On Nov 22, 2022, at 11:32, Shane Coughlan <scoughlan@...> wrote:

The OpenChain Export Control Work Group will hold its first meeting on the 22nd of November at 15:00 UTC (16:00 CET).

This meeting will have the following agenda:

(1) Introductions
(2) Overview of why export control matters from the perspective of open source and compliance
(3) Open discussion about how our community can contribute to the field

Zoom meeting:
https://zoom.us/j/93456802267

Meeting ID: 93456802267

<OpenChain Export Control Work Group - First Meeting.ics>

On Nov 21, 2022, at 9:08, Shane Coughlan <scoughlan@...> wrote:

A reminder: a chair election for the specification work team ends tomorrow. You have *one* day left to vote.

Here are our current nominees:
• Steve Kilbane, Analog Devices
• Helio Chissini de Castro, CARIAD
• Jacob Wilson, Gemini
• Chris Wood, Lockheed Martin
Everyone is invited to vote for their preferred chairs. Here is how:
• You have two votes.
• One is licensing focused (Steve or Helio) and one is security focused (Jacob or Chris).
• You can vote by (a) signing up to our Specification mailing list (because this mailing list is our single source of truth for specification work) and (b) sending an email to operations@... with the subject “Specification Chair Elections” and the following content:
My name is NAME and my votes are as follows:
NAME for licensing
NAME for security
Regards
YOUR NAME

On Nov 16, 2022, at 9:59, Shane Coughlan via lists.openchainproject.org <scoughlan=linuxfoundation.org@...> wrote:

OpenChain Specification Chair Election Period Now Open

The OpenChain Project is running an election for co-chairs of the Specification Work Group. The election period is from today (2022-11-16) until 2022-11-22 Close of Business UTC.
Here are our current nominees:
• Steve Kilbane, Analog Devices
• Helio Chissini de Castro, CARIAD
• Jacob Wilson, Gemini
• Chris Wood, Lockheed Martin
Everyone is invited to vote for their preferred chairs. Here is how:
• You have two votes.
• One is licensing focused (Steve or Helio) and one is security focused (Jacob or Chris).
• You can vote by (a) signing up to our Specification mailing list (because this mailing list is our single source of truth for specification work) and (b) sending an email to operations@... with the subject “Specification Chair Elections” and the following content:
My name is NAME and my votes are as follows:
NAME for licensing
NAME for security
Regards
YOUR NAME
Some notes:
• The email address ending your vote must be subscribed to the specification mailing list.
• Any vote not provided in this format will be invalid.
• You can vote for yourself.
• You can only submit your votes once.
More Details
How we are running this election is split into two lengthy descriptions below. We are striving to do two things:
• Create an open election process
• Address the potential we have to have multiple domain experts sharing work
Because this is our first major election for Specification Chair, the process may have some rough edges. If there are any critical issues, we will address them.
How We Are Running The Elections
The OpenChain Governing Board is formally considering who should be appointed by the board for the position(s) of OpenChain Specification Chairperson, and invites the broader OpenChain community to provide their perspective.
In this process, the broader OpenChain community will have nominees proposed and voted on to provide a recommendation. That recommendation will be passed to the OpenChain Governing Board for review, approval and ratification at their next meeting.
The specific process on behalf of the community is to undertake a voting process after a period of nomination. The community will vote in the following manner:
Votes for chairpeople will be sent by email to operations@...(received by the OpenChain General Manager and Project Manager).
Each member of our specification@ can cast *one* vote. All members of main@ are entitled to join specification@. The requirement to join the specification list is to maintain that list as the “single source of truth” for our specification-editing and other core specification work.
The votes will be tallied by the General Manager and prepared for the OpenChain Governing Board to review.
The tally will be reported to the OpenChain governing board. Their feedback and final decision will be provided to the community-at-large after their next formal governing board meeting.
For the 2022 OpenChain Specification Work Group elections the following notes are provided:
(1) we are operationally splitting the specification work group into two work groups: licensing and security, reflecting our two specifications in-market.
(2) for *this* specific election, we will split the election into two threads: one license biased (two nominees) and one security biased (two nominees). The result will be two chairs to fill the co-chair positions after approval by the OpenChain Governing Board.
(3) this means everyone on specification@ should vote for:
(i) their preferred choice for license work group chair;
(I) their preferred choice for security work group chair.
(4) these votes may be cast between the 16th and 22nd of November 2022.
(5) the OpenChain Governing Board will receive the tally of votes expressing community feedback, and will review it formally at their next meeting on the 8th of December 2022.
(6) it is expected that at this juncture the community will receive a response from the OpenChain Governing Board regarding their decision(s) around specification chairperson(s) circa 9th December 2022, and our new specification chairs will begin their term of office prior to 2023.
This process may be adjusted at any time by the governing board, and feedback to improve the process is always welcome, with the optic of ensuring that we continually refine the process as time progresses.
For This Specific Election
For the nomination period, we happen to have two people well versed in license compliance (Steve and Helio) and two people with a security background (Jacob and Chris). This suggest that our co-chair election – for *this* specific election, should break into two threads: one license biased (two nominees) and one security biased (two nominees). The result will be two chairs to fill the co-chair positions after approval by the OpenChain Governing Board.
However, for clarity, the intent is not to split the development of our licensing and security specifications into two different paths. The intent is that both chairs will work on both specifications by helping to collect community feedback and so on, with this feedback being provided to the Steering Committee for formal review and ratification if and when we decide to produce new versions of our standards.

