Skip to main content
THE LINUX FOUNDATION PROJECTS
search
Category

legal

Nov 07

Webinar: Containers and Compliance

By legal, licensing, News, security, Webinar

This was an exceptionally popular (over 50 attendees). Unfortunately, we had a recording mishap and are unable to bring you the full panel discussion. However, we are providing a summary below alongside the slides used.

Quick Recap

Our Panelists:

  • Chair: Chris Wood
  • Caren Kresse
  • Heather Meeker
  • Mary Hardy
  • Till Jaeger

The meeting focused on discussing open-source containers, package managers, and compliance challenges, with panelists exploring issues around transparency, licensing information, and source code access. The group examined limitations in package manager information and binary scanning capabilities, discussing how incomplete or incorrect licensing data can hinder true compliance. The panel emphasized the importance of proper license declarations and developer awareness, while exploring potential solutions for addressing licensing issues in containerized environments and discussing the need for improved compliance automation tools.

Summary

Source Container Compliance Challenges:

The meeting focused on open-source containers, package managers, and compliance, with Chris chairing the discussion and introducing panelists including Karen from OSADL, Till, and others. Chris raised concerns about the transparency of package managers, noting that some widely used products lack sufficient licensing information and do not provide SBOMs or source code access, which may hinder true license compliance. The panelists were asked to share their thoughts on these issues.

Improving Open Source Compliance Tracking:

The panel discussed the limitations of package manager information for source compliance, with Caren, Heather, and Mary agreeing that package managers often provide incomplete, outdated, or incorrect licensing information. They emphasized the need to improve provenance tracking and source code analysis rather than relying solely on meta-information. Till explained that package managers can only use the information provided by open source projects, which is often insufficient. Mary noted a public database, ClearlyDefined, contains metadata for open source packages, including licenses discovered during scanning. It can be used as a reference during container content analysis. There is still some human curation for packages that have missing top-level license information, but at least it only needs to be completed once. The group also addressed the limitations of license scanners, noting that many only analyze the top-level license of binaries, which may not reflect the true complexity of the software’s licensing structure.

Binary Scanner Limitations and Potential:

The group discussed the limitations and potential of binary scanners in identifying licensing information. Caren emphasized the need for binary scanners to trace the origin and build information of binaries to extract licensing details, while Heather highlighted the evolution of scanning tools from line-by-line source code analysis to higher-level scans, noting a potential resurgence in detailed scanning due to AI coding tools. Mary mentioned ongoing experiments using AI to improve the detection of binary origins, and Till explained the convenience of binary scanning for large dependency trees but stressed the need for source code for comprehensive compliance. Florian raised concerns about relying solely on third-party binary scanning for compliance, and Stefan questioned the discrepancies in license declarations between Maven and GitHub, which Caren and Till acknowledged as a challenge due to incomplete or outdated meta-information.

Software Licensing Awareness and Management:

The panel discussed the importance of proper license declarations in software development, emphasizing the need for awareness training among developers to ensure accurate declarations. They highlighted the role of configuration management in preventing issues related to incorrect licensing, with Marcel explaining that the default Apache license in Maven requires explicit changes for different licensing. The group also addressed the limitations of binary scanning in identifying license information, with Till suggesting a theoretical approach using a database to link source code and binary information. Chris raised a question about remediation options for non-compatible licenses in containerized environments, which the panel acknowledged as an open issue.

Container Licensing Compliance Challenges:

The panel discussed challenges in container and package manager compliance, focusing on how to address licensing issues when using non-modified binary formats. Heather noted that license disclosures for pre-built containers have improved over time, and suggested working with upstream sources for remediation, while Caren emphasized engaging with source projects to resolve licensing problems. The group agreed that developer awareness of licensing requirements is crucial, particularly for containers, and Till highlighted the importance of using compliant and trusted base images. The panel expressed hope for improved tools to automate compliance processes in the future.

Read the Slides:

More About Our Webinars:

This event is part of the overarching OpenChain Project Webinar Series. Our series highlights knowledge from throughout the global OpenChain eco-system. Participants are discussing approaches, processes and activities from their experience, providing a free service to increase shared knowledge in the supply chain. Our goal, as always, is to increase trust and therefore efficiency. No registration or costs involved. This is user companies producing great informative content for their peers.

Check Out The Rest Of Our Webinars

This OpenChain Webinar was broadcast on 2025-10-29.

Sep 16

Webinar: Introduction to the Cyber Resilience Act (CRA)

By community, legal, licensing, News, standards, Webinar

About This Webinar:

The European Union (EU) Cyber Resilience Act (CRA) is a new law that covers almost all “products with digital elements”, including software, released in the EU. Enforcement will begin in 2026, even on organizations who aren’t based in the EU. This presentation explains the scope and requirements of the CRA. This webinar was lead by David A. Wheeler, Director of Open Source Supply Chain Security at the Linux Foundation.

