Skip to main content
THE LINUX FOUNDATION PROJECTS
search
Category

security

Nov 07

Webinar: Containers and Compliance

By legal, licensing, News, security, Webinar

This was an exceptionally popular (over 50 attendees). Unfortunately, we had a recording mishap and are unable to bring you the full panel discussion. However, we are providing a summary below alongside the slides used.

Quick Recap

The meeting focused on discussing open-source containers, package managers, and compliance challenges, with panelists exploring issues around transparency, licensing information, and source code access. The group examined limitations in package manager information and binary scanning capabilities, discussing how incomplete or incorrect licensing data can hinder true compliance. The panel emphasized the importance of proper license declarations and developer awareness, while exploring potential solutions for addressing licensing issues in containerized environments and discussing the need for improved compliance automation tools.

Summary

Source Container Compliance Challenges:

The meeting focused on open-source containers, package managers, and compliance, with Chris chairing the discussion and introducing panelists including Karen from OSADL, Till, and others. Chris raised concerns about the transparency of package managers, noting that some widely used products lack sufficient licensing information and do not provide SBOMs or source code access, which may hinder true license compliance. The panelists were asked to share their thoughts on these issues.

Improving Open Source Compliance Tracking:

The panel discussed the limitations of package manager information for source compliance, with Caren, Heather, and Mary agreeing that package managers often provide incomplete, outdated, or incorrect licensing information. They emphasized the need to improve provenance tracking and source code analysis rather than relying solely on meta-information. Till explained that package managers can only use the information provided by open source projects, which is often insufficient. Mary noted a public database, ClearlyDefined, contains metadata for open source packages, including licenses discovered during scanning. It can be used as a reference during container content analysis. There is still some human curation for packages that have missing top-level license information, but at least it only needs to be completed once. The group also addressed the limitations of license scanners, noting that many only analyze the top-level license of binaries, which may not reflect the true complexity of the software’s licensing structure.

Binary Scanner Limitations and Potential:

The group discussed the limitations and potential of binary scanners in identifying licensing information. Caren emphasized the need for binary scanners to trace the origin and build information of binaries to extract licensing details, while Heather highlighted the evolution of scanning tools from line-by-line source code analysis to higher-level scans, noting a potential resurgence in detailed scanning due to AI coding tools. Mary mentioned ongoing experiments using AI to improve the detection of binary origins, and Till explained the convenience of binary scanning for large dependency trees but stressed the need for source code for comprehensive compliance. Florian raised concerns about relying solely on third-party binary scanning for compliance, and Stefan questioned the discrepancies in license declarations between Maven and GitHub, which Caren and Till acknowledged as a challenge due to incomplete or outdated meta-information.

Software Licensing Awareness and Management:

The panel discussed the importance of proper license declarations in software development, emphasizing the need for awareness training among developers to ensure accurate declarations. They highlighted the role of configuration management in preventing issues related to incorrect licensing, with Marcel explaining that the default Apache license in Maven requires explicit changes for different licensing. The group also addressed the limitations of binary scanning in identifying license information, with Till suggesting a theoretical approach using a database to link source code and binary information. Chris raised a question about remediation options for non-compatible licenses in containerized environments, which the panel acknowledged as an open issue.

Container Licensing Compliance Challenges:

The panel discussed challenges in container and package manager compliance, focusing on how to address licensing issues when using non-modified binary formats. Heather noted that license disclosures for pre-built containers have improved over time, and suggested working with upstream sources for remediation, while Caren emphasized engaging with source projects to resolve licensing problems. The group agreed that developer awareness of licensing requirements is crucial, particularly for containers, and Till highlighted the importance of using compliant and trusted base images. The panel expressed hope for improved tools to automate compliance processes in the future.

Read the Slides:

More About Our Webinars:

This event is part of the overarching OpenChain Project Webinar Series. Our series highlights knowledge from throughout the global OpenChain eco-system. Participants are discussing approaches, processes and activities from their experience, providing a free service to increase shared knowledge in the supply chain. Our goal, as always, is to increase trust and therefore efficiency. No registration or costs involved. This is user companies producing great informative content for their peers.

Check Out The Rest Of Our Webinars

This OpenChain Webinar was broadcast on 2025-10-29.

Jul 07

Webinar – How we are doing compliance at CARIAD with ORT

By automation, legal, licensing, News, security, Webinar

This webinar covered how the team in VW Group are doing compliance at CARIAD with ORT. Helio Chissini de Castro lead the discussion, and we had some interesting Q&A.

This is an outcome webinar from the OpenChain and Friends event in Stuttgart, Germany during April 2025. This event saw speakers from Germany and beyond come together to share best practices around open source process management, compliance and automation.

