
Vargenau, Marc-Etienne (Nokia - FR/Paris-Saclay)
Hi,
There is an article about OpenChain in the German Wikipedia:
https://de.wikipedia.org/wiki/ISO/IEC_5230
but in no other language.
I consider it would be good to have an article at least in English.
What do you think?
Best regards,
Marc-Etienne
--
Marc-Etienne Vargenau marc-etienne.vargenau@...
Nokia, Route de Villejust, 91620 NOZAY, FRANCE
Mobile: +33 6 24 49 78 68
Senior Specialist Open Source
Planned absence: none
|
|
Hi Marc, please find attached a translated version of the article. I do not know how to publish it on Wikipedia and whether it should be available in English on the German site or English, American or Irish site… But feel free to use. Br Jan Von: <main@...> im Auftrag von "Vargenau, Marc-Etienne (Nokia - FR/Paris-Saclay) via lists.openchainproject.org" <marc-etienne.vargenau=nokia.com@...> Antworten an: "main@..." <main@...> Datum: Dienstag, 22. November 2022 um 16:16 An: "main@..." <main@...> Cc: "Marc-Etienne Vargenau (Nokia)" <marc-etienne.vargenau@...> Betreff: [openchain] OpenChain article in Wikipedia Hi, There is an article about OpenChain in the German Wikipedia: https://de.wikipedia.org/wiki/ISO/IEC_5230 but in no other language. I consider it would be good to have an article at least in English. What do you think? Best regards, Marc-Etienne -- Marc-Etienne Vargenau marc-etienne.vargenau@... Nokia, Route de Villejust, 91620 NOZAY, FRANCE Mobile: +33 6 24 49 78 68 Senior Specialist Open Source Planned absence: none
|
|
Hi all,
it seems as the German Wikipedia has a different treatment of the terms of “OpenChain” and “ISO/IEC 5230”.

The German Wikipedia will forward you to the “ISO/IEC 5230” page when searching for “OpenChain”…
…in the English, French, Spanish and Italiian Wikipedia, it’s just the other way round.
So there actually is information on the Wikipedia pages – but under different headlines.
Would it be an idea to create two separate articles for “OpenChain” and “ISO/IEC 5230”?
At least it might be good to have a uniform treatment of the search terms in the different language versions…
Regards,
Stefan
Stefan Thanheiser
Atruvia AG
---
Servicefeld Qualität IT-Sicherheit Einkauf,
Tribe Einkauf,
Chapter Software Asset & Lizenzmanagement
---
Telefon +49 721 4004-1860
Mobil +49 170 3304133
E-Mail stefan.thanheiser@...
Atruvia AG | www.atruvia.de AG Frankfurt a. M. HRB 102381 | Sitz der Gesellschaft: Frankfurt a. M. | USt-IdNr. DE 143582320 Vorstand: Martin Beyer (Vorstandssprecher), Ulrich Coenen (Vorstandssprecher), Daniela Bücker, Birgit Frohnhoff, Jörg Staff, Ralf Teufel Vorsitzender des Aufsichtsrats: Jürgen Brinkmann
Von: main@... <main@...>
Im Auftrag von Vargenau, Marc-Etienne (Nokia - FR/Paris-Saclay)
Gesendet: Dienstag, 22. November 2022 16:16
An: main@...
Cc: Marc-Etienne Vargenau (Nokia) <marc-etienne.vargenau@...>
Betreff: [openchain] OpenChain article in Wikipedia
Hi,
There is an article about OpenChain in the German Wikipedia:
https://de.wikipedia.org/wiki/ISO/IEC_5230
but in no other language.
I consider it would be good to have an article at least in English.
What do you think?
Best regards,
Marc-Etienne
--
Marc-Etienne Vargenau marc-etienne.vargenau@...
Nokia, Route de Villejust, 91620 NOZAY, FRANCE
Mobile: +33 6 24 49 78 68
Senior Specialist Open Source
Planned absence: none
|
|

Vargenau, Marc-Etienne (Nokia - FR/Paris-Saclay)
Hi Stefan,
Thank you for your quick translation of the German article. I will put it in the English Wikipedia tomorrow.
In German Wikipedia, the article is under “ISO/IEC 5230”. I have created a redirect from “OpenChain”.
In the other languages, there are no articles for the moment. Your screenshot is from Wikidata.
What I will do is to put the article under “OpenChain” and a redirect from “ISO/IEC 5230”.
Best regards,
Marc-Etienne
toggle quoted message
Show quoted text
From: Stefan Thanheiser <Stefan.Thanheiser@...>
Sent: Tuesday, November 22, 2022 7:21 PM
To: main@...
Cc: Marc-Etienne Vargenau (Nokia) <marc-etienne.vargenau@...>
Subject: AW: OpenChain article in Wikipedia
Hi all,
it seems as the German Wikipedia has a different treatment of the terms of “OpenChain” and “ISO/IEC 5230”.

The German Wikipedia will forward you to the “ISO/IEC 5230” page when searching for “OpenChain”…
…in the English, French, Spanish and Italiian Wikipedia, it’s just the other way round.
So there actually is information on the Wikipedia pages – but under different headlines.
Would it be an idea to create two separate articles for “OpenChain” and “ISO/IEC 5230”?