Check out our online training course diving deeper into this topic:
https://training.linuxfoundation.org/express-learning/understanding-the-eu-cyber-resilience-act-cra-lfel1001/

Watch the Webinar:

Review the Slides:

More About Our Webinars:

This event is part of the overarching OpenChain Project Webinar Series. Our series highlights knowledge from throughout the global OpenChain eco-system. Participants are discussing approaches, processes and activities from their experience, providing a free service to increase shared knowledge in the supply chain. Our goal, as always, is to increase trust and therefore efficiency. No registration or costs involved. This is user companies producing great informative content for their peers.

Check Out The Rest Of Our Webinars

This OpenChain Webinar was broadcast on 2025-09-12.

Sep 12

Webinar: Compliant containers with the OSADL Base Image

By legal, licensing, News, Webinar

About This Webinar:

While containers certainly simplify deploying software, fulfilling FOSS license obligations for containers is made difficult by their layered structure and the lack of compliance material in public repositories. Although every container is customized for its particular use and therefore comprises different software components, many are built on a base image that provides essential system components. It seems obvious to apply the Open Source principle of sharing development of non-differentiating technologies and services to license obligations of container base images. Therefore, OSADL offers the OSADL Base Images that are provided together with all required legal information and material needed to be distributed compliantly. A company may build their individual container images on top of the OSADL Docker Base Image and use the provided instructions to fulfill license obligations for the additional software to achieve license compliant container distribution. This presentation explained how the base images and in particular the license compliance material are created, list what flavors, versions and variants are available and show how they can be used to facilitate licensing of individual containers.

Project page: https://www.osadl.org/base-image

Docker Hub: https://hub.docker.com/r/osadl/

Watch the Webinar:

More About Our Webinars:

This event is part of the overarching OpenChain Project Webinar Series. Our series highlights knowledge from throughout the global OpenChain eco-system. Participants are discussing approaches, processes and activities from their experience, providing a free service to increase shared knowledge in the supply chain. Our goal, as always, is to increase trust and therefore efficiency. No registration or costs involved. This is user companies producing great informative content for their peers.

Check Out The Rest Of Our Webinars

This OpenChain Webinar was broadcast on 2025-09-12.

Jul 31

Webinar: Unlocking Potential – Case Study on ZF’s ISO/IEC 5230 Third-Party Certification with TIMETOACT

By community, legal, licensing, News, standards, Webinar

The OpenChain Project held a webinar on the 29th of July 2025 to provide a case study on how ZF – one of the world’s largest automotive suppliers – collaborated with TIMETOACT to obtain third-party certification for OpenChain ISO/IEC 5230.

Abstract:

This case study is suitable for organizations new to the OpenChain standards, organizations in the process of adopting the standards, or organizations reviewing how others met this milestone in open source process management. It will be structured as a series of short section presentations that provide:

  • A brief introduction to ISO/IEC 5230
  • The importance of ISO/IEC in the automotive industry
  • ZF’s certification journey
  • Forming an OSPO
  • Steps taken to accomplish ISO/IEC 5230 certification
  • Challenges faced
  • Role of TIMETOACT in the certification process
  • Gap analysis with TIMETOACT and ZF
  • How ZF used OpenChain and InnerSource Commons resources
  • Lessons learned
  • Closing thoughts

More About Our Webinars:

This event is part of the overarching OpenChain Project Webinar Series. Our series highlights knowledge from throughout the global OpenChain eco-system. Participants are discussing approaches, processes and activities from their experience, providing a free service to increase shared knowledge in the supply chain. Our goal, as always, is to increase trust and therefore efficiency. No registration or costs involved. This is user companies producing great informative content for their peers.

Check Out The Rest Of Our Webinars

This OpenChain Webinar was broadcast on 2025-07-29.

Jul 07

Webinar – How we are doing compliance at CARIAD with ORT

By automation, legal, licensing, News, security, Webinar

This webinar covered how the team in VW Group are doing compliance at CARIAD with ORT. Helio Chissini de Castro lead the discussion, and we had some interesting Q&A.

This is an outcome webinar from the OpenChain and Friends event in Stuttgart, Germany during April 2025. This event saw speakers from Germany and beyond come together to share best practices around open source process management, compliance and automation.

Watch the Webinar:

More About Our Webinars:

This event is part of the overarching OpenChain Project Webinar Series. Our series highlights knowledge from throughout the global OpenChain eco-system. Participants are discussing approaches, processes and activities from their experience, providing a free service to increase shared knowledge in the supply chain. Our goal, as always, is to increase trust and therefore efficiency. No registration or costs involved. This is user companies producing great informative content for their peers.