Watch the Webinar:

More About Our Webinars:

This event is part of the overarching OpenChain Project Webinar Series. Our series highlights knowledge from throughout the global OpenChain eco-system. Participants are discussing approaches, processes and activities from their experience, providing a free service to increase shared knowledge in the supply chain. Our goal, as always, is to increase trust and therefore efficiency. No registration or costs involved. This is user companies producing great informative content for their peers.

Check Out The Rest Of Our Webinars

This OpenChain Webinar was broadcast on 2025-07-03.

Jul 02

Webinar – Project OCCTET.eu – The Why, What and How

By automation, community, legal, licensing, News, security, Webinar

This webinar covered an interesting new EU-funded project that brings together various open source tooling for open source security and compliance like Open Source Review Toolkit (ORT) and AboutCode, and other experts in the domain of open source compliance, security and automation. It featured Andreas Kotulla (Bitsea) and Martin von Willebrand (DoubleOpen), and had lively interaction from our audience.

This is an outcome webinar from the OpenChain and Friends event in Stuttgart, Germany during April 2025. This event saw speakers from Germany and beyond come together to share best practices around open source process management, compliance and automation.

Watch the Webinar:

More About Our Webinars:

This event is part of the overarching OpenChain Project Webinar Series. Our series highlights knowledge from throughout the global OpenChain eco-system. Participants are discussing approaches, processes and activities from their experience, providing a free service to increase shared knowledge in the supply chain. Our goal, as always, is to increase trust and therefore efficiency. No registration or costs involved. This is user companies producing great informative content for their peers.

Check Out The Rest Of Our Webinars

This OpenChain Webinar was broadcast on 2025-07-01.

Jun 19

Webinar – AboutCode – Practical Compliance in One Stack – Licensing, Vulnerabilities, and More

By ai, automation, licensing, News, security

Our speaker was a good friend of the OpenChain Project, and the founder of AboutCode, Philippe Ombredanne. Our focus was on recent advances in the open source and open data AboutCode stack for licensing and security compliance.

This is an outcome webinar from the OpenChain and Friends event in Stuttgart, Germany during April 2025. This event saw speakers from Germany and beyond come together to share best practices around open source process management, compliance and automation.

Watch the Webinar:

Review the Slides:

More About Our Webinars:

This event is part of the overarching OpenChain Project Webinar Series. Our series highlights knowledge from throughout the global OpenChain eco-system. Participants are discussing approaches, processes and activities from their experience, providing a free service to increase shared knowledge in the supply chain. Our goal, as always, is to increase trust and therefore efficiency. No registration or costs involved. This is user companies producing great informative content for their peers.

Check Out The Rest Of Our Webinars

This OpenChain Webinar was broadcast on 2025-06-10.

Jan 28

Webinar: Practical Compliance in One Stack – Licensing, Vulnerabilities, and More

By automation, community, licensing, News, security, Webinar

What We Covered:

The Cyber Resiliency Act (CRA) is coming and this European regulation will impact software development worldwide. Organizations (and projects) of all sizes need efficient compliance processes to correctly identify software components and strengthen cybersecurity efforts.

The AboutCode stack of 100% open source tools and open data is engineered to automate compliance, with a practical approach. Tools like ScanCode and DejaCode paired with aggregated open databases like PurlDB and VulnerableCode ensure accurate origin, licensing, vulnerability detection, and comprehensive SBOM management. Newer projects like Massive FOSS Scan, CRAVEX, and AI-Generated Code Search deliver new performance improvements and advanced capabilities to improve the automation of compliance processes.

In this presentation, AboutCode lead maintainer Philippe Ombredanne shared the latest updates on how to use the AboutCode stack for better, faster, and more efficient license and security compliance automation.

More About Our Webinars:

This event is part of the overarching OpenChain Project Webinar Series. Our series highlights knowledge from throughout the global OpenChain eco-system. Participants are discussing approaches, processes and activities from their experience, providing a free service to increase shared knowledge in the supply chain. Our goal, as always, is to increase trust and therefore efficiency. No registration or costs involved. This is user companies producing great informative content for their peers.

Check Out The Rest Of Our Webinars

This OpenChain Webinar was broadcast on 2025-01-20.

Dec 20

Webinar: DeviceCode – A Crowdsourced Device Data Parser

By automation, News, security, Webinar

When walking into a shop, there’s a lot of choice for electronic devices like WiFi routers, IP cameras, and more. Many devices are identical, or nearly so, as they come from the same manufacturer or use the same chip and code from the chipset manufacturer.

