The OpenChain Project took center stage alongside our peers at OpenSSF and TODO Group during the OSPOlogy.live event hosted by Ericsson in Sweden on the 19th and 20th of October 2022. The main presentation slides are available now for your review.
Learn about the OSPOlogy.live event in Sweden:
We are preparing a new path to conformance document via GitHub. The current iteration is biased towards ISO/IEC 5230, the International Standard for open source license compliance. We invite you to take a look, help expand it, and especially help to add material to support the OpenChain Security Assurance Specification.
You can contribute by opening issues:
Or you can join our education mailing list:
The OpenChain Project is ready to start accepting feedback to improve our license compliance and security standards.
OpenChain Security Assurance Specification:
https://github.com/OpenChain-Project/Security-Assurance-Specification
Easy way to suggest Security Assurance Specification improvements:
https://github.com/OpenChain-Project/Security-Assurance-Specification/issues/new/choose
OpenChain License Compliance Specification (ISO/IEC 5230):
https://github.com/OpenChain-Project/License-Compliance-Specification
Easy way to suggest License Compliance Specification improvements:
https://github.com/OpenChain-Project/License-Compliance-Specification/issues/new/choose
You can also send your suggestions to our specification mailing list:
https://lists.openchainproject.org/g/specification
Notes
Pre-existing submissions for the security assurance standard:
https://github.com/OpenChain-Project/Security-Assurance-Specification/issues
Pre-existing submissions for the license compliance standard:
https://github.com/OpenChain-Project/License-Compliance-Specification/issues
This series highlights offerings from various service providers throughout the global OpenChain eco-system. Each featured partner has an official relationship with the project, whereby they may use our trademark for marketing OpenChain-specific services, and in exchange they help with community outreach, education and other aspects of collaborative (and free) support.
This event is part of the overarching OpenChain Project Webinar Series. Our series highlights knowledge from throughout the global OpenChain eco-system. Participants are discussing approaches, processes and activities from their experience, providing a free service to increase shared knowledge in the supply chain. Our goal, as always, is to increase trust and therefore efficiency. No registration or costs involved. This is user companies producing great informative content for their peers.
This OpenChain Webinar was broadcast on 2022-10-18.
The OpenChain Project has a new slide template for meetings and presentations. You will find it here:
Please feel free to use this for your work groups, advocacy around the project, and to help education people inside your company or supply chain.
Please Note:
The OpenChain Project Meeting and Presentation Template contains the OpenChain trademark and can only be used for matters related to OpenChain Project activities. This template also contains The Linux Foundation trademarked logo. The Linux Foundation trademark policy can be found here:
To use the OpenChain trademark for commercial activities please join the OpenChain Partner Program:
The OpenChain Security Assurance Specification 1.1 self-certification checklist is now available in Simplified Chinese. A big thank you to Zhang Jun Xia from CAICT for making this happen.
This checklist is designed to help organizations adopt the de facto standard for open source security assurance. Organizations using this self-certification process will also meet the requirements of the specification when it graduates the ISO/IEC JTC-1 PAS Transposition process, with an estimated arrival time of that International Standard in mid-2023.
The checklist contains a series of “yes” or “no” statements. If you can answer “yes” to everything, you are self-certified. If you answer “no” to some items, you know where to invest further time to build a quality security assurance program.
Do you want to get the English version of the self-certification checklist?
This checklist is licensed under CC-0 (effectively public domain), so you can take it, integrate it, and remix it without any restrictions. You do not even have to provide attribution.
We welcome contributions to improve this checklist. You can contribute by opening a GitHub issue here:
https://github.com/OpenChain-Project/Reference-Material/issues
This is the OpenChain Monthly Community Call for Mainland China / Japan / Korea / Taiwan + USA. People from everywhere else are very welcome to join too! We realize the timezone is terrible for Europe. We have a separate monthly call designed for Europe / USA. It takes place on the First Tuesday of every month.
It is open to every individual and company regardless of their membership of Linux Foundation or the OpenChain Project. It provides a forum to bring together the various things the OpenChain community is doing around the world, from building our family of standard (licensing compliance and now security compliance), assisting with tooling, SBOMs and OSPOs, and facilitating industry specific discussions in areas like telco and automotive.