Kobota San has raised an interesting topic for discussion. Attached see slides with an overview.

Summary: there are various different types of SBOM involved in preparing various types of product. For example, Build SBOM, Binary SBOM, Source SBOM.

What is the best way to combine these for final records?

Thoughts and suggestions?

Intel Deutschland GmbH
Registered Address: Am Campeon 10, 85579 Neubiberg, Germany
Tel: +49 89 99 8853-0, www.intel.de
Managing Directors: Christin Eisenschmid, Sharon Heck, Tiffany Doon Silva  
Chairperson of the Supervisory Board: Nicole Lau
Registered Office: Munich
Commercial Register: Amtsgericht Muenchen HRB 186928

On Nov 16, 2022, at 9:59, Shane Coughlan via lists.openchainproject.org <scoughlan=linuxfoundation.org@...> wrote:

OpenChain Specification Chair Election Period Now Open

The OpenChain Project is running an election for co-chairs of the Specification Work Group. The election period is from today (2022-11-16) until 2022-11-22 Close of Business UTC.
Here are our current nominees:

• Steve Kilbane, Analog Devices

• Helio Chissini de Castro, CARIAD 

• Jacob Wilson, Gemini

• Chris Wood, Lockheed Martin

Everyone is invited to vote for their preferred chairs. Here is how:

• You have two votes.

• One is licensing focused (Steve or Helio) and one is security focused (Jacob or Chris).

• You can vote by (a) signing up to our Specification mailing list (because this mailing list is our single source of truth for specification work) and (b) sending an email to operations@... with the subject “Specification Chair Elections” and the following content:

My name is NAME and my votes are as follows:
NAME for licensing
NAME for security
Regards
YOUR NAME
Some notes:

• The email address ending your vote must be subscribed to the specification mailing list.

• Any vote not provided in this format will be invalid.

• You can vote for yourself.

• You can only submit your votes once.

More Details
How we are running this election is split into two lengthy descriptions below. We are striving to do two things:

