openchainproject.org/participate

Save the date! We will hold the second annual OpenChain and Friends event in Stuttgart from the 24th to the 26th of March 2026.
(learn about last year’s edition here: https://openchainproject.org/news/2025/02/20/openchain-and-friends-stuttgart )

Main Event Location:

• Service and Supply Chain Campus Feuerbach,

Satellite Event Locations:

• Mercedes-Benz in Vaihingen
• Bosch in Ludwigsburg

In Partnership With:

The FOSS-LÄND Community

Topic Streams:

1. Open Source Compliance and OSPOs – join the Matrix Open Source Compliance and OSPO discussion
2. Cybersecurity – join the Matrix CyberSecurity discussion
3. Women in Open Source – join the Matrix Women in Open Source discussion
4. Embedded and OpenHW – join the Matrix Embedded and OpenHW discussion
5. Artificial Intelligence – join the Matrix Artificial Intelligence discussion
6. Digital Sovereignty and Open Source in Business – join the Matrix Digital Sovereignty discussion
7. Education – join the Matrix Education discussion
8. Automotive /SDV – join the Matrix Automotive and SDV discussion

Program details are collaboratively developed and can be tracked in our repository: OpenChain and Friends Program 2026.

Contact helpdesk@lists.openchainproject.org for more information. We would love for you to be part of this, and to help contribute to our welcoming community of open source governance professionals. We welcome everyone from small, medium and large companies, local and national government, non-profit organizations, academica and also independent parties curious about what is happening in this space.