THE LINUX FOUNDATION PROJECTS
Category

News

Dec 12

RECORDING: OpenChain Telco Work Group – 2025-12-04

By News

Attendees:

  • Jimmy Ahlberg, Ericsson
  • Takashi Ninjouji, Honda
  • Marc-Etienne Vargenau, Nokia

We show the anti-trust notice https://github.com/OpenChain-Project/Reference-Material/tree/master/OpenChain-Templates/Work-Group-Slide-Template as reminded by Shane.

Jimmy is back from his Asia trip. He will go in Japan for the Open Source and Compliance summits.

Jimmy has concerns about the recently released version 1.7 of the CycloneDX standard. CycloneDX v1.7 introduces first-class support for patents and patent families. These new fields could be used by patent trolls.

Shane will be leaving his role as OpenChain General Manager. His last day will be the 12th of December. There is no replacement for him yet. It might take some time. Everyone is welcome to propose candidates.

We have no news from CISA about their Minimum Elements document. Nokia comments were provided, but they are still not visible at https://www.regulations.gov/document/CISA-2025-0007-0001/comment. So we have no idea when the final version of the document will be published.

The Python ntia-conformance-checker https://pypi.org/project/ntia-conformance-checker/ has been updated. It is now possible to check also conformance to the CISA document, meaning checking also Licenses and Copyright Holder. But the default is still to check NTIA, an option has to be added to check for CISA. So it has no impact on the openchain-telco-sbom-validator that uses this library.

It is now also possible to check conformance for SPDX 3 SBOMs. But we have not yet tested this capability.

A new release 0.3.3 of the openchain-telco-sbom-validator has been published. It only fixes a very small bug in the handling of the CISA SBOM type when followed by more text in the comment.

Nokia has published a new Python tool https://pypi.org/project/pypispdx/ to create SBOMs for Python packages available on https://pypi.org/. It will create an SBOM in multiple SPDX 2.3 formats (tag:value, JSON, RDF, XML, YAML). The SBOM will be compliant with the OpenChain Telco SBOM Guide. It includes the recursive dependencies of the package. For every package, it contains the PackageDownloadLocation, the PackageChecksum in both SHA256 and MD5 and the licenses when available.

Takashi-san reminds that the last version of the German BSI document requires SPDX in version 3, whereas the previous version required only SPDX 2. Most tools, including for example Black Duck, produce only SPDX 2 for the moment. We do not know the reason why the BSI requires it. In practice, the simplest solution could be to convert SPDX 2 to SPDX 3 using the Java tools https://github.com/spdx/tools-java.

Takashi-san shows the work done by the automotive group about SPDX 3.

The OpenChain automotive work group handles SPDX 3 generate by Yocto and would like to validate it against the Telco Guide. Currently, the validator can only handle SPDX 2, as the Python library it uses (https://github.com/spdx/tools-python/) cannot parse SPDX 3. The last release of this library is more that one year old. A new maintainer has been nominated, so we hope to have a new release that can handle SPDX 3, but we have no date.

We can start to think to an update of the SBOM Guide to allow SPDX 3. The OpenChain SBOM work group has produced in its document a mapping table of the Telco Guide between SPDX 2 and SPDX 3.

Jimmy will provide a better wording of the paragraph about encryption (see https://github.com/OpenChain-Project/Telco-WG/pull/214).

Watch the Recording:

Be part of this:

Everyone is welcome to be part of this study group! OpenChain has free, open access to all its work groups and study groups. Just turn up, and listen in, and contribute comments, ideas and suggestions.

✉️ We have a dedicated mailing list:
https://lists.openchainproject.org/g/telco

💻 We have a dedicated GitHub Repo:
https://github.com/OpenChain-Project/Telco-WG

You are also welcome to participate in any of our other working groups around the world:

Dec 11

RECORDING: OpenChain AI Work Group – Monthly Workshop for North America and Europe – 2025-12-02

By News

We continued to explore the question of how to address the intersection of open source, AI and process management in our regulation OpenChain AI Work Group Workshop for North America and Europe. Chaired by Matthew Crawford of Arm and Dave Marr of Qualcomm, this work group is building on the knowledge gathered and deployed to market in the OpenChain AI System Bill of Materials Compliance Guide.

Watch the Recording:

Get Involved:

Everyone is welcome to be part of this activity! OpenChain has free, open access to all its work groups and study groups. Just turn up, and listen in, and contribute comments, ideas and suggestions.

