As AI continues to transform industries, companies are increasingly building their AI systems using open-source AI models. However, with this rapid expansion comes complex challenges—particularly in understanding the legal risks and compliance implications of using specific open-source models. Critical factors like model lineage and training data are often hard to track, and the legal risks tied to these elements are only growing, especially with regulations like the upcoming EU AI Act.

To help you navigate these complexities, we’re excited to announce an upcoming webinar featuring Nick Schifano, CEO and founder of FastCatalog.ai. Nick’s deep expertise lies at the intersection of AI innovation and legal frameworks. With years of experience in IP law, standards, and AI/ML legal frameworks, Nick will guide us through key considerations for managing the AI supply chain—focusing on how companies can prepare for and comply with new regulatory requirements.

Webinar Highlights:

• Insights into the hidden risks behind model lineage and training data in open-source AI models
• Scenarios where data transparency becomes crucial for AI systems
• Operational strategies to better manage AI and data supply chains
• Preparing for the upcoming EU AI Act and its implications for companies

Join Us:

Don’t miss this opportunity to get ahead of the curve on AI supply chain management and legal compliance.

• Date & Time: October 9th, 17:00 PDT / October 10th, 00:00 UTC / October 10th, 09:00 JST

Let’s come together to learn and grow as a community!

• You can find dial-in details on the OpenChain Global Calendar or join directly using this link:
  https://zoom-lfx.platform.linuxfoundation.org/meeting/93393390377?password=9fddedb2-67a3-42e6-8796-6e9d8ebb67fe

About the Speaker:

Nick Schifano is a leading expert in AI and legal frameworks. Before founding FastCatalog.ai, a company dedicated to revolutionizing AI supply chain management, Nick served as Assistant General Counsel at Microsoft, where he led groundbreaking initiatives in open innovation and AI/ML legal practices. With a technical foundation in software engineering and IT consulting, Nick brings a holistic view of both the technical and legal aspects of AI development.

More About Our Webinars:

This event is part of the overarching OpenChain Project Webinar Series. Our series highlights knowledge from throughout the global OpenChain eco-system. Participants are discussing approaches, processes and activities from their experience, providing a free service to increase shared knowledge in the supply chain. Our goal, as always, is to increase trust and therefore efficiency. No registration or costs involved. This is user companies producing great informative content for their peers.

Check Out The Rest Of Our Webinars

https://www.openchainproject.org/webinars

During the Operations Management Summit at Open Source Summit Europe in Vienna, Kobota San (Sony) and Ninjouji San (Toshiba) from the OpenChain Project gave a deep-dive into some of the original and current market realities behind the creation and use of the SPDX Lite SBOM format.

Their slides contain a wealth of information that is useful for anyone working in this field.

Review The Slides:

More About The Speakers:

The OpenChain Project will be featured at the OSCAR event in Beijing, China on the 16th of October. OpenChain will be represented by Zhenhua Sun of ByteDance, the current Chair of the OpenChain China Work Group.

Agenda

Learn More (Chinese):

• https://mp.weixin.qq.com/s/bYXpKWWEarLIPbcbVN8U-A

Full Event Graphic (Chinese):

The OpenChain AI Study Group held its regular workshop on the 1st of October. Karen Bennet from SPDX provided a briefing on AI BOM. Work also progressed on the draft scratchpad for management of AI BOMs.

Watch the Recording

Track This Work

You can follow and contribute to the work of the OpenChain AI Study Group through its dedicated mailing list. This is open to everyone regardless of industry vertical or speciality. You will find it here:

• https://lists.openchainproject.org/g/ai

Attend Future Meetings

You can find and get the dial-in details for all future AI Study Group meetings from our participate page here:

• https://www.openchainproject.org/participate

We held our regular Monthly North America and Europe Call on the 1st of October. The focus was on discussing the Public Comment period for our draft proposed updates to the licensing and security specifications, and on the outcomes of the recent Steering Committee meeting.

Check Out The Recording

Link to the Steering Committee Meeting Recording:

We keep all the slides from our monthly calls online and they can be a useful way to access direct links and more details:

• https://github.com/OpenChain-Project/Meeting-Minutes/tree/main/Slides

Join Our Work

Everyone is welcome to be part of the Specification Work Group. You can join their mailing list here:
https://lists.openchainproject.org/g/specification/

You can find and be part of all OpenChain calls through our participation page here:
https://openchainproject.org/participate

This webinar will cover the topic of SBOM visualization to provide an alternative approach to review code.

Abstract

In order to comply with the use of open source, when setting up the SBOM, care must be taken not only to list the components, but also to show how they are incorporated into your products (this is a multidimensional space consisting of hierarchy, linking, modification, export restrictions, security vulnerabilities, distribution type, versions, etc.), and how properties may propagate through the dependency tree. Keeping track of these complex relationships based on a text file or tables is extremely difficult.