CVEs, however, often focus on individual devices rather than classes of similar devices, leaving many vulnerable ones unreported. For example, CVE-2006-2560 and CVE-2006-2561 describe the same vulnerability on devices from different vendors—likely from the same ODM. Many more devices with the same vulnerabilities are overlooked, possibly giving a false sense that only the listed devices are at risk.

Information about device hardware, such as the ODM or chipset used, isn’t easily accessible, as companies rarely disclose this. Fortunately, a wealth of data has been crowd-sourced globally via various wikis. However, this information is hard to reuse outside those specific platforms.

This is where DeviceCode comes in: it unlocks and cleans data from various wikis (as not all users input data correctly or consistently) and integrates it with other sources. This makes it possible to query by chipset, manufacturer, ODM, and even installed software. It helps answer questions like, “Which other devices are similar to a known vulnerable device?” enabling security researchers to identify additional vulnerable devices.

Watch The Webinar

About Our Speaker

Armijn Hemel, MSc, is the owner of Tjaldur Software Governance Solutions, a consultancy specializing in open-source license compliance engineering and provenance research.

More About Our Webinars:

This event is part of the overarching OpenChain Project Webinar Series. Our series highlights knowledge from throughout the global OpenChain eco-system. Participants are discussing approaches, processes and activities from their experience, providing a free service to increase shared knowledge in the supply chain. Our goal, as always, is to increase trust and therefore efficiency. No registration or costs involved. This is user companies producing great informative content for their peers.

Check Out The Rest Of Our Webinars

This OpenChain Webinar was broadcast on 2024-12-19.

Dec 12

Webinar: CHAOSS Practitioner Guides for Healthy & Sustainable OSS Projects

By automation, community, legal, licensing, News, security, Webinar

We had an insightful session with Dawn Foster on sustaining OSS projects and communities over the long-term. The CHAOSS project has been creating a series of MIT-licensed Practitioner Guides focused on improving the sustainability of our software and communities. The guides are designed to make it easier for people to draw meaningful and actionable insights using community metrics, even when those people do not necessarily have a deep background in data analysis or much experience working within OSS communities.

This talk identified several categories of metrics from the Practitioner Guide Series, including responsiveness, contributor sustainability, organizational participation, and security. It covered not just how to interpret the metrics, but also on providing ideas for improving in areas identified using the metrics. The audience walks away with a better understanding of how to use metrics to proactively improve the long-term sustainability of their OSS projects and communities.

Watch The Recording

About Our Speaker

Dawn leads the data science initiative for the CHAOSS project where she is also a Governing Board member / maintainer. Dawn is an OpenUK board member and co-chair of the CNCF Contributor Strategy Technical Advisory Group.

Dawn has 20+ years of experience working in open source positions at companies like VMware, Intel and Puppet with expertise in managing people, open source strategy, building new communities, and managing existing communities with a particular emphasis on developer and open source communities. She has held a wide range of roles over the years, including UNIX system administrator, researcher, consultant, strategist, director / manager, and more.

Dawn holds a PhD from the University of Greenwich, an MBA from Ashland University, and a BS in Computer Science from Kent State University. Dawn blogs about online communities as the author of the Fast Wonder Blog, and she’s blogged for The New Stack, Linux.com, GigaOM’s WebWorkerDaily, and in various other places.

She has done over a hundred talks at industry events, including many Linux Foundation events, KubeCon, OSCON, SXSW, FOSDEM and more. In her spare time she enjoys reading science fiction, running, and traveling.

More About Our Webinars:

This event is part of the overarching OpenChain Project Webinar Series. Our series highlights knowledge from throughout the global OpenChain eco-system. Participants are discussing approaches, processes and activities from their experience, providing a free service to increase shared knowledge in the supply chain. Our goal, as always, is to increase trust and therefore efficiency. No registration or costs involved. This is user companies producing great informative content for their peers.

Check Out The Rest Of Our Webinars

This OpenChain Webinar was broadcast on 2024-12-05.

Aug 11

Webinar: Implementing OpenChain ISO/IEC 5230 at endjin + Further Research on OpenChain ISO/IEC 18974

By community, licensing, News, security, standards, Webinar

Recent computer science graduate Charlotte Gayton shared her journey of implementing the OpenChain standard during her Year in Industry (ISO/IEC 5230) and her dissertation project (ISO/IEC 18974). She discussed the challenges she faced and the solutions she developed to achieve compliance. The session will provide a unique perspective on navigating OpenChain from the viewpoint of someone early in their career. Her work lead to the detailed case study recently published regarding OpenChain ISO/IEC 5230 adoption by endjin.