✉️ We have a dedicated mailing list for the AI Work Group: https://lists.openchainproject.org/g/ai

Attend Future Meetings:

You can find and get the dial-in details for all future meetings from our participate page here: https://www.openchainproject.org/participate

Dec 09

OpenChain and Friends 2026 – Stuttgart – March 24~26

By Featured, News
“OpenChain and Friends” is an in-person community event focused on open source software supply chain management, compliance, and collaboration. It’s organized by the OpenChain Project in partnership with local and international communities, such as The FOSS-LÄND Community. The event takes place in Stuttgart, Germany and gathers people working with open source across different industries.
 
Register Here / Hier Registrieren Registration is required for this free event / kostenlose Veranstaltung, aber Registrierung ist erforderlich

In-person only.  (Please actively select/de-select the topics you plan to attend or not, we will only consider your registration for the actively selected tracks on a first come first serve base. By submitting your registration you confirm to follow the event code of conduct.)

The event is subject to the Chatham House Rule.

We will hold the second annual OpenChain and Friends event in Stuttgart from the 24th to the 26th of March 2026. (learn about last year’s edition here: https://openchainproject.org/news/2025/02/20/openchain-and-friends-stuttgart )

Main Event Location:

Satellite Event Locations:

Socializing Event Locations (on day 1):

In Partnership With:

The FOSS-LÄND Community

Topic Streams:

  1. Open Source Compliance and OSPOs  – Open Source Compliance & OSPO – processes, automation, governance & NFRs
  2. Cybersecurity – Cybersecurity in the Software Supply Chain – CRA, SBOM requirements, ISO 18974, and good practices
  3. Women in Open Source – networking and cross-track contributions
  4. Embedded and Open Source Hardware – from chip design to licensing and IP questions
  5. Artificial Intelligence – AI Systems Engineering & Data Platforms – methods, tools, open platforms, open AI agents for resilient supply chains
  6. Digital Sovereignty and Open Source in Business – public/private collaboration, open source as a competitive factor
  7. Education – open trainings, infrastructure, new formats
  8. Automotive /SDV – Open Automotive Platform, Ecosystems, Tool Interoperability
  9. Cross-Innovation and Innovation Practices – potential of mixing creative industries and digital sovereignty ideas with industrial Open Source
  10. Linux OS and beyond – software supply chain from the Linux ecosystem perspective

KEYNOTES

on tuesday march 24th 2026:

Bjoern Schiessle Nextcloud

“Digital sovereignty isn’t about choosing your dependencies — it’s about eliminating them.”

– Björn Schiessle,  Co-founder and Director of Sales Engineering at Nextcloud

Charley Mann & Florian Wohlrab OpenHW Foundation

“The Unified RISC-V IP Access Platform is absolutely critical to supporting technological sovereignty in Europe, and the OpenHW Foundation is committed to developing it into a sustainable, interoperable, and community driven resource for the wider RISC-V ecosystem. Open source collaboration is essential to ensuring a competitive playing field, and by working together, we will be able to go further, faster.”

– Florian Wohlrab, CEO, OpenHW Foundation

Dr.-Ing. Thomas Usländer Fraunhofer IOSB

„Beyond and precisely because of the AI hype there is need for a systematic approach to engineer, develop, deploy and operate AI systems. If not applied along the whole lifecycle, there is no sustainable and commercial benefit of an AI system.”

– Dr.-Ing. Thomas Usländer, Business Developer AI Systems Engineering, Fraunhofer IOSB, and head of the subprojects “AI Data Platform” and “AI Challenge” of the AI Alliance Baden-Württemberg

 

Aleksander Sadowski (ALSADO)

“Let’s empower sole inventors to become the manufacturers of tomorrow, securing our long term prosperity by establishing open-source software in manufacturing!”

– Aleksander Sadowski (ALSADO), a founder, inventor, author, developer and influencer in the German mechanical engineering industry

 

on wednesday march 25th 2026:

Prof. Dr. Ingo Weber (Fraunhofer Gesellschaft / TU Munich)

   “George Box famously said: ‘All models are wrong, but some models are useful.’ This is also true for LLMs.
But to know how we can make them useful, openness in code, data, and governance helps.”