As part of a research project funded by the Federal Ministry for Economic Affairs and Climate Protection (BMWi) and with the Bonn-Rhein-Sieg University of Applied Sciences and Bitsea, a visualization of the meta information was implemented that displays the relationships and potential risks quickly and in an easy-to-understand way.

Get Dial-In Details Via Our Global Calendar

• https://www.openchainproject.org/participate

About the Speaker

Dr Kotulla is the founder and managing director of Bitsea GmbH and specializes in the technical audits of software systems. Bitsea assesses open source compliance and advises clients comprehensively on open source management, open source strategy, open source governance, open source processes, tool chains and offers an Open Source Program Office (OSPO) and scanning as a managed service.

Dr Kotulla is a computer scientist, has been active in IT for more than three decades, leads workshops and gives lectures on open source, software engineering, software quality and worked for 12 years for international telecommunications providers. He is a member of the Linux Foundation’s OpenChain project, is active in Bitkom e.V.’s Open Source working group and is the author of several books and publications.

Learn More: www.bitsea.de

More About Our Webinars:

This event is part of the overarching OpenChain Project Webinar Series. Our series highlights knowledge from throughout the global OpenChain eco-system. Participants are discussing approaches, processes and activities from their experience, providing a free service to increase shared knowledge in the supply chain. Our goal, as always, is to increase trust and therefore efficiency. No registration or costs involved. This is user companies producing great informative content for their peers.

Check Out The Rest Of Our Webinars

• https://www.openchainproject.org/webinars

We held our regular Monthly North America and Europe Call on the 3rd of September. The focus was on discussing the Public Comment period for our draft proposed updates to the licensing and security specifications.

Check Out The Recording

We keep all the slides from our monthly calls online and they can be a useful way to access direct links and more details:

• https://github.com/OpenChain-Project/Meeting-Minutes/tree/main/Slides

What We Did On This Call:

Update openchain-license-compliance-3.0.md #76

Changed:

 A process shall exist for creating the set of compliance artifacts for the supplied software.

Verification material(s):

• 3.4.1.1 – A documented procedure that describes the process under which the compliance artifacts are prepared and distributed with the supplied software as required by the identified licenses.
• 3.4.1.2 – A documented procedure for archiving copies of the compliance artifacts of the supplied software – where the archive is planned to exist for a reasonable period of time (Determined by domain, legal jurisdiction and/or customer contracts) since the last offer of the supplied software; or as required by the identified licenses (whichever is longer). Records exist that demonstrate the procedure has been properly followed.

To:

A process shall exist for creating the set of compliance artifacts for the supplied software.

Verification material(s):

• 3.4.1.1 – A documented procedure that describes the process under which the compliance artifacts are prepared and distributed with the supplied software as required by the identified licenses.
• 3.4.1.2 – A documented procedure for archiving copies of the compliance artifacts of the supplied software – where the archive is planned to exist for a reasonable period of time (determined by domain, legal jurisdiction and/or customer contracts) since the last offer of the supplied software, or as required by the identified licenses (whichever is longer). Records exist that demonstrate the procedure has been properly followed.

Improved 2.7 #75

Changed:

a “Software Bill of Materials” (SBOM) is a inventory for software, a list of ingredients that make up software components. An example is the (Software Package Data Exchange) SPDX specification created by the Linux Foundation’s SPDX Project to exchange bill of materials for a given software package (see spdx.org). Regardless of the SBOM specification used, it should follow a complete profile for the intended use case.

To:

a “Software Bill of Materials” (SBOM) is an inventory for software, a list of ingredients that make up software components. An example is the Software Package Data Exchange (SPDX) specification created by the Linux Foundation’s SPDX Project to exchange bill of materials for a given software package (see spdx.org). Regardless of the SBOM specification used, it should follow a complete profile for the intended use case.

Update openchain-license-compliance-3.0.md #74

Changed:

a set of open source software licenses identified as a result of following an appropriate method of identifying open source components from which the supplied software is may contain

To:

a set of open source software licenses identified as a result of following an appropriate method of identifying open source components which the supplied software may contain

Terms and definitions sub-headings to same level openchain-license-co… #66

Fixed formatting:

“Under Terms and definitions there were some sub-headings with ## and some with ### so changed them all to be ### level sub-headings.”

Update openchain-security-specification-2.0.md #37

Changed:

3.3.2 – Security Assurance

A process shall exist to detect, identify, and document the existence of Known Vulnerabilities in each Open Source Software component on the Software Bill of Materials (SBOM) for the Supplied Software.

To:

3.3.2 – Security Assurance

A process shall exist to detect, identify, and document the existence of Known Vulnerabilities in each Open Source Software component in the Software Bill of Materials (SBOM) for the Supplied Software.