At least it might be good to have a uniform treatment of the search terms in the different language versions…
Regards,
Stefan
Stefan Thanheiser
Atruvia AG
---
Servicefeld Qualität IT-Sicherheit Einkauf,
Tribe Einkauf,
Chapter Software Asset & Lizenzmanagement
---
Telefon +49 721 4004-1860
Mobil +49 170 3304133
E-Mail stefan.thanheiser@...
Atruvia AG | www.atruvia.de
AG Frankfurt a. M. HRB 102381 | Sitz der Gesellschaft: Frankfurt a. M. | USt-IdNr. DE 143582320
Vorstand: Martin Beyer (Vorstandssprecher), Ulrich Coenen (Vorstandssprecher),
Daniela Bücker, Birgit Frohnhoff, Jörg Staff, Ralf Teufel
Vorsitzender des Aufsichtsrats: Jürgen Brinkmann
Von:
main@... <main@...>
Im Auftrag von Vargenau, Marc-Etienne (Nokia - FR/Paris-Saclay)
Gesendet: Dienstag, 22. November 2022 16:16
An: main@...
Cc: Marc-Etienne Vargenau (Nokia) <marc-etienne.vargenau@...>
Betreff: [openchain] OpenChain article in Wikipedia
Hi,
There is an article about OpenChain in the German Wikipedia:
https://de.wikipedia.org/wiki/ISO/IEC_5230
but in no other language.
I consider it would be good to have an article at least in English.
What do you think?
Best regards,
Marc-Etienne
--
Marc-Etienne Vargenau marc-etienne.vargenau@...
Nokia, Route de Villejust, 91620 NOZAY, FRANCE
Mobile: +33 6 24 49 78 68
Senior Specialist Open Source
Planned absence: none
|
|
Hi Stefan
I think it would be super useful, especially because the OpenChain Project is now producing two standards.
Um… team everyone. How about we edit via this email thread?
Shane Shane Coughlan OpenChain General Manager +818040358083 Book a meeting: https://meetings.hubspot.com/scoughlan
toggle quoted message
Show quoted text
On Nov 22, 2022, at 19:21, Stefan Thanheiser <stefan.thanheiser@...> wrote:
Hi all,
it seems as the German Wikipedia has a different treatment of the terms of “OpenChain” and “ISO/IEC 5230”.

The German Wikipedia will forward you to the “ISO/IEC 5230” page when searching for “OpenChain”…
…in the English, French, Spanish and Italiian Wikipedia, it’s just the other way round.
So there actually is information on the Wikipedia pages – but under different headlines.
Would it be an idea to create two separate articles for “OpenChain” and “ISO/IEC 5230”?
At least it might be good to have a uniform treatment of the search terms in the different language versions…
Regards,
Stefan
Stefan Thanheiser
Atruvia AG
---
Servicefeld Qualität IT-Sicherheit Einkauf,
Tribe Einkauf,
Chapter Software Asset & Lizenzmanagement
---
Telefon +49 721 4004-1860
Mobil +49 170 3304133
E-Mail stefan.thanheiser@...
Atruvia AG | www.atruvia.de AG Frankfurt a. M. HRB 102381 | Sitz der Gesellschaft: Frankfurt a. M. | USt-IdNr. DE 143582320 Vorstand: Martin Beyer (Vorstandssprecher), Ulrich Coenen (Vorstandssprecher), Daniela Bücker, Birgit Frohnhoff, Jörg Staff, Ralf Teufel Vorsitzender des Aufsichtsrats: Jürgen Brinkmann
Von: main@... <main@...>
Im Auftrag von Vargenau, Marc-Etienne (Nokia - FR/Paris-Saclay)
Gesendet: Dienstag, 22. November 2022 16:16
An: main@...
Cc: Marc-Etienne Vargenau (Nokia) <marc-etienne.vargenau@...>
Betreff: [openchain] OpenChain article in Wikipedia
Hi,
There is an article about OpenChain in the German Wikipedia:
https://de.wikipedia.org/wiki/ISO/IEC_5230
but in no other language.
I consider it would be good to have an article at least in English.
What do you think?
Best regards,
Marc-Etienne
--
Marc-Etienne Vargenau marc-etienne.vargenau@...
Nokia, Route de Villejust, 91620 NOZAY, FRANCE
Mobile: +33 6 24 49 78 68
Senior Specialist Open Source
Planned absence: none
|
|

Vargenau, Marc-Etienne (Nokia - FR/Paris-Saclay)
Hi,
I have created the article, but it has been moved to the Draft area:
https://en.wikipedia.org/wiki/Draft:ISO/IEC_5230
We need to do some improvement (adding references) before it is published.
I will do my best to have it approved.
Best regards,
Marc-Etienne
toggle quoted message
Show quoted text
From: Shane Coughlan <scoughlan@...>
Sent: Thursday, November 24, 2022 6:38 AM
To: main@...
Cc: Marc-Etienne Vargenau (Nokia) <marc-etienne.vargenau@...>; OpenChain Education <education@...>
Subject: Re: [openchain] OpenChain article in Wikipedia
Hi Stefan
I think it would be super useful, especially because the OpenChain Project is now producing two standards.
Um… team everyone. How about we edit via this email thread?
