Our first monthly meeting of the year contained some great discussion about the spec with oversight by Co-Chair Helio (we worked on issues as usual) and Nathan also set the tone for future plans around the Education Work Group. It was a relatively small group due to the new year vacation ending unevenly around the world, but some substantive material was covered.
Please note that we also had a ton of interesting news to cover. Check out the slides for the details and the links to each item.
Interneuron, a UK-based service provider to the British National Health Service (NHS), is the first company to formally announce an OpenChain Security Assurance Specification conformant program. This continues their history of engagement with open source standards – including previous adoption of OpenChain ISO/IEC 5230, the International Standard for open source license compliance.
“We have worked with Interneuron from when they were a start-up,” says Martin Callinan, Director at Source Code Control Limited. “From the outset we implemented a secure by design approach to the management of open source components used in their software development. It is hugely beneficial that OpenChain have created the Security Assurance Specification to provide guidance and benchmark the processes that have been implemented.”
“Interneuron has a long-term, focused approach on ensuring solutions provided to the NHS demonstrate excellence in sustainable, manageable ways as well as through providing technological solutions,” says Shane Coughlan, OpenChain General Manager. “Their previous adoption of OpenChain ISO/IEC 5230 aligned their company behind reproducible, standard processes. Their newly announced adoption of the OpenChain Security Assurance Specification continues this path, and covers one of the most critical domains in information technology. Their conformance, accomplished in conjunction with their support partner Source Code Control, is an important milestone for the global community as well. With the OpenChain Security Assurance Specification disseminating worldwide, companies like Interneuron provide a clear example of how and why to leverage this standard today.”
About Interneuron
Interneuron is a different kind of healthcare IT organization. We are a purpose driven company, Community Interest Company (CIC) that exists primarily for the benefit of those in need of health and social care. Interneuron projects aim to help NHS organizations replace their legacy technology with world-class clinical software that will revolutionize the way in which data is integrated, stored and used. Interneuron’s open source philosophy is to make this new technology freely available. NHS Trusts will be able to download, test and implement the software, or receive support from Interneuron if that is preferred
Founded in 2014 by Martin Callinan, Source Code Control has established itself as one of the only Open Source and Cloud Transformation consultancy businesses. We help organizations who have software at the core of their company value, build trust in software supply chains and simplify the cloud transformation process. With this in mind, our main aim is to minimize an organization’s risk when dealing with open source and cloud software.
The OpenChain Project has an extensive global community that involves thousands of companies collaborating to make the supply chain quicker, more effective and more efficient. We work together to create trust between entities around open source. Our job is to increase trust in the open source supply chain. We do this by maintaining ISO/IEC 5230:2020, the International Standard for open source license compliance, and our Security Assurance Reference Specification. We also have a large global community where knowledge is shared to reduce friction and increase efficiency across all aspects of open source process management.
The Linux Foundation is the world’s largest non-profit connecting global technical experts, and providing them with a neutral and trusted platform to develop open source projects. Founded in 2000 as the home of the Linux Kernel, the Linux Foundation has grown to host hundreds of open source projects, with a community spanning 2,950+ members, 540,000+ contributing developers, and 19,000+ contributing companies.
The OpenChain Security Assurance Specification 1.1 has been building momentum as a sister specification to ISO/IEC 5230:2020, the International Standard for open source license compliance. With an identical approach to high level process management, the OpenChain Security Assurance Specification is designed to help companies adopt the key requirements of a quality open source security assurance program.
Self-certification is available in English, German and Simplified Chinese. In addition, the following companies have announced services to support adoption of this specification. Three of these organizations are OpenChain Project official third-party certifiers, and all of these companies provide onboarding, adoption and review services across the global supply chain.
CAICT (Mainland China)
CAICT is an official OpenChain Project partner and one of our third-party certifiers with a regional service offering.
If you’re not already aware of it, OpenChain ISO/IEC 5230:2020 is the International Standard for open-source license compliance and is designed to build trust in the supply chain. The standard allows companies of all sizes and in all sectors to adopt the key requirements of a quality open-source compliance program. This is an open standard, and all parties are welcome to engage with the community to share their knowledge and contribute to the future of the standard. BlackBerry recently became the first company based in North America to adopt and conform to OpenChain across its entire product portfolio. The company saw the need to lead in this space and joined other technology-leading companies to adopt a higher standard for its software supply chain.