Agenda
1 Introductions
2 Specification (process standards) news
3 SBOM news
4 OSPO news
5 Automation news
6 Community feedback and comments – issues for standards and core supporting material
7 Community feedback and comments – issues for reference and supporting material
8 Community feedback and comments – issues to support other projects
9 Any other business
10 Close of meeting
This meeting is held in the OpenChain Project Zoom room:
https://zoom.us/j/4377592799
Check your timezone:
PDT United States Pacific UTC-07:00
UTC Coordinated Universal Time UTC
CET Central European Time UTC+01:00
IST India Standard Time UTC+05:30
CST China Standard Time UTC+08:00
KST Korea Standard Time UTC+09:00
JST Japan Standard Time UTC+09:00
Compare timezones:
https://www.worldtimebuddy.com
Join via one tap mobile:
+86 10 8783 3177,,4377592799# Mainland China
+33 1 8699 5831,,4377592799# France
+49 69 7104 9922,,4377592799# Germany
+81 524 564 439,,4377592799# Japan
+82 2 3143 9612,,4377592799# Korea
+91 80 71 279 440,,4377592799# India
+886 (2) 7741 7473,,4377592799# Taiwan
+44 330 088 5830,,4377592799# UK
+13017158592,,4377592799# USA
Find your local country number:
https://zoom.us/u/awFnORNiA
Meeting ID: 437 759 2799
The OpenChain Security Assurance Specification 1.1 self-certification checklist is now available. This is designed to help organizations adopt the de facto standard for open source security assurance. Organizations using this self-certification process will also meet the requirements of the specification when it graduates the ISO/IEC JTC-1 PAS Transposition process, with an estimated arrival time of that International Standard in mid-2023.
The checklist contains a series of “yes” or “no” statements. If you can answer “yes” to everything, you are self-certified. If you answer “no” to some items, you know where to invest further time to build a quality program.
This checklist is licensed under CC-0 (effectively public domain), so you can take it, integrate it, and remix it without any restrictions. You do not even have to provide attribution.
We welcome contributions to improve this checklist. You can contribute by opening a GitHub issue here:
https://github.com/OpenChain-Project/Reference-Material/issues
Witzel Erb Backu & Partner, a law firm founded in 2020 by alumni of the Munich law firm SSW Schneider Schiffer Weihermüller, has joined the OpenChain Partner Program.
“The importance of Open Source Software shall not be underestimated,” says Stefan Haßdenteufel, Partner at Witzel Erb Backu & Partner. “The idea of permitting others to use your software free of charge combined with the availability of the source code boosted the entire software industry years ago. Nowadays, it is all about the little IoT devices and the IT services that emerge – all driven by Open Source Software components. While software is still becoming more important for our economy and our everyday life, the need for Open Source Software continues to grow.”
“There is tremendous value in having the option of outside counsel for addressing supply chain questions,” says Shane Coughlan, OpenChain General Manager. “We are delighted to announce the strengthening of official OpenChain Partner coverage in Germany in this respect, and we expect to work closely with Witzel Erb Backu & Partner as the OpenChain standards for license compliance and security assurance extend more deeply into procurement in Europe and beyond.”
About Witzel Erb Backu & Partner
Witzel Erb Backu & Partner, founded by eleven partners and twelve associates in 2020, has its roots in the law firm SSW Schneider Schiffer Weihermüller, a well-established law firm founded in Munich in 1998. Many years of experience, our depth of knowledge and our genuine enthusiasm are what we stand for. Law is our passion. Our team of currently more than 25 lawyers combines the highest standards with the utmost professional expertise, focusing on four key areas: family law, commercial law, IT law as well as tax criminal and business criminal law. Especially with IT law, our focus lies on issues of technological change, innovation and digitalization in all areas of life.
© 2024 OpenChain. All rights reserved. The Linux Foundation has registered trademarks and uses trademarks. For a list of trademarks of The Linux Foundation, please see our Trademark Usage page. Linux is a registered trademark of Linus Torvalds. Privacy Policy and Terms of Use