Shane Coughlan
OpenChain General Manager
Hi all,
it seems as the German Wikipedia has a different treatment of the terms of “OpenChain” and “ISO/IEC 5230”.

The German Wikipedia will forward you to the “ISO/IEC 5230” page when searching for “OpenChain”…
…in the English, French, Spanish and Italiian Wikipedia, it’s just the other way round.
So there actually is information on the Wikipedia pages – but under different headlines.
Would it be an idea to create two separate articles for “OpenChain” and “ISO/IEC 5230”?
At least it might be good to have a uniform treatment of the search terms in the different language versions…
Regards,
Stefan
Stefan Thanheiser
Atruvia AG
---
Servicefeld Qualität IT-Sicherheit Einkauf,
Tribe Einkauf,
Chapter Software Asset & Lizenzmanagement
---
Telefon +49 721 4004-1860
Mobil +49 170 3304133
E-Mail stefan.thanheiser@...
Atruvia AG | www.atruvia.de
AG Frankfurt a. M. HRB 102381 | Sitz der Gesellschaft: Frankfurt a. M. | USt-IdNr. DE 143582320
Vorstand: Martin Beyer (Vorstandssprecher), Ulrich Coenen (Vorstandssprecher),
Daniela Bücker, Birgit Frohnhoff, Jörg Staff, Ralf Teufel
Vorsitzender des Aufsichtsrats: Jürgen Brinkmann
Von:
main@... <main@...>
Im Auftrag von Vargenau, Marc-Etienne (Nokia - FR/Paris-Saclay)
Gesendet: Dienstag, 22. November 2022 16:16
An: main@...
Cc: Marc-Etienne Vargenau (Nokia) <marc-etienne.vargenau@...>
Betreff: [openchain] OpenChain article in Wikipedia
Hi,
There is an article about OpenChain in the German Wikipedia:
https://de.wikipedia.org/wiki/ISO/IEC_5230
but in no other language.
I consider it would be good to have an article at least in English.
What do you think?
Best regards,
Marc-Etienne
--
Marc-Etienne Vargenau marc-etienne.vargenau@...
Nokia, Route de Villejust, 91620 NOZAY, FRANCE
Mobile: +33 6 24 49 78 68
Senior Specialist Open Source
Planned absence: none
|
|
Thank you for flagging and for doing this! I will aim to swing by on Monday to help out.
Regards
Shane Shane Coughlan OpenChain General Manager +818040358083 Book a meeting: https://meetings.hubspot.com/scoughlan
toggle quoted message
Show quoted text
On Nov 24, 2022, at 10:17, Vargenau, Marc-Etienne (Nokia - FR/Paris-Saclay) <marc-etienne.vargenau@...> wrote:
Hi,
I have created the article, but it has been moved to the Draft area:
https://en.wikipedia.org/wiki/Draft:ISO/IEC_5230
We need to do some improvement (adding references) before it is published.
I will do my best to have it approved.
Best regards,
Marc-Etienne
From: Shane Coughlan <scoughlan@...>
Sent: Thursday, November 24, 2022 6:38 AM
To: main@...
Cc: Marc-Etienne Vargenau (Nokia) <marc-etienne.vargenau@...>; OpenChain Education <education@...>
Subject: Re: [openchain] OpenChain article in Wikipedia
Hi Stefan
I think it would be super useful, especially because the OpenChain Project is now producing two standards.
Um… team everyone. How about we edit via this email thread?
Shane Coughlan
OpenChain General Manager
Hi all,
it seems as the German Wikipedia has a different treatment of the terms of “OpenChain” and “ISO/IEC 5230”.
<image001.png>
The German Wikipedia will forward you to the “ISO/IEC 5230” page when searching for “OpenChain”…
…in the English, French, Spanish and Italiian Wikipedia, it’s just the other way round.
So there actually is information on the Wikipedia pages – but under different headlines.
Would it be an idea to create two separate articles for “OpenChain” and “ISO/IEC 5230”?
At least it might be good to have a uniform treatment of the search terms in the different language versions…
Regards,
Stefan
Stefan Thanheiser
Atruvia AG
---
Servicefeld Qualität IT-Sicherheit Einkauf,
Tribe Einkauf,
Chapter Software Asset & Lizenzmanagement
---
Telefon +49 721 4004-1860
Mobil +49 170 3304133
E-Mail stefan.thanheiser@...
Atruvia AG | www.atruvia.de
AG Frankfurt a. M. HRB 102381 | Sitz der Gesellschaft: Frankfurt a. M. | USt-IdNr. DE 143582320
Vorstand: Martin Beyer (Vorstandssprecher), Ulrich Coenen (Vorstandssprecher),
Daniela Bücker, Birgit Frohnhoff, Jörg Staff, Ralf Teufel
Vorsitzender des Aufsichtsrats: Jürgen Brinkmann
Von:
main@... <main@...>
Im Auftrag von Vargenau, Marc-Etienne (Nokia - FR/Paris-Saclay)
Gesendet: Dienstag, 22. November 2022 16:16
An: main@...
Cc: Marc-Etienne Vargenau (Nokia) <marc-etienne.vargenau@...>
Betreff: [openchain] OpenChain article in Wikipedia
Hi,
There is an article about OpenChain in the German Wikipedia:
https://de.wikipedia.org/wiki/ISO/IEC_5230
but in no other language.