The OpenChain Export Control Work Group held its second meeting in December 2022. This meeting is providing an informal, exploratory platform for discussion around open source, export control, and the type of community resources people have found in the ecosystem.
We are working on a landscape spreadsheet. Everyone is invited to contribute:
The OpenChain Security Assurance Specification 1.1 is now available in Simplified Chinese. This translation was created by Zhang Jun Xia from the China Academy of Information and Communications Technology (翻译人：张俊霞，中国信息通信研究院). Zhang Jun Xia previously contributed the Simplified Chinese self-certification checklist for this specification.
Please note that we are always glad to have review for any errors in the translations we provide, and we are always glad to receive new translations. We work via GitHub and you can find the OpenChain Security Assurance Specification repository here:
Part 10 (!) of a long-running open source compliance series on the Japanese website @IT covers some of the differences between SPDX and CycloneDX, two SBOM formats with growing mindshare across the supply chain. Ninjouji San from Toshiba is the author of this article and is well-known for his contributions as an OpenChain Japan Work Group member and a board representative for Toshiba as a Platinum of the OpenChain Project.
The OpenChain Project has invested resources throughout 2022 towards improving the sustainability and continuity of our project. As part of this, the OpenChain Project Governing Board decided to initiate a chairperson election. This initiative was lead by David Marr of Qualcomm, our founding chairperson, and was designed to introduce processes for a predictable cycle of leadership rotation at the very top of the project management structure.
Jimmy Ahlberg of Ericsson was duly elected OpenChain Project Governing Board Chair on the 8th of December by his peers, the voting members of the OpenChain Project Governing Board. The board is made up of one voting representative from each of the Platinum Member companies. We currently have 24 Platinum Members spread across three continents, providing one of the most geographically diverse boards in our industry.
The OpenChain Board Chair is a pivotal position. As with everything in this project, it is a position that offers influence but not control, though in this case the influence is specifically targeted towards our long-term strategic future. Jimmy has been elected for a period of three years.
As the steward of two industry standards, one of which already has an ISO/IEC grant, the OpenChain Project Governing Board has a responsibility to ensure stability and sustainability. From fiscal decisions to overarching strategy, they meet once a quarter to assess our status and future steps. Because this is an open source project, their decisions are not taken in isolation. Our community has tremendous latitude and influence on this project, and our board has tremendous respect for what that means.
Jimmy is stepping into the role with the continued support of David and the rest of the OpenChain Project Governing Board, and our fundamental strategy remains consistent. This said, we expect and look forward to Jimmy making his mark as new chairperson, and innovating around our top-level strategy based on his insight, experience and corporate background.
If you have questions, comments or suggestions directed towards Jimmy, don’t hesitate to connect with him on one of our monthly calls, via our mailing lists or by direct mail. The leadership of the OpenChain Project is here to serve you, the community seeking to build trust in the supply chain.
To end this lengthy post, please note that the OpenChain Project Governing Board formally thanks David Marr for his exceptional work in founding and growing this project. He first brought people together to discuss the concept of standardization around open source license compliance eight years ago, and it takes a special type of determination and community-building to turn that into an executed ISO/IEC standard. It is also thanks to David that we have expanded our activities based on community feedback to other aspects of a trusted supply chain. His impact has been and continues to be immeasurable.
The OpenChain Security Assurance Specification 1.1 is now available in German. Self-certification is also available via checklists and questionnaires. Huge thanks to Katharina and the rest of the the team at PwC for making this happen.
Get the OpenChain Security Assurance Specification 1.1 in German:
If you self-certify, you can be listed on the OpenChain Project website alongside your peers. This is optional but recommended as a useful exercise for the supply chain. Contact us to get the free process underway.
Self-certification for the Security Assurance Specification 1.1 is now available in English, Simplified Chinese and German. More languages are expected to be made available soon.
