If you want to dive into the full background on the recent discussion regarding compliance program quality and continual improvement, check out the recording of the latest work team

It does appear this mental model can provide an avenue forward. Speculation: if the market(s) dictate various concepts of evolution, we will probably see differentiation by sector regarding preferred

All, context slides at link: https://1drv.ms/p/s!AsXJVqby5kpnkShuUGG9M2Ki9MEc During our last call we had some strong push-back in terms of the project itself defining levels of competence. However,

All, context slides at link: https://1drv.ms/p/s!AsXJVqby5kpnkShuUGG9M2Ki9MEc Jari, I think it’s a good idea, but I also fear it might add a little too much complexity at this time. How about we

In a break from our usual governance-related discussions, Linux has hit a big milestone and Greg KH has a few words to share in an interview on the topic. Those who know Greg will know that he is one

Hello all This is a great discussion. I do like Jacob's suggestion with some simple notation that indicates that the "levels" or whatever you call them are cumulative going from the base (Level 1 up

I agree with Steve’s sentiment of wandering tokens, in my opinion levels of assurance with progressive technology independent criteria are required. Borrowing from other ISO standards, I propose

Hi All, I think that this new slide 10 is better now. It might add unnecessary complexity, but maybe each of the 4 arrows could have a small loop arrow on top depicting the nature of iterative work

Thanks Steve. Slide 10 has been refined to place emphasis on the actions being non-normative evolution on the part of a single example

Thanks Matija. Glad it reads well to you! Regards Shane

Die 24. 08. 21 et hora 09:00 Shane Coughlan scripsit: This sounds like a sane approach to me. After opening the slide deck today, I was wondering what the complaints were against :) The slides look

Hi Shane, As a comment on the revised slides, slide 10 doesn't work for me, since it shows a cycle, but you wouldn't go from your intended end-point (audit done) back to "just" OpenChain compliance

Thanks for the great feedback Kate and Mark (on this list) and loads of other people (on our call). In broad strokes: (1) we decided to make it *very* clear this was not about variants of OpenChain

One of the core guiding principles for the OpenChain Specification is to focus on the what and why of compliance (and avoid the how and when). This is highlighted in the introduction of the spec. That

Hi Shane, Bit concerned about the slide mentioning the formats (SPDX, SWID, CycloneDX) - it's painting them as basically equivalent. However when it comes to representing licensing information

Open Compliance Summit is an exclusive event for Linux Foundation members and select invitees. It will take place on December 16, 2021. You can submit your talk proposals

Make a note for December 16, 2021. Open Compliance Summit is an exclusive event for Linux Foundation members and select invitees. Attendance is limited to ensure ease of networking and

We will be discussing a very important topic at the OpenChain bi-weekly global work team meeting today (Monday 23rd of August) at 14:00 UTC. You can dial-in here: https://zoom.us/j/4377592799 From

Dear all During a recent OpenChain Japan Planning meeting we discussed the challenge of “next steps” in OpenChain ISO 5230 conformance. Our initial goal of adoption in the supply chain is well

Coontec, a company focused on secure and effective embedded software, is the latest company to announce an OpenChain ISO 5230 conformant