I consider it would be good to have an article at least in English.
What do you think?
Best regards,
Marc-Etienne
--
Marc-Etienne Vargenau marc-etienne.vargenau@...
Nokia, Route de Villejust, 91620 NOZAY, FRANCE
Mobile: +33 6 24 49 78 68
Senior Specialist Open Source
Planned absence: none
|
|
Everyone, to help with the creation process I am flagging the text Marc-Etienne has prepared below. The link for editing on Wikipedia is: https://en.wikipedia.org/wiki/Draft:ISO/IEC_5230
== The proposed text for our Wikipedia article for ISO/IEC 5230 ==
ISO/IEC 5230 is an international standard on the key requirements for a high-quality open source license compliance program. The standard was published jointly by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC) in late 2020. The standard is based on the Linux Foundation OpenChain Specification 2.1. It focuses on software supply chains, easier procurement and license compliance. Organizations that meet the requirements of the standard can self-certify to ISO/IEC 17021, from an accredited certification body or after successfully completing an audit. How the standard works[edit]Most organizations and software products rely on numerous open source components made by third parties, such as frameworks, libraries and containers, coming from diverse and often unaffiliated sources. This is akin to a supply chain in a brick-and-mortar environment and making sure the supply chain is as reliable as possible is considered important from an operational, legal and security standpoint. Upon this premise, a number of players have decided to establish the ground rules for an organization to deal with open source software at whichever level of the supply chain they operate. A working group under the umbrella of the Linux Foundation, the OpenChain project. Later, when reaching the 2.0 version, the norms were presented for approval as an ISO/IEC standard. According to the standard, in order to use open source components effectively, organization must be aware of and comply with all the components involved, the associated open source licenses, and obligations such as copyleft. ISO/IEC 5230 aims to establish a non-prescriptive common understanding of what needs to be addressed within a quality open source compliance program. This makes ISO/IEC 5230 applicable across many industries and organizations and provides benefits to procurement and software supply chains, as open source software tends to be very cumbersome in legal contracts and procurement. The main topics covered by ISO/IEC 5230 and OpenChain-2.1 are: - Existence of an open source policy
- Competencies of program participants (e.g., legal training for specific tasks).
- Awareness of open source risks among all program participants
- A clearly defined scope, e.g. only specified areas and product lines
- Understand and collect licensing obligations for relevant use cases.
- Access for external open source requests (e.g. to the OSS authors).
- Compliance offices equipped with sufficient resources
- Generate a Bill of Material
- License compliance process (e.g., documents meeting obligations)
- Archiving and provision of compliance artifacts
- A guideline for community engagement and contributions
ISO/IEC 5230 does not define how exactly most of the tasks are to be performed, such as whether snippet scanning, revalidation of declared open source licenses is required, and what the compliance artifacts should look like. However, it should be noted that SPDX is now an ISO standard (ISO/IEC 5962) and is mentioned in ISO/IEC 5230 as an example of compliance artifacts. Certification[edit]A high-quality open source compliance program can be certified as compliant with ISO/IEC 5230 by a number of accredited registrars worldwide. In some countries, the bodies that verify the conformity of management systems to certain standards are referred to as "certification bodies", while in others they are usually referred to as "registration bodies", "assessment and registration bodies", "certification/registration bodies" and sometimes "registrars". ISO/IEC 5230 certification, like other ISO management system certifications, typically involves a three-step external audit process defined in ISO/IEC 17021: - Stage 1 is a preliminary, informal review of the open source compliance program, verifying, for example, the existence and completeness of key documents such as the organization's open source policy, clearing process, and staffing. This phase serves to familiarize the auditors with the organization and vice versa.
- Stage 2 is a more detailed and formal compliance audit, where the open source compliance program is independently audited against the requirements set out in ISO/IEC 5230. Auditors look for evidence to confirm that the management system has been properly designed and implemented and is actually in operation. Certification audits are usually performed by ISO/IEC 5230 lead auditors. Passing this phase results in the open source quality program being certified as compliant with ISO/IEC 5230.
