We held our regular Monthly North America and Asia Call this week. The focus was on discussing the Public Comment period for our draft proposed updates to the licensing and security specifications.
We keep all the slides from our monthly calls online and they can be a useful way to access direct links and more details:
OpenChain Project Announces Public Comment Period for Draft Updates to Compliance and Security Specifications
Starting 2024-06-19 ~ Ending 2024-12-19
The OpenChain Project has announced the beginning of its six month Public Comment Period for proposed draft updates to the open source license compliance (ISO/IEC 5230:2020) and open source security assurance (ISO/IEC 18974:2023) specifications.
During the Public Comment Period everyone is invited to review and comment on the specifications. As an open project developing open standards, we host the draft documents on our GitHub repositories.
You can comment on this process by joining our monthly calls or via our Specification Mailing list. You can also leave comments via GitHub issues as detailed below.
IAV GmbH has announced adoption of ISO/IEC 5230:2020 via third-party certification provided by TimeToAct. Adjacent to this, IAV and TimeToAct has collaborated with the OpenChain Project on a webinar and case study about the certification rationale and process. This webinar digs into details on how, why and when decisions were made in the IAV adoption and use of ISO/IEC 5230.
Get the Slides
More About Our Webinars:
This event is part of the overarching OpenChain Project Webinar Series. Our series highlights knowledge from throughout the global OpenChain eco-system. Participants are discussing approaches, processes and activities from their experience, providing a free service to increase shared knowledge in the supply chain. Our goal, as always, is to increase trust and therefore efficiency. No registration or costs involved. This is user companies producing great informative content for their peers.
2024-07-30 at 09:00 CEST / 15:00 CST / 16:00 KST + JST
The OpenChain Governing Board recently approved the creation of a new study group to discuss SBOM use in the supply chain. With a focus on “how to use,” this study group will consider practical ways to increase trust in the supply chain and satisfy regulatory requirements. It builds on previous work by the OpenChain Project around lightweight SBOM profiles (SPDX Lite), defining quality SBOM (Telco SBOM Guide) and local work group activities.
Join here up to ten minutes before we start, no registration required:
Introduce the practical considerations of using SBOMs in supply chains
Discuss who these considerations apply to
Talk about existing market solutions: Case Study SPDX Lite
Have an open discussion on next steps
Everyone with an interest in SBOMs, the use of SBOMs in the supply chain, and in increasing trust in the supply chain is invited. Kobota San from Sony is the chair of this study group in 2024. Kobota San, thank you for stepping forward to start this activity!
One of the most innovative people in the OpenChain community has to be Martin Yagi of the UK Work Group. He kicked off an initiative to create and publish tons of bite-sized videos around OpenChain training courses and more. Not satisfied with that, he has also created a beta video for some work underway in the Education Work Group around “explainers” for different departments in companies.
Let’s explore how we can explain OpenChain to Sales and Marketing departments (beta, because the explainer is still in draft development).
Want to be part of helping with the development of the explainer series?
Be part of this:
You can get involved with the Education Work Group through their dedicated mailing list. At this link, you will also find connections to other study and working groups around the world:
The OpenChain AI Study Group held its regular Asia sync on the 11th of July. This focused on a recap of the earlier monthly workshop, including an overview of outcomes from the recent OpenChain Governing Board meeting regarding the AI Study Group, flagging a presentation by Laurie Grant @ Qualcomm on ISO/IEC 42001, and other discussion around shared concerns regarding AI compliance in the supply chain.
Be part of this:
You can get involved with this study or work group through their dedicated mailing list. At this link, you will also find connections to other study and working groups around the world:
On the 3rd of July we held our regular meeting of the OpenChain Education Work Group. As part of the outreach activities of the OpenChain Project, it focuses on help to make it easier to understand and adopt OpenChain ISO/IEC 5230:2020 for license compliance and OpenChain ISO/IEC 18974:2023 for security assurance. Discussion ranges from handouts to education leaflets to training slides to case studies and guides. Editing is normally done on GitHub. All are welcome.