Watch the Recording:

View the Slides:

More About Our Webinars:

This event is part of the overarching OpenChain Project Webinar Series. Our series highlights knowledge from throughout the global OpenChain eco-system. Participants are discussing approaches, processes and activities from their experience, providing a free service to increase shared knowledge in the supply chain. Our goal, as always, is to increase trust and therefore efficiency. No registration or costs involved. This is user companies producing great informative content for their peers.

Check Out The Rest Of Our Webinars

This OpenChain Webinar was broadcast on 2024-08-08.

May 17

OpenChain Webinar: AboutCode and Beyond – End-to-End SCA

By automation, community, legal, licensing, News, security, Webinar

This OpenChain Webinar digs into open source tooling with open data for open source compliance.

Full Overview From The Presenters

Ensuring software license and security compliance can be difficult. Managing open source components – especially their licensing, provenance, and vulnerability risk – is a critical part of Software Composition Analysis (SCA), which is now a prerequisite for modern organizations to comply with mandated SBOMs and other regulations.

Expensive, proprietary SCA solutions rely on proprietary data that can be outdated or just wrong. To make using open source easier for everyone, we need FOSS tools and open data for FOSS SCA. Philippe Ombredanne will explain how using 100% open source software and open data, the AboutCode stack offers a new approach for the practical management of open source software for licensing and vulnerability risks for organizations of all sizes.

Philippe will share how modular open source projects like ScanCode, VulnerableCode, and DejaCode fit together to identify components and their license, provenance, and known vulnerabilities, and aggregate this and SBOM data across products, teams, and organizations to address security, legal, and regulatory requirements for software license and security compliance in an integrated solution.

Philippe will also discuss exciting updates on new open source projects for better software supply chain integrity and security like CRAVEX, which delivers modern open source tools for developers to manage, triage, rate, review, and determine exploitability of package vulnerabilities in a package-centric world.

Get The Slides

More About Our Webinars:

This event is part of the overarching OpenChain Project Webinar Series. Our series highlights knowledge from throughout the global OpenChain eco-system. Participants are discussing approaches, processes and activities from their experience, providing a free service to increase shared knowledge in the supply chain. Our goal, as always, is to increase trust and therefore efficiency. No registration or costs involved. This is user companies producing great informative content for their peers.

Check Out The Rest Of Our Webinars

This OpenChain Webinar was broadcast on 2024-05-15.

Apr 23

Webinar: OFE Briefing on the Cyber Resilience Act

By Featured, legal, licensing, News, security, Webinar

This webinar is a special briefing lead by Ciarán O’Riordan, Senior Policy Advisor at OpenForum Europe (OFE), on European policy matters that impact open source, business processes and risk management. OFE is a not-for-profit, Brussels-based independent think tank which explains the merits of openness in computing to policy makers and communities across Europe. Originally launched in 2002 to accelerate and broaden the use of Open Source Software (OSS) among businesses, consumers and governments, OFE’s focus has since evolved to also cover issues related to Open standards, Cybersecurity, Digital Government, Public Procurement, Intellectual Property, Cloud Computing and Internet Policy.

More Details

“The proposal for a regulation on cybersecurity requirements for products with digital elements, known as the Cyber Resilience Act, bolsters cybersecurity rules to ensure more secure hardware and software products. Hardware and software products are increasingly subject to successful cyberattacks, leading to an estimated global annual cost of cybercrime of €5.5 trillion by 2021.”
https://digital-strategy.ec.europa.eu/en/library/cyber-resilience-act

Our Speaker is Ciarán O’Riordan, Senior Policy Advisor at OpenForum Europe. His background is as a free software / open source software policy and communications expert.

OFE is a not-for-profit, Brussels-based independent think tank which explains the merits of openness in computing to policy makers and communities across Europe. Originally launched in 2002 to accelerate and broaden the use of Open Source Software (OSS) among businesses, consumers and governments, OFE’s focus has since evolved to also cover issues related to Open standards, Cybersecurity, Digital Government, Public Procurement, Intellectual Property, Cloud Computing and Internet Policy.
https://openforumeurope.org/

More in the OFE Series

We held three special briefings from OFE for the OpenChain community from May to June 2024.

More About Our Webinars:

This event is part of the overarching OpenChain Project Webinar Series. Our series highlights knowledge from throughout the global OpenChain eco-system. Participants are discussing approaches, processes and activities from their experience, providing a free service to increase shared knowledge in the supply chain. Our goal, as always, is to increase trust and therefore efficiency. No registration or costs involved. This is user companies producing great informative content for their peers.

Check Out The Rest Of Our Webinars

This OpenChain Webinar was broadcast on 2024-04-23.