Check Out The Rest Of Our Webinars

This OpenChain Webinar was broadcast on 2025-07-03.

Jul 02

Webinar – Project OCCTET.eu – The Why, What and How

By automation, community, legal, licensing, News, security, Webinar

This webinar covered an interesting new EU-funded project that brings together various open source tooling for open source security and compliance like Open Source Review Toolkit (ORT) and AboutCode, and other experts in the domain of open source compliance, security and automation. It featured Andreas Kotulla (Bitsea) and Martin von Willebrand (DoubleOpen), and had lively interaction from our audience.

This is an outcome webinar from the OpenChain and Friends event in Stuttgart, Germany during April 2025. This event saw speakers from Germany and beyond come together to share best practices around open source process management, compliance and automation.

Watch the Webinar:

More About Our Webinars:

This event is part of the overarching OpenChain Project Webinar Series. Our series highlights knowledge from throughout the global OpenChain eco-system. Participants are discussing approaches, processes and activities from their experience, providing a free service to increase shared knowledge in the supply chain. Our goal, as always, is to increase trust and therefore efficiency. No registration or costs involved. This is user companies producing great informative content for their peers.

Check Out The Rest Of Our Webinars

This OpenChain Webinar was broadcast on 2025-07-01.

Jun 05

Webinar – How big is the risk of using LLM-generated code from the open source license compliance point of view?

By ai, legal, licensing, News, Webinar
Oscar Goñi (Quique) discussed research around LLM generated code and the potential for risks associated with open source license compliance. This event looked at source code similarity detection via open source tooling.

Watch the Webinar:

Abstract:

Oscar Goñi (Quique) has investigated source code similarity detection in Large Language Model (LLM) out-puts using the SCANOSS platform. While recent research has identified concerns regarding LLMs generating code that closely resembles their training data, the full extent of this similarity across the broader open-source ecosystem remained unexplored. Quique will describe during this talk his findings, which indicate that code similarity in LLM outputs may be more prevalent than previously indicated when evaluated against a broader open-source code base. At the same time, Quique will describe how this study contributes to the ongoing discussion of LLM-generated code’s originality and its implications for software licensing compliance, while validating the effectiveness of lightweight similarity detection algorithms as preliminary indicators for more comprehensive analysis. Finally, a Q&A session hopefully will provide participants some light of the implications of the study and to Quique about next steps in his research. Link to the study: https://1598a6a9-df1a-48d5-891f-3e90e39b960e.usrfiles.com/ugd/1598a6_a32407fa87264fadb3646274c31f3fd8.pdf

Our Speaker:

Oscar Enrique (Quique) Goñi, UNICEN, Professor – STF Head of academic program Oscar Enrique Goñi is a systems engineer who graduated from the National University of the Center of the Province of Buenos Aires, Faculty of Exact Sciences (Argentina, 2009), and holds a Ph.D. in Computer Science from the National University of La Plata (Argentina, 2015). Since 2004, he has been engaged in teaching and research activities at the National University of the Center of the Province of Buenos Aires. Additionally, he has led the design and management of critical systems projects, as well as in data mining and high-performance systems.

More About Our Webinars:

This event is part of the overarching OpenChain Project Webinar Series. Our series highlights knowledge from throughout the global OpenChain eco-system. Participants are discussing approaches, processes and activities from their experience, providing a free service to increase shared knowledge in the supply chain. Our goal, as always, is to increase trust and therefore efficiency. No registration or costs involved. This is user companies producing great informative content for their peers.

Check Out The Rest Of Our Webinars

This OpenChain Webinar was broadcast on 2025-05-30.
Dec 12

Webinar: CHAOSS Practitioner Guides for Healthy & Sustainable OSS Projects

By automation, community, legal, licensing, News, security, Webinar

We had an insightful session with Dawn Foster on sustaining OSS projects and communities over the long-term. The CHAOSS project has been creating a series of MIT-licensed Practitioner Guides focused on improving the sustainability of our software and communities. The guides are designed to make it easier for people to draw meaningful and actionable insights using community metrics, even when those people do not necessarily have a deep background in data analysis or much experience working within OSS communities.

This talk identified several categories of metrics from the Practitioner Guide Series, including responsiveness, contributor sustainability, organizational participation, and security. It covered not just how to interpret the metrics, but also on providing ideas for improving in areas identified using the metrics. The audience walks away with a better understanding of how to use metrics to proactively improve the long-term sustainability of their OSS projects and communities.

Watch The Recording

About Our Speaker

Dawn leads the data science initiative for the CHAOSS project where she is also a Governing Board member / maintainer. Dawn is an OpenUK board member and co-chair of the CNCF Contributor Strategy Technical Advisory Group.