– Prof. Dr. Ingo Weber, Director for AI & Innovation at the Fraunhofer Gesellschaft, Full Professor and Chair of Information System Development and Operation in the Computer Science Department at the TUM School of Computation, Information and Technology (Technical University of Munich)

Dr. Ingo Simonis (CTO Open Geospatial Consortium)


“The most powerful AI systems won’t be built in isolation. They’ll emerge from open platforms where diverse communities collaborate, share data, and validate solutions together”

– Dr. Ingo Simonis (CTO Open Geospatial Consortium)

on thursday march 26th 2026:

Shane Coughlan (Open Invention Network)

“Open source is community and innovation realized in its purest form, and our management of this paradigm is critical for sustainable, sovereign societies.”

– Shane Coughlan, Global Ambassador OIN 2.0, Open Invention Network

 

Dirk Targoni (Robert Bosch GmbH)


“Don’t avoid dependencies—master them: track everything, verify continuously, and enforce need‑to‑know. Open source isn’t the risk; opaque code is. As AI reshapes the security paradigm, our winning strategy is shared visibility and collaborative defense.”

– Dirk Targoni, Product Vulnerability and Incident Response Team at Robert Bosch GmbH, ASRG-S lead and co-organizer

 

Franz Loogen (e-mobil BW GmbH)

“Software increasingly defines our industry. Open collaboration strengthens the supply chain. Through the Automotive Software Collaboration BW and the FOSS‑LÄND Community, we provide tailored support for organisations of all kinds, including OEMs, SMEs, public organisations and research institutions.“

– Franz Loogen, President of e-mobil BW GmbH

 

Mary Meixia Wang (OpenChain)

“In today’s software world, trust in open source is essential, and compliance with licensing and security standards is a fundamental part of that trust. My mission is to help every industry see the true benefits of open source within the supply chain. As open source evolves, it’s a shared responsibility and chances across the entire supply chain, and together, we can build a transparent and collaborative ecosystem for all.”

– Mary Meixia Wang, Executive Director of the Linux Foundation OpenChain Project

 

Program Details

Program details and schedule are collaboratively developed and can be tracked in our repository: OpenChain and Friends Program 2026.

Overall Event Schedule (all days, all locations)

Preliminary schedule (as of 2026-03-04 increment 7 – including a link column to access the abstracts in the stream-specific agendas, where already available – updates will be regularly provided – stay tuned!)

OpenChainAndFriends_preliminary_schedule_inc7.pdf

Topic-Stream specific schedules with details

Hint: All contents still preliminary.

SPONSORS

DIAMOND

BRONZE

Contact FOSS@e-mobilbw.de or helpdesk@lists.openchainproject.org for more information. We would love for you to be part of this, and to help contribute to our welcoming community of open source governance professionals. We welcome everyone from small, medium and large companies, local and national government, non-profit organizations, academica and also independent parties curious about what is happening in this space.

Colours in the program based on https://yeun.github.io/open-color/

Event is listed in https://foss.events/ ; https://dev.events/ ;  and submitted to https://confs.tech/

Dec 07

OpenChain @ COSCON 2025 on 2025-12-06

By News

The OpenChain Project had a Mini-Summit as COSCON 2025 in China on the 6th of December 2025. We were hosted by the local open source community in Beijing, and our OpenChain China Work Group Chair – Zhenhua Sun of ByteDance – lead discussion around licensing, security and regulatory compliance topics.

View the Keynote Slides:

Dec 04

Webinar – A Panel on Generative AI Risks and Management

By ai, legal, licensing, News, Webinar

OpenChain hosted a panel featuring experts from Bitsea, Jun Legal, FossID and SCANOSS discuss their experience and opinions on the topic of managing Generative AI in corporate environments. This discussion featured both structured commentary and plenty of opportunity for the audience to engage and ask questions.

Watch the Webinar:

More About Our Webinars:

This event is part of the overarching OpenChain Project Webinar Series. Our series highlights knowledge from throughout the global OpenChain eco-system. Participants are discussing approaches, processes and activities from their experience, providing a free service to increase shared knowledge in the supply chain. Our goal, as always, is to increase trust and therefore efficiency. No registration or costs involved. This is user companies producing great informative content for their peers.

Check Out The Rest Of Our Webinars:

This OpenChain Webinar was broadcast on 2025-12-04.

Dec 04

COMING SOON: Webinar – A Panel on Generative AI Risks and Management – 2025-12-04 @ 08:00 UTC / 09:00 CET / 16:00 CST / 17:00 KST + JST

By News

OpenChain is hosting a panel featuring experts from Bitsea, Jun Legal, FossID and SCANOSS discuss their experience and opinions on the topic of managing Generative AI in corporate environments. This discussion will feature both structured commentary and plenty of opportunity for the audience to engage and ask questions.