Continuous means that follow-up reviews or audits are conducted to confirm that the organization continues to be compliant with the standard. Maintenance of certification requires periodic re-audits to confirm that the quality open source compliance program continues to function as specified and intended. These should occur at least annually, but are often conducted more frequently (in consultation with management), especially while the Quality Open Source Compliance Program is still under development. Additionally, ISO/IEC 5230 is functionally identical to OpenChain 2.1, which enables free self-certification via the project's web app. Dissemination[edit]On October 19, 2020, the Eclipse Foundation announced that it is the first open source foundation to be certified to ISO/IEC 5230[1]. Several companies, including SAP, Toshiba, Samsung Electronics and LG Electronics have publicly announced their conformance to OpenChain. External links[edit]Fist version of this article was translated from the article on German Wikipedia. References[edit]
toggle quoted message
Show quoted text
On Nov 24, 2022, at 18:17, Vargenau, Marc-Etienne (Nokia - FR/Paris-Saclay) <marc-etienne.vargenau@...> wrote:
Hi, I have created the article, but it has been moved to the Draft area: https://en.wikipedia.org/wiki/Draft:ISO/IEC_5230 We need to do some improvement (adding references) before it is published. I will do my best to have it approved. Best regards, Marc-Etienne From: Shane Coughlan <scoughlan@...> Sent: Thursday, November 24, 2022 6:38 AM To: main@... Cc: Marc-Etienne Vargenau (Nokia) <marc-etienne.vargenau@...>; OpenChain Education <education@...> Subject: Re: [openchain] OpenChain article in Wikipedia Hi Stefan I think it would be super useful, especially because the OpenChain Project is now producing two standards. Um… team everyone. How about we edit via this email thread? Shane Shane Coughlan OpenChain General Manager +818040358083 Book a meeting: https://meetings.hubspot.com/scoughlan
On Nov 22, 2022, at 19:21, Stefan Thanheiser <stefan.thanheiser@...> wrote: Hi all, it seems as the German Wikipedia has a different treatment of the terms of “OpenChain” and “ISO/IEC 5230”. <image001.png> The German Wikipedia will forward you to the “ISO/IEC 5230” page when searching for “OpenChain”… …in the English, French, Spanish and Italiian Wikipedia, it’s just the other way round. So there actually is information on the Wikipedia pages – but under different headlines. Would it be an idea to create two separate articles for “OpenChain” and “ISO/IEC 5230”? At least it might be good to have a uniform treatment of the search terms in the different language versions… Regards, Stefan Stefan Thanheiser Atruvia AG --- Servicefeld Qualität IT-Sicherheit Einkauf, Tribe Einkauf, Chapter Software Asset & Lizenzmanagement --- Telefon +49 721 4004-1860 Mobil +49 170 3304133 E-Mail stefan.thanheiser@... Atruvia AG | www.atruvia.de AG Frankfurt a. M. HRB 102381 | Sitz der Gesellschaft: Frankfurt a. M. | USt-IdNr. DE 143582320 Vorstand: Martin Beyer (Vorstandssprecher), Ulrich Coenen (Vorstandssprecher), Daniela Bücker, Birgit Frohnhoff, Jörg Staff, Ralf Teufel Vorsitzender des Aufsichtsrats: Jürgen Brinkmann Von: main@... <main@...> Im Auftrag von Vargenau, Marc-Etienne (Nokia - FR/Paris-Saclay) Gesendet: Dienstag, 22. November 2022 16:16 An: main@... Cc: Marc-Etienne Vargenau (Nokia) <marc-etienne.vargenau@...> Betreff: [openchain] OpenChain article in Wikipedia Hi, There is an article about OpenChain in the German Wikipedia: https://de.wikipedia.org/wiki/ISO/IEC_5230 but in no other language. I consider it would be good to have an article at least in English. What do you think? Best regards, Marc-Etienne -- Marc-Etienne Vargenau marc-etienne.vargenau@... Nokia, Route de Villejust, 91620 NOZAY, FRANCE Mobile: +33 6 24 49 78 68 Senior Specialist Open Source Planned absence: none
|
|

Vargenau, Marc-Etienne (Nokia - FR/Paris-Saclay)
toggle quoted message
Show quoted text
From: Shane Coughlan <scoughlan@...>
Sent: Tuesday, December 13, 2022 1:52 AM
To: OpenChain Main <main@...>
Cc: OpenChain Education <education@...>; Marc-Etienne Vargenau (Nokia) <marc-etienne.vargenau@...>
Subject: Re: [openchain] OpenChain article in Wikipedia
Everyone, to help with the creation process I am flagging the text Marc-Etienne has prepared below. The link for editing on Wikipedia is:
https://en.wikipedia.org/wiki/Draft:ISO/IEC_5230
== The proposed text for our Wikipedia article for ISO/IEC 5230 ==
ISO/IEC 5230 is an international standard on the key requirements for a high-quality open source
license compliance program. The standard was published jointly by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC) in late 2020. The standard is based on the Linux
Foundation OpenChain Specification 2.1. It focuses on software supply chains, easier procurement and license compliance. Organizations that meet the requirements of the standard can self-certify to ISO/IEC 17021, from an accredited certification
body or after successfully completing an audit.
How the standard works[edit]
Most organizations and software products rely on numerous open source components made by third parties, such as frameworks, libraries and containers, coming from diverse and often unaffiliated
sources. This is akin to a supply chain in a brick-and-mortar environment and making sure the supply chain is as reliable as possible is considered important from an operational, legal and security standpoint. Upon this premise, a number of players have decided
to establish the ground rules for an organization to deal with open source software at whichever level of the supply chain they operate. A working group under the umbrella of the Linux
Foundation, the OpenChain project. Later, when reaching the 2.0 version, the norms were presented for approval as an ISO/IEC standard.
According to the standard, in order to use open source components effectively, organization must be aware of and comply with all the components involved, the associated open source
licenses, and obligations such as copyleft. ISO/IEC 5230 aims to establish a non-prescriptive common understanding of what needs to
be addressed within a quality open source compliance program. This makes ISO/IEC 5230 applicable across many industries and organizations and provides benefits to procurement and software supply chains, as open source software tends to be very cumbersome in
legal contracts and procurement.
The main topics covered by ISO/IEC 5230 and OpenChain-2.1 are:
·
Existence of an open source policy
·
Competencies of program participants (e.g., legal training for specific tasks).