Dawn has 20+ years of experience working in open source positions at companies like VMware, Intel and Puppet with expertise in managing people, open source strategy, building new communities, and managing existing communities with a particular emphasis on developer and open source communities. She has held a wide range of roles over the years, including UNIX system administrator, researcher, consultant, strategist, director / manager, and more.

Dawn holds a PhD from the University of Greenwich, an MBA from Ashland University, and a BS in Computer Science from Kent State University. Dawn blogs about online communities as the author of the Fast Wonder Blog, and she’s blogged for The New Stack, Linux.com, GigaOM’s WebWorkerDaily, and in various other places.

She has done over a hundred talks at industry events, including many Linux Foundation events, KubeCon, OSCON, SXSW, FOSDEM and more. In her spare time she enjoys reading science fiction, running, and traveling.

More About Our Webinars:

This event is part of the overarching OpenChain Project Webinar Series. Our series highlights knowledge from throughout the global OpenChain eco-system. Participants are discussing approaches, processes and activities from their experience, providing a free service to increase shared knowledge in the supply chain. Our goal, as always, is to increase trust and therefore efficiency. No registration or costs involved. This is user companies producing great informative content for their peers.

Check Out The Rest Of Our Webinars

This OpenChain Webinar was broadcast on 2024-12-05.

Dec 04

Webinar: Enabling SBOMs Across The Linux Foundation

By automation, legal, licensing, News, standards, Webinar

We have been doing source level license scans for Linux Foundation (LF) projects for a long time including generating SPDX formatted files, but what about SBOMs that can meet (and exceed) the government minimum specification? Here at the LF, we are now leveraging our existing scanning capabilities to generate SBOMs for these same critical open source projects.

In the LF spirit, we are using existing open source tools to scan project dependencies to produce an SBOM that meets the minimum spec. We are also producing dependency level license data to complement our source level scans. In the near future we will be combining these to produce a grand unified SBOM that will meet a newly defined LF minimum specification for SBOMs.

We will talk about our process to generate these SBOMs, the challenges we faced, our future plans, and share more about how you can make use of these for the projects you care about most.

Watch The Recording

About Our Speakers

Gary O’Neall

Gary is a contributor to the Software Package Data Exchange® (SPDX™) – an open standard for communicating software bill of material information, including components, licenses, copyrights, and security references. Gary has contributed several open source tools. Gary O’Neall is responsible for product development and technology for Source Auditor Inc., a software and service company helping software companies manage the technical and legal risks of open-source software.

Jeff Shapiro

Jeff Shapiro is the Director of License Scanning for The Linux Foundation. He has over 30 years of experience in the software industry, including 10 years in software auditing, open source scanning, and training developers in OSS license compliance.

More About Our Webinars:

This event is part of the overarching OpenChain Project Webinar Series. Our series highlights knowledge from throughout the global OpenChain eco-system. Participants are discussing approaches, processes and activities from their experience, providing a free service to increase shared knowledge in the supply chain. Our goal, as always, is to increase trust and therefore efficiency. No registration or costs involved. This is user companies producing great informative content for their peers.

Check Out The Rest Of Our Webinars

This OpenChain Webinar was broadcast on 2024-12-04.

Oct 29

Webinar: SBOM Visualization – An Alternative Approach to Reviewing SBOMs

By automation, legal, licensing, News, Webinar

When we think about Software Build of Materials, we are looking at what might be a multi-dimensional space consisting of hierarchy, linking, modification, export restrictions, security vulnerabilities, distribution type, versions, etc. Care must be taken when setting up the SBOMs to both list the components used and to show how they are incorporated into your products. This webinar discusses how a visualization of such meta-information was implemented to display the relationships and potential risks in a quick and in easy-to-understand way. It was part of a research project funded by the Federal Ministry for Economic Affairs and Climate Protection (BMWi) and with the Bonn-Rhein-Sieg University of Applied Sciences and Bitsea.

Watch The Recording

About Our Speaker

Dr. Andreas Kotulla is the Founder & CEO of Bitsea GmbH. He is specialized in auditing software systems and identifying hidden risks for companies. We support the technical due diligence and advise operators of critical infrastructure (KRITIS). He advises customers on Open-Source-Strategy, Open-Source-Governance, Open-Source-Processes, toolchains and offers an Open-Source-Program-Office (OSPO) and scanning as a managed service.

More About Our Webinars:

This event is part of the overarching OpenChain Project Webinar Series. Our series highlights knowledge from throughout the global OpenChain eco-system. Participants are discussing approaches, processes and activities from their experience, providing a free service to increase shared knowledge in the supply chain. Our goal, as always, is to increase trust and therefore efficiency. No registration or costs involved. This is user companies producing great informative content for their peers.

Check Out The Rest Of Our Webinars

This OpenChain Webinar was broadcast on 2024-10-23.