The Eventbrite booking form for the next OpenChain UK Workgroup meeting, taking place on 26th January 2023 is now live.

Date: 26th January 2023 

Time: 15:00 – 17:00 UTC

Venue: Both virtual and physical. You can select your preference on the booking form.

The physical meeting will take place at the offices of Analog Devices in Hayes, West London (near Heathrow) at the Old Vinyl Factory, 5 Pressing Lane, Hayes UB3 1EP. 

Many thanks to Steve Kilbane for making the space available for us at his company’s offices. 

To confirm your place either in person or virtually so that we can guage numbers, please complete the Eventbrite booking form.

Hi,

The Eventbrite booking form for the next OpenChain UK Workgroup meeting, taking place on 26th January 2023 is now live.

Date: 26th January 2023 

Time: 15:00 - 17:00

Venue: Both virtual and physical. You can select your preference on the booking form.

The physical meeting will take place at the offices of Analog Devices in Hayes, West London (near Heathrow) at the Old Vinyl Factory, 5 Pressing Lane, Hayes UB3 1EP. 

Many thanks to Steve Kilbane for making the space available for us at his company's offices. 

To confirm your place either in person or virtually so that we can guage numbers, please complete the Eventbrite booking form.

Hi All 

Happy New Year!

We’re delighted to announce that the next meeting of the OpenChain UK workgroup will take place on 26th January 2023 at 3pm at the offices of Analog Devices in Hayes, West London (near Heathrow) at the Old Vinyl Factory, 5 Pressing Lane, Hayes, UB3 1EP. Many thanks to Steve Kilbane for making the space available for us at his company’s offices. The meeting will also be available to join virtually.  We have scheduled 2 hours from 3pm to 5pm. 

We’re planning on launching an exciting new initiative. Since meeting at the OpenSource Summit in Dublin back in September last year, it's becoming clear that it would be helpful to the OpenChain community at large to produce some end-to-end reference materials showing how example real world projects can be developed, built and distributed in a compliant way, and how compliance artefacts can be generated for the project which ensure that on deployment, all the relevant materials are made available.

The idea is to move away from abstract questions to concrete examples of a project, covering the tooling actually used, the compliance artifacts actually generated, and how they are actually made available to recipients of the code.

Ideally, we’d like to create a reference for a number of projects, distributed in the following different ways:

• Standard app-on-a-desktop-or-server
• Distribution through an app store
• Distribution in a container
• Distribution in an embedded system
• Distribution through a third party (e.g. supplier provides software to a customer as a binary, which is then embedded into a device and distributed to the end user, requiring different compliance artifacts). 

We will use this as an opportunity to demonstrate good practice (or best practice), so compliance artifacts should be machine readable, for example, and, where appropriate, comply with SPDX standards (https://spdx.dev/), and repos which are made available could also, where appropriate, comply with REUSE standards https://reuse.software/). 

This is a pretty ambitious task, so we suggest that we start with a reasonably straightforward project (distribution of a standard desktop app: the list above is in a rough order of complexity, easiest first). We can also, as mini-projects with easily attainable goals, take a simple repo, and issue pull requests with the aim of bringing it into compliance.

We’ve already started working on this behind the scenes and want to present our thoughts at the meeting. 

As a project which is complementary to this, Yogesh Despande from ARM will demonstrate how ARM has have been working alongside Google in increasing transparency in the compliance process for firmware development. 

In addition, Martin Yagi has been working on some great training materials including bitesize training videos and you can see an example of his work here:

https://drive.google.com/file/d/1Px8Ffs_sTmNWKWvCAObRDJ_VL1Tl43yN/view?usp=sharing

He will provide some more information on the history of this initiative, his plans for the future, and how the OpenChain UK community could get involved. 

We can also give you news about the next meeting to follow later in the year.  David Buckhurst from the BBC who has been kind enough to offer us space for our second meeting of the year at the BBC at Media City in Salford. This one is provisionally set for 28th March, and further details will follow. 

As you can see, we have some great activity going on, the launch of some excellent initiatives and exciting potential for 2023!

We’ll be sending more information shortly about the meeting on 26th January, together with an Eventbrite invitation so that we can gauge numbers (virtually and in person). Save the date!

All the best

Andrew

The annual OpenChain Advent Calendar is now out! It is the 4th year of our calendar and our 100th article will be published on Christmas Day, the 25th of December 2022. Following advent tradition, the articles will be revealed daily, and then it is time for us to take a break, eat nice food, and watch our favorite movies.

This calendar is maintained by our Japan Work Group and lead by Watanabe San from Hitachi Solutions with help from Fukuchi San of Sony and many more. You can access it at this link:
https://qiita.com/advent-calendar/2022/openchainjapanwg

Do you want to jump to the first article? Sure! It is from Shane Coughlan, OpenChain General Manager, and is available in both English and Japanese. Watanabe San created the Japanese translation:
https://qiita.com/AyumiWatanabe/items/832146867fde6560f2d1

OpenChain JWG Advent Calendar初日のShaneからの
メッセージは大変力強いものでした。
是非多くの方に読んで頂ければと思います。

アドベントカレンダー：
https://qiita.com/advent-calendar/2022/openchainjapanwg

Shaneのメッセージ：
https://qiita.com/AyumiWatanabe/items/832146867fde6560f2d1

「さまざまなオープンソースのプロセス管理の課題を
抱えるすべての組織が、コミュニティによってシェア
されたソリューションを見つけられるようにしたいと
考えています。
多くの参考資料のメンテナンスを継続し、ピアサポート
(仲間同士の助け合い)を提供するため、時にローカル
言語で運営される、大規模なグローバルコミュニティの
活動を継続していきます。」

On Oct 20, 2022, at 17:17, Steve Kilbane <stephen.kilbane@...> wrote:
• At the OpenChain day at the Open Source Summit in Dublin, Andrew asked whether the community could provide reference implementations of compliance as examples. My garbled notes of the day were just a single line of text for this, but I’m interpreting it as (for example) simple projects on GitHub with the associated metadata or config files to tie in with tooling, and resulting outcomes. Or perhaps appropriate SPDX declarations in source files. I dunno – I figure “community could provide examples” is sufficient to warrant some discussion.

• Would it make sense to have a community-led project to improve the compliance stance of popular open-source projects? By this, I mean coordinating the submission of PRs to projects , where the PR (for example) adds SPDX-License identifiers, or makes the project conform to REUSE guidelines or adds configurations for OSS tooling for scanning, or whatever else makes sense that would make it easier to clear the project in a compliance toolchain later?

• SBOM distribution methods – especially when the software distribution is embedded.
I recognise that these are not UK-specific, but figure that need not be a barrier.

On 19 Oct 2022, at 15:12, Shane Coughlan <scoughlan@...> wrote:

Hi Steve

On Oct 19, 2022, at 14:16, Steve Kilbane <stephen.kilbane@...