·
Awareness of open source risks among all program participants
·
A clearly defined scope, e.g. only specified areas and product lines
·
Understand and collect licensing obligations for relevant use cases.
·
Access for external open source requests (e.g. to the OSS authors).
·
Compliance offices equipped with sufficient resources
·
Generate a Bill of Material
·
License compliance process (e.g., documents meeting obligations)
·
Archiving and provision of compliance artifacts
·
A guideline for community engagement and contributions
ISO/IEC 5230 does not define how exactly most of the tasks are to be performed, such as whether snippet scanning, revalidation of declared open source licenses is required, and what
the compliance artifacts should look like. However, it should be noted that SPDX is now
an ISO standard (ISO/IEC 5962) and is mentioned in ISO/IEC 5230 as an example of compliance artifacts.
A high-quality open source compliance program can be certified as compliant with ISO/IEC 5230 by a number of accredited registrars worldwide.
In some countries, the bodies that verify the conformity of management systems to certain standards are referred to as "certification bodies", while in others they are usually referred
to as "registration bodies", "assessment and registration bodies", "certification/registration bodies" and sometimes "registrars".
ISO/IEC 5230 certification, like other ISO management system certifications, typically involves a three-step external audit process defined in ISO/IEC 17021:
·
Stage 1 is a preliminary, informal review of the open source compliance program, verifying, for example, the existence and completeness of key documents
such as the organization's open source policy, clearing process, and staffing. This phase serves to familiarize the auditors with the organization and vice versa.
·
Stage 2 is a more detailed and formal compliance audit, where the open source compliance program is independently audited against the requirements set
out in ISO/IEC 5230. Auditors look for evidence to confirm that the management system has been properly designed and implemented and is actually in operation. Certification audits are usually performed by ISO/IEC 5230 lead auditors. Passing this phase results
in the open source quality program being certified as compliant with ISO/IEC 5230.
Continuous means that follow-up reviews or audits are conducted to confirm that the organization continues to be compliant with the standard. Maintenance of certification requires periodic
re-audits to confirm that the quality open source compliance program continues to function as specified and intended. These should occur at least annually, but are often conducted more frequently (in consultation with management), especially while the Quality
Open Source Compliance Program is still under development. Additionally, ISO/IEC 5230 is functionally identical to OpenChain 2.1, which enables free self-certification via the project's web app.
On October 19, 2020, the Eclipse Foundation announced
that it is the first open source foundation to be certified to ISO/IEC 5230[1].
Several companies, including SAP, Toshiba, Samsung Electronics and LG Electronics have publicly announced their conformance to OpenChain.
·
ISO/IEC 5230:2020-12 Information technology
- OpenChain specification
·
OpenChain official website
·
OpenChain official
translations
·
OpenChain Self Certification
·
Shane
Coughlan: A Recap of the OpenChain Project.
·
OpenChain project on GitHub
Fist version of this article was translated from the article
on German Wikipedia.
On Nov 24, 2022, at 18:17, Vargenau, Marc-Etienne (Nokia - FR/Paris-Saclay) <marc-etienne.vargenau@...> wrote:
Hi,
I have created the article, but it has been moved to the Draft area:
https://en.wikipedia.org/wiki/Draft:ISO/IEC_5230
We need to do some improvement (adding references) before it is published.
I will do my best to have it approved.
Best regards,
Marc-Etienne
From: Shane Coughlan <scoughlan@...>
Sent: Thursday, November 24, 2022 6:38 AM
To: main@...
Cc: Marc-Etienne Vargenau (Nokia) <marc-etienne.vargenau@...>; OpenChain Education <education@...>
Subject: Re: [openchain] OpenChain article in Wikipedia
Hi Stefan
I think it would be super useful, especially because the OpenChain Project is now producing two standards.
Um… team everyone. How about we edit via this email thread?
Shane
Shane Coughlan
OpenChain General Manager
+818040358083
Book a meeting:
https://meetings.hubspot.com/scoughlan
On Nov 22, 2022, at 19:21, Stefan Thanheiser <stefan.thanheiser@...> wrote:
Hi all,
it seems as the German Wikipedia has a different treatment of the terms of “OpenChain” and “ISO/IEC 5230”.
<image001.png> The German Wikipedia will forward you to the “ISO/IEC 5230” page when searching for “OpenChain”…
…in the English, French, Spanish and Italiian Wikipedia, it’s just the other way round.
So there actually is information on the Wikipedia pages – but under different headlines.
Would it be an idea to create two separate articles for “OpenChain” and “ISO/IEC 5230”?
At least it might be good to have a uniform treatment of the search terms in the different language versions…
Regards,
Stefan
Stefan Thanheiser
Atruvia AG
---
Servicefeld Qualität IT-Sicherheit Einkauf,
Tribe Einkauf,
Chapter Software Asset & Lizenzmanagement
---
Telefon +49 721 4004-1860
Mobil +49 170 3304133
E-Mail stefan.thanheiser@...