Exciting stuff this time:
Explainers for different parts of companies
Maturity modeling
More about upcoming PDF versions of documents
And a discussion about our update training slides
Be part of this:
You can get involved with the OpenChain Education Work Group through their dedicated mailing list. At this link, you will also find connections to other working groups around the world:
As usual, this was a very practical meeting, and it covered topics like TR-03183 – Cyber Resilience Requirements for Manufacturers and Products. Full recording below.
Be part of this:
You can get involved with the OpenChain Telco Work Group through their dedicated mailing list. At this link, you will also find connections to other working groups around the world:
Please note: you do not have to be an expert in telecommunications or work for a telecommunications company to join the group. Work on subjects like the Telco SBOM Quality Guide is intended to also help other market sectors.
An oldie but a goodie. If you want to see what a longer community event is like, check out the OpenChain Japan All Member Meeting #30 from February.
Owada San, our ever-dedicated community contributor, is currently preparing the 31st meeting for release, so watch this space!
You can get involved with the OpenChain Japan Work Group through their dedicated mailing list. At this link, you will also find connections to other working groups around the world:
Gu Ya Nan from SAIC Z-ONE Technology Co., Ltd will briefly discuss OpenChain ISO standards as part of her larger presentation on Friday 19th of July at the Automotive Software and Security Technology Week in Shanghai, China. Her contribution to spreading the word about our work to make a more trusted open source supply chain is appreciated!
IAV GmbH has announced adoption of ISO/IEC 5230:2020 via third-party certification provided by TimeToAct. Adjacent to this, IAV and TimeToAct are collaborating with the OpenChain Project on a webinar and case study about the certification rationale and process.
“The exceptional progress of OpenChain ISO/IEC 5230 in improving trust in the open source supply chain has been felt in many industries,” says Shane Coughlan, OpenChain Project General Manager. “However, automotive is perhaps where we have had the largest and broadest impact. In a sector with a high degree of regulation, our ISO standard for open source license compliance offers a clear, effective and efficient method of containing risk. We are delighted to welcome IAV GmbH to our community of conformance, and to have had the opportunity to collaborate with our official partner TimeToAct on sharing this news with others. Our forthcoming webinar and case study adjacent to the certification provides a useful tool for other companies seeking to align behind international standards for open source business process management.”
The case study will be released and the webinar will take place at 10:00 CEST on the 16th of July. Learn more about this from the OpenChain Global Calendar on our participation page.
There is no need to register for this webinar. Simply follow the Zoom link in the OpenChain Global Calendar.
About IAV GmbH
IAV Automotive Engineering is a developer of computer app systems for the automotive industry. The company offers services in the areas of light vehicles, such as chassis, cockpit, combustion engine, E-Traction, exterior, gaseous-fuel vehicle, hybrid, interior, mobility, powertrain concept and integration, powertrain electronic, product life cycle,transmission, vehicle electronic, vehicle function, and vehicle safety services; commercial vehicles and work machines, including cabin, CO2 efficiency, driver assistance, functional architecture, powertrain, transportation and logistics, and work and agricultural machines; energy supply aspects; and methods and test facilities.
About TimeToAct
TIMETOACT GROUP modernises and integrates IT applications for upper midmarket companies, fortune 500 enterprises and the public sector, with the goal of increasing their agility, efficiency, and transparency and to reduce costs and risks. In addition, TIMETOACT GROUP designs and implements digital business models, opening up new market opportunities for its innovative customers. Its services include consulting and cloud transformation as well as data, software and system engineering in the fields of employee experience, business applications, and customer experience.
About the OpenChain Project
The OpenChain Project has an extensive global community of over 1,000 companies collaborating to make the supply chain quicker, more effective and more efficient. It maintains OpenChain ISO/IEC 5230, the international standard for open source license compliance programs and OpenChain ISO/IEC 18974, the industry standard for open source security assurance programs
About The Linux Foundation
The Linux Foundation is the world’s leading home for collaboration on open source software, hardware, standards, and data. Linux Foundation projects are critical to the world’s infrastructure, including Linux, Kubernetes, Node.js, ONAP, PyTorch, RISC-V, SPDX, OpenChain, and more. The Linux Foundation focuses on leveraging best practices and addressing the needs of contributors, users, and solution providers to create sustainable models for open collaboration. For more information, please visit us at linuxfoundation.org.