Join here 2025-12-04 @ 08:00 UTC / 09:00 CET / 16:00 CST / 17:00 KST + JST:

Dec 01

RECORDING: OpenChain Meridian 22 Work Group Meeting – 2025-12-01

By News

The OpenChain Meridian 22 Work Group held its second meeting in early December with a focus on planning next steps for the region. Given the geographic scope, crossing over many cultures and languages, there was plenty to talk about. Open Source Summit Europe in Prague during 2026 was a key point of focus.

Watch the Recording:

Nov 29

Webinar – Software Hash ID: you will not be able to live without it

By community, licensing, News, standards, Webinar

The Software Hash Identifier (SWHID) is an intrinsic identifier for software source code and artifacts that became an international standard in April 2025 (ISO/IEC 18670:2025).

In this talk, Thomas Aynaud presented the Software Heritage mission and data model, introduced the concept of intrinsic identifiers, explained the SWHID specification, and presented its open standard governance model. He shared how open source projects and companies can adopt and benefit from SWHID through real-world use cases, and concluded with a summary of the key advantages of SWHID and an update on Software Heritage’s plans to support its development and adoption in the coming months.

Watch the Webinar:

More About Our Webinars:

This event is part of the overarching OpenChain Project Webinar Series. Our series highlights knowledge from throughout the global OpenChain eco-system. Participants are discussing approaches, processes and activities from their experience, providing a free service to increase shared knowledge in the supply chain. Our goal, as always, is to increase trust and therefore efficiency. No registration or costs involved. This is user companies producing great informative content for their peers.

Check Out The Rest Of Our Webinars:

This OpenChain Webinar was broadcast on 2025-11-27.

Nov 28

A Message from the Governing Board of the OpenChain Project

By Featured, News

A message from the Governing Board of the OpenChain Project:

We wanted to let you know that there will be a rotation in the administrative leadership of the OpenChain Project in Mid-December 2025. Shane Coughlan, our General Manager over the last eight years, will be transitioning to work on a personal venture, and we will shortly be announcing a new executive leader in the same role. In the meantime, the Governing Board, The Linux Foundation project management office, the Work Group Chairs and the Ambassadors will collaborate as usual to continue our normal meetings, releases and community building.

The Governing Board would like to express their gratitude to Shane for all the work he has put into the project over the years, constantly going above and beyond. Shane’s work with the OpenChain Project is nothing short of spectacular, he has been a community builder, role model, and friend to the OpenChain community and he will be missed. The board want to wish him the best of luck in his new endeavors and for him to know that he will forever remain part of the OpenChain family he helped create.

“I have been honored to work on this project, with this board and with everyone in our exceptional community over the last eight and a half years,” says Shane Coughlan, OpenChain General Manager. “After such a long period, and enjoying so much collective success, it is a difficult decision to move on to a new venture. However, there is a personal project that I want to attend to, and the passage of time has suggested to me that it is appropriate to begin work on that activity. I will speak more to this in early 2026, but for now my focus is on finalizing the transition of the administrative leadership of the OpenChain Project. We have extensive internal process material and a purposefully distributed management system to aide in sustainability and such transitions, and I am fully confident in the health and continued momentum of the project and our activities.

In closing, I want to take a moment to thank everyone who has made this journey possible for me. While there are too many people to name individually – such is the scale of our community and accomplishment – I would like to give special thanks to David Marr of Qualcomm for leading the foundation of the OpenChain Project, to Jimmy Ahlberg of Ericsson for leading us through the evolution into a multi-ISO standard project, to Watanabe San, Kobota San, Owada San and Fukuchi San for being instrumental in the development of our work in Japan, to Haksung Jang for leading our work in Korea to such success, to Zhenhua Sun in China for his leadership and driving frequent local meetings, to Oliver Fendt and Marcel Kurzmann in Germany for endlessly encouraging and supporting one of the exceptional local communities in the domain of processes and automation, and finally to the dearly departed Ueda San for providing inspiration in community building that has always helped guide and ensure the success of what we do.

And finally my thanks to you all, who have attended calls, come to meetings and read (and reshared) our news across the world. You made this community, and you made this success. I am grateful to call you my colleagues in open source.”

An administrative note: For those of you interested in learning more about this transition for 2026 – and about the executive leadership role – you can contact Renu from the Project Management office at helpdesk@lists.openchainproject.org