Overview of the Public Comment Period

OpenChain Project Announces Public Comment Period for Draft Updates to Compliance and Security Specifications

Starting 2024-06-19 ~ Ending 2024-12-19

The OpenChain Project has announced the beginning of its six month Public Comment Period for proposed draft updates to the open source license compliance (ISO/IEC 5230:2020) and open source security assurance (ISO/IEC 18974:2023) specifications.

As per our specification development process outlined in the project FAQ, this Public Comment Period will run for six months, and it will be followed by a three month Freeze Period.

During the Public Comment Period everyone is invited to review and comment on the specifications. As an open project developing open standards, we host the draft documents on our GitHub repositories.

Learn More:

• https://openchainproject.org/featured/2024/06/19/public-comment-period-2024

You can comment on this process by joining our monthly calls or via our Specification Mailing list. You can also leave comments via GitHub issues as detailed below.

• Visit Our Participation Page

Overview in Text Format:

朝晩涼しくなってきましたね。先週はめちゃ寒いところにいたので、体がついてきてくれません。
皆さまも期末でお忙しいでしょうが、ご自愛くださいね。

さて、ご連絡しておりますとおり10月17日＆18日に【OpenChain Japan Community Day Vol.32】を開催します。

本日より参加申込フォームを公開しておりますので、現地参加の方はご登録をお願いいたします。(参加費無料)
↓参加登録フォームはこちら↓
https://cvent.me/Am1Z10

今回も充実の内容でお送りします。アジェンダは以下のとおり。(詳細は添付のリーフレットをご覧ください)
　★ダイキンさんの取組み紹介
　★ホンダさんのOpenChain認証取得の事例紹介
　・SBOM最新動向の共有＆有識者によるパネルディスカッション
　・OSPO Japan Local Meetup（TODOグループのAnaさんが来日参加）
　・OpenChain Japan FAQ SWG体験会＆ワークday

どなたでも自由にご参加いただけますので、周囲の方やお友達にもお声がけの上、是非現地でご参加ください。
Day1のみ、Day2のみのご参加でも大丈夫です。
(オンライン配信は一部だけです。重要な情報を逃がさないよう、是非現地でのご参加をご検討ください。)

どうでもいいんですけど今日わたし誕生日なんですよね。普通に仕事してるんですけど。社会人って悲しい。

Get Help / Find Out More On The Mailing List:

• https://lists.openchainproject.org/g/japan-wg

As part of their engagement with the OpenChain Project, the Nokia Open Source team have contributed the ‘openchain-telco-sbom-validator’, a script to validate SBOMs against the OpenChain Telco SBOM Guide.

Now the validator is available in Pipy: https://pypi.org/project/openchain-telco-sbom-validator/ and can be installed with `pip install openchain-telco-sbom-validator`

This reference tool is available to everyone under the Apache 2.0 license.

Credits

Marc-Etienne Vargenau of Nokia, chair of the OpenChain Telco Work Group, Gergely Csatari and their colleagues have been instrumental in helping to ensure the determination of SBOM quality is easier, faster and more effective.

Check out the Telco SBOM Guide (Written Document):

• https://openchainproject.org/news/2024/07/30/openchain-telco-sbom-guide-general-availability

Access the Validator Code:

• https://github.com/OpenChain-Project/Telco-WG/tree/main/tools/openchain_telco_sbom_validator

Usage

usage: python3 openchain-telco-sbom-validator.py [options] input

positional arguments:
  input                 The input SPDX file.

options:
  -h, --help            Shows this help message and exits.
  --debug               Prints debug logs.
  --nr-of-errors NR_OF_ERRORS
                        Sets a limit on the number of errors displayed.
  --strict-purl-check   Runs a strict check on the given purls. The default behaviour is to run a non strict purl check what means that it is not checked if the purl is translating to a downloadable URL.
  --strict-url-check    Runs a strict check on the URLs of the PackageHomepages. Strict check means that the validator checks also if the given URL can be accessed. The default behaviour is to run a non strict URL check what means that it is not checked if the URL points to a valid page. Strict URL check requires access to the internet and takes some time.')

Installation of prerequisites

This script is written in python and uses a requirements.txt to list its dependencies. To install python on an Ubuntu environment run sudo apt install python3-pip.

It is usually a good practice to install Python dependencies to a Python virtual environment. To be able to manage virtual environments you need to install venv with sudo apt install python3-venv.

If you do not have a virtual environment yet cretate it with python3 -m venv .env and install the dependencies with pip3 install -r requirements.txt, if you already have a virtual environment start it with . .env/bin/activate.

License

This software is Copyright Nokia and is licensed under the Apache 2.0 license.

Issues and contributions

In case of any issues please create a GitHub issue, while also any contributions are warmly welcome in the form of GitHub merge requests.