• Create an open election process

• Address the potential we have to have multiple domain experts sharing work

Because this is our first major election for Specification Chair, the process may have some rough edges. If there are any critical issues, we will address them.
How We Are Running The Elections
The OpenChain Governing Board is formally considering who should be appointed by the board for the position(s) of OpenChain Specification Chairperson, and invites the broader OpenChain community to provide their perspective.
In this process, the broader OpenChain community will have nominees proposed and voted on to provide a recommendation. That recommendation will be passed to the OpenChain Governing Board for review, approval and ratification at their next meeting.
The specific process on behalf of the community is to undertake a voting process after a period of nomination. The community will vote in the following manner:
Votes for chairpeople will be sent by email to operations@...(received by the OpenChain General Manager and Project Manager).
Each member of our specification@ can cast *one* vote. All members of main@ are entitled to join specification@. The requirement to join the specification list is to maintain that list as the “single source of truth” for our specification-editing and other core specification work.
The votes will be tallied by the General Manager and prepared for the OpenChain Governing Board to review.
The tally will be reported to the OpenChain governing board. Their feedback and final decision will be provided to the community-at-large after their next formal governing board meeting.
For the 2022 OpenChain Specification Work Group elections the following notes are provided:
(1) we are operationally splitting the specification work group into two work groups: licensing and security, reflecting our two specifications in-market.
(2) for *this* specific election, we will split the election into two threads: one license biased (two nominees) and one security biased (two nominees). The result will be two chairs to fill the co-chair positions after approval by the OpenChain Governing Board.
(3) this means everyone on specification@ should vote for:
(i) their preferred choice for license work group chair;
(I) their preferred choice for security work group chair.
(4) these votes may be cast between the 16th and 22nd of November 2022.
(5) the OpenChain Governing Board will receive the tally of votes expressing community feedback, and will review it formally at their next meeting on the 8th of December 2022.
(6) it is expected that at this juncture the community will receive a response from the OpenChain Governing Board regarding their decision(s) around specification chairperson(s) circa 9th December 2022, and our new specification chairs will begin their term of office prior to 2023.
This process may be adjusted at any time by the governing board, and feedback to improve the process is always welcome, with the optic of ensuring that we continually refine the process as time progresses.
For This Specific Election
For the nomination period, we happen to have two people well versed in license compliance (Steve and Helio) and two people with a security background (Jacob and Chris). This suggest that our co-chair election – for *this* specific election, should break into two threads: one license biased (two nominees) and one security biased (two nominees). The result will be two chairs to fill the co-chair positions after approval by the OpenChain Governing Board.
However, for clarity, the intent is not to split the development of our licensing and security specifications into two different paths. The intent is that both chairs will work on both specifications by helping to collect community feedback and so on, with this feedback being provided to the Steering Committee for formal review and ratification if and when we decide to produce new versions of our standards.

Kobota San has raised an interesting topic for discussion. Attached see slides with an overview.

Summary: there are various different types of SBOM involved in preparing various types of product. For example, Build SBOM, Binary SBOM, Source SBOM.

What is the best way to combine these for final records?

Thoughts and suggestions?

Da: "Carlo Piana" <carlo@...>
A: "main@..." <main@...>
Cc: "OpenChain Education" <education@...>
Inviato: Venerdì, 18 novembre 2022 12:33:43
Oggetto: Re: [openchain] OpenChain Reference Training Slides now in MarkDown (Draft, needs work)

Anyway, even in Powerpoint online, the charts have issues.

see here:


----- Messaggio originale -----

Da: "Carlo Piana" <carlo@...>
A: "main@..." <main@...>
Cc: "OpenChain Education" <education@...>
Inviato: Venerdì, 18 novembre 2022 12:15:09
Oggetto: Re: [openchain] OpenChain Reference Training Slides now in MarkDown
(Draft, needs work)

Hi,

I have tried to figure out an easier way to do it and extract the images in a
bulk-ish way, but they appear to be Powerpoint internal objects without any
coherence. The best way I have figured out without spending too much time,
was to export to PDF, open the PDF in Inkscape, remove the text, group the
graphic and export what remains as SVG.

Now Inkscape can deal with multiple pages, but it would be a much better idea to
separate each page, remove the ones without images, put the remaining ones in a
place and proceed page by page.

It's painful and error prone. Powerpoint is something that is better left with
presentations (or even better, alone, sitting in the dark to rotten), not
documents.

