----- Original Message -----

From: "Dirk Riehle" <dirk@riehle.org>
To: "main@lists.openchainproject.org" <main@lists.openchainproject.org>
Sent: Thursday, 1 July, 2021 13:26:51
Subject: [openchain] Direct or indirect supplier?

Hi,

Germany has a new law about diligence in the supply chain, basically to watch
out that no supplier violates human rights.

We like to talk about open source projects being suppliers, but I'm not sure
that legally speaking this is true.

As a consequence, what is the relationship between a company contributing to
an open source project with the company using it? Is that a direct supplier
relationship? An indirect one? None at all?

Thanks, Dirk

Dirk,

I guess a German Lawyer should reply.

In general terms, as I have been pondering it on other accounts, I would suggest that making FOSS generally available does not qualify as a supplier relationship. One needs to have a development agreement or a support agreement for that. This could also include developing FOSS to be given at large.

Just my two eurocents.

Cheers

Carlo