Atruvia AG | www.atruvia.de
AG Frankfurt a. M. HRB 102381 | Sitz der Gesellschaft: Frankfurt a. M. | USt-IdNr. DE 143582320
Vorstand: Martin Beyer (Vorstandssprecher), Ulrich Coenen (Vorstandssprecher),
Daniela Bücker, Birgit Frohnhoff, Jörg Staff, Ralf Teufel
Vorsitzender des Aufsichtsrats: Jürgen Brinkmann
Von: main@... <main@...> Im Auftrag von Vargenau, Marc-Etienne (Nokia - FR/Paris-Saclay)
Gesendet: Dienstag, 22. November 2022 16:16
An: main@...
Cc: Marc-Etienne Vargenau (Nokia) <marc-etienne.vargenau@...>
Betreff: [openchain] OpenChain article in Wikipedia
Hi,
There is an article about OpenChain in the German Wikipedia:
https://de.wikipedia.org/wiki/ISO/IEC_5230
but in no other language.
I consider it would be good to have an article at least in English.
What do you think?
Best regards,
Marc-Etienne
--
Marc-Etienne Vargenau marc-etienne.vargenau@...
Nokia, Route de Villejust, 91620 NOZAY, FRANCE
Mobile: +33 6 24 49 78 68
Senior Specialist Open Source
Planned absence: none
|
|
Thank you Marc-Etienne! The news item is going live today. Excellent, wonderful work. This really helps our long term outreach.
toggle quoted message
Show quoted text
On Feb 20, 2023, at 19:39, Marc-Etienne Vargenau (Nokia) <marc-etienne.vargenau@...> wrote:
Hi, I have the pleasure to inform you that the OpenChain article has been published in the English Wikipedia. https://en.wikipedia.org/wiki/User_talk:Vargenau#Your_submission_at_Articles_for_creation:_ISO/IEC_5230_has_been_accepted The article: https://en.wikipedia.org/wiki/ISO/IEC_5230 French version: https://fr.wikipedia.org/wiki/OpenChain German version: https://de.wikipedia.org/wiki/ISO/IEC_5230 Feel free to improve the article or translate to other languages. Best regards, Marc-Etienne From: Shane Coughlan <scoughlan@...> Sent: Tuesday, December 13, 2022 1:52 AM To: OpenChain Main <main@...> Cc: OpenChain Education <education@...>; Marc-Etienne Vargenau (Nokia) <marc-etienne.vargenau@...> Subject: Re: [openchain] OpenChain article in Wikipedia Everyone, to help with the creation process I am flagging the text Marc-Etienne has prepared below. The link for editing on Wikipedia is: https://en.wikipedia.org/wiki/Draft:ISO/IEC_5230 == The proposed text for our Wikipedia article for ISO/IEC 5230 == ISO/IEC 5230 is an international standard on the key requirements for a high-quality open source license compliance program. The standard was published jointly by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC) in late 2020. The standard is based on the Linux Foundation OpenChain Specification 2.1. It focuses on software supply chains, easier procurement and license compliance. Organizations that meet the requirements of the standard can self-certify to ISO/IEC 17021, from an accredited certification body or after successfully completing an audit. Contents • 1How the standard works • 2Certification • 3Dissemination • 4External links • 5Source • 6References
How the standard works[edit] Most organizations and software products rely on numerous open source components made by third parties, such as frameworks, libraries and containers, coming from diverse and often unaffiliated sources. This is akin to a supply chain in a brick-and-mortar environment and making sure the supply chain is as reliable as possible is considered important from an operational, legal and security standpoint. Upon this premise, a number of players have decided to establish the ground rules for an organization to deal with open source software at whichever level of the supply chain they operate. A working group under the umbrella of the Linux Foundation, the OpenChain project. Later, when reaching the 2.0 version, the norms were presented for approval as an ISO/IEC standard. According to the standard, in order to use open source components effectively, organization must be aware of and comply with all the components involved, the associated open source licenses, and obligations such as copyleft. ISO/IEC 5230 aims to establish a non-prescriptive common understanding of what needs to be addressed within a quality open source compliance program. This makes ISO/IEC 5230 applicable across many industries and organizations and provides benefits to procurement and software supply chains, as open source software tends to be very cumbersome in legal contracts and procurement. The main topics covered by ISO/IEC 5230 and OpenChain-2.1 are: · Existence of an open source policy · Competencies of program participants (e.g., legal training for specific tasks). · Awareness of open source risks among all program participants · A clearly defined scope, e.g. only specified areas and product lines · Understand and collect licensing obligations for relevant use cases. · Access for external open source requests (e.g. to the OSS authors). · Compliance offices equipped with sufficient resources · Generate a Bill of Material · License compliance process (e.g., documents meeting obligations) · Archiving and provision of compliance artifacts · A guideline for community engagement and contributions ISO/IEC 5230 does not define how exactly most of the tasks are to be performed, such as whether snippet scanning, revalidation of declared open source licenses is required, and what the compliance artifacts should look like. However, it should be noted that SPDX is now an ISO standard (ISO/IEC 5962) and is mentioned in ISO/IEC 5230 as an example of compliance artifacts. Certification[edit] A high-quality open source compliance program can be certified as compliant with ISO/IEC 5230 by a number of accredited