Cheers

Carlo


----- Messaggio originale -----

Da: "Shane Coughlan" <scoughlan@...>
A: "OpenChain Main" <main@...>
Cc: "OpenChain Education" <education@...>
Inviato: Mercoledì, 16 novembre 2022 15:02:02
Oggetto: [openchain] OpenChain Reference Training Slides now in MarkDown (Draft,
needs work)

Well, this is big news. Our reference training slides - one of the most used
parts of our reference library - is now in MarkDown. The conversation status is
“draft” and we need to check for rough edges:
https://github.com/OpenChain-Project/Reference-Material/blob/master/Training-Slides/Official/2.1/en/openchain-reference-training-slides-iso5230-version1.md

Original PowerPoint slides here for compare, contrast and planning:
https://github.com/OpenChain-Project/Reference-Material/blob/master/Training-Slides/Official/2.1/en/openchain-reference-training-slides-for-ISO-5230-en.pptx

The biggest to-do item is that we need to extract the images from the slides and
add them to the MarkDown. This is probably a relatively big lift… we may want
to recreate some of the images at this juncture.

Da: "Carlo Piana" <carlo@...>
A: "main@..." <main@...>
Cc: "OpenChain Education" <education@...>
Inviato: Venerdì, 18 novembre 2022 12:15:09
Oggetto: Re: [openchain] OpenChain Reference Training Slides now in MarkDown (Draft, needs work)

Hi,

I have tried to figure out an easier way to do it and extract the images in a
bulk-ish way, but they appear to be Powerpoint internal objects without any
coherence. The best way I have figured out without spending too much time,
was to export to PDF, open the PDF in Inkscape, remove the text, group the
graphic and export what remains as SVG.

Now Inkscape can deal with multiple pages, but it would be a much better idea to
separate each page, remove the ones without images, put the remaining ones in a
place and proceed page by page.

It's painful and error prone. Powerpoint is something that is better left with
presentations (or even better, alone, sitting in the dark to rotten), not
documents.

Cheers

Carlo


----- Messaggio originale -----

Da: "Shane Coughlan" <scoughlan@...>
A: "OpenChain Main" <main@...>
Cc: "OpenChain Education" <education@...>
Inviato: Mercoledì, 16 novembre 2022 15:02:02
Oggetto: [openchain] OpenChain Reference Training Slides now in MarkDown (Draft,
needs work)

Well, this is big news. Our reference training slides - one of the most used
parts of our reference library - is now in MarkDown. The conversation status is
“draft” and we need to check for rough edges:
https://github.com/OpenChain-Project/Reference-Material/blob/master/Training-Slides/Official/2.1/en/openchain-reference-training-slides-iso5230-version1.md

Original PowerPoint slides here for compare, contrast and planning:
https://github.com/OpenChain-Project/Reference-Material/blob/master/Training-Slides/Official/2.1/en/openchain-reference-training-slides-for-ISO-5230-en.pptx

The biggest to-do item is that we need to extract the images from the slides and
add them to the MarkDown. This is probably a relatively big lift… we may want
to recreate some of the images at this juncture.

Da: "Shane Coughlan" <scoughlan@...>
A: "OpenChain Main" <main@...>
Cc: "OpenChain Education" <education@...>
Inviato: Mercoledì, 16 novembre 2022 15:02:02
Oggetto: [openchain] OpenChain Reference Training Slides now in MarkDown (Draft, needs work)

Well, this is big news. Our reference training slides - one of the most used
parts of our reference library - is now in MarkDown. The conversation status is
“draft” and we need to check for rough edges:
https://github.com/OpenChain-Project/Reference-Material/blob/master/Training-Slides/Official/2.1/en/openchain-reference-training-slides-iso5230-version1.md

Original PowerPoint slides here for compare, contrast and planning:
https://github.com/OpenChain-Project/Reference-Material/blob/master/Training-Slides/Official/2.1/en/openchain-reference-training-slides-for-ISO-5230-en.pptx

The biggest to-do item is that we need to extract the images from the slides and
add them to the MarkDown. This is probably a relatively big lift… we may want
to recreate some of the images at this juncture.