registrars worldwide. In some countries, the bodies that verify the conformity of management systems to certain standards are referred to as "certification bodies", while in others they are usually referred to as "registration bodies", "assessment and registration bodies", "certification/registration bodies" and sometimes "registrars". ISO/IEC 5230 certification, like other ISO management system certifications, typically involves a three-step external audit process defined in ISO/IEC 17021: · Stage 1 is a preliminary, informal review of the open source compliance program, verifying, for example, the existence and completeness of key documents such as the organization's open source policy, clearing process, and staffing. This phase serves to familiarize the auditors with the organization and vice versa. · Stage 2 is a more detailed and formal compliance audit, where the open source compliance program is independently audited against the requirements set out in ISO/IEC 5230. Auditors look for evidence to confirm that the management system has been properly designed and implemented and is actually in operation. Certification audits are usually performed by ISO/IEC 5230 lead auditors. Passing this phase results in the open source quality program being certified as compliant with ISO/IEC 5230. Continuous means that follow-up reviews or audits are conducted to confirm that the organization continues to be compliant with the standard. Maintenance of certification requires periodic re-audits to confirm that the quality open source compliance program continues to function as specified and intended. These should occur at least annually, but are often conducted more frequently (in consultation with management), especially while the Quality Open Source Compliance Program is still under development. Additionally, ISO/IEC 5230 is functionally identical to OpenChain 2.1, which enables free self-certification via the project's web app. Dissemination[edit] On October 19, 2020, the Eclipse Foundation announced that it is the first open source foundation to be certified to ISO/IEC 5230[1]. Several companies, including SAP, Toshiba, Samsung Electronics and LG Electronics have publicly announced their conformance to OpenChain. External links[edit] · ISO/IEC 5230:2020-12 Information technology - OpenChain specification · OpenChain official website · OpenChain official translations · OpenChain Self Certification · Shane Coughlan: A Recap of the OpenChain Project. · OpenChain project on GitHub Source[edit] Fist version of this article was translated from the article on German Wikipedia. References[edit] 1. ^ Möbus, Maika (2021-10-20). "Open Source: Eclipse Foundation erreicht OpenChain-Konformität". Heise online. Retrieved 2022-11-24.
On Nov 24, 2022, at 18:17, Vargenau, Marc-Etienne (Nokia - FR/Paris-Saclay) <marc-etienne.vargenau@...> wrote:
Hi, I have created the article, but it has been moved to the Draft area: https://en.wikipedia.org/wiki/Draft:ISO/IEC_5230 We need to do some improvement (adding references) before it is published. I will do my best to have it approved. Best regards, Marc-Etienne From: Shane Coughlan <scoughlan@...> Sent: Thursday, November 24, 2022 6:38 AM To: main@... Cc: Marc-Etienne Vargenau (Nokia) <marc-etienne.vargenau@...>; OpenChain Education <education@...> Subject: Re: [openchain] OpenChain article in Wikipedia Hi Stefan I think it would be super useful, especially because the OpenChain Project is now producing two standards. Um… team everyone. How about we edit via this email thread? Shane Shane Coughlan OpenChain General Manager +818040358083 Book a meeting: https://meetings.hubspot.com/scoughlan
On Nov 22, 2022, at 19:21, Stefan Thanheiser <stefan.thanheiser@...> wrote: Hi all, it seems as the German Wikipedia has a different treatment of the terms of “OpenChain” and “ISO/IEC 5230”. <image001.png> The German Wikipedia will forward you to the “ISO/IEC 5230” page when searching for “OpenChain”… …in the English, French, Spanish and Italiian Wikipedia, it’s just the other way round. So there actually is information on the Wikipedia pages – but under different headlines. Would it be an idea to create two separate articles for “OpenChain” and “ISO/IEC 5230”? At least it might be good to have a uniform treatment of the search terms in the different language versions… Regards, Stefan Stefan Thanheiser Atruvia AG --- Servicefeld Qualität IT-Sicherheit Einkauf, Tribe Einkauf, Chapter Software Asset & Lizenzmanagement --- Telefon +49 721 4004-1860 Mobil +49 170 3304133 E-Mail stefan.thanheiser@... Atruvia AG | www.atruvia.de AG Frankfurt a. M. HRB 102381 | Sitz der Gesellschaft: Frankfurt a. M. | USt-IdNr. DE 143582320 Vorstand: Martin Beyer (Vorstandssprecher), Ulrich Coenen (Vorstandssprecher), Daniela Bücker, Birgit Frohnhoff, Jörg Staff, Ralf Teufel Vorsitzender des Aufsichtsrats: Jürgen Brinkmann Von: main@... <main@...> Im Auftrag von Vargenau, Marc-Etienne (Nokia - FR/Paris-Saclay) Gesendet: Dienstag, 22. November 2022 16:16 An: main@... Cc: Marc-Etienne Vargenau (Nokia) <marc-etienne.vargenau@...> Betreff: [openchain] OpenChain article in Wikipedia Hi, There is an article about OpenChain in the German Wikipedia: https://de.wikipedia.org/wiki/ISO/IEC_5230 but in no other language. I consider it would be good to have an article at least in English. What do you think? Best regards, Marc-Etienne -- Marc-Etienne Vargenau marc-etienne.vargenau@... Nokia, Route de Villejust, 91620 NOZAY, FRANCE Mobile: +33 6 24 49 78 68 Senior Specialist Open Source Planned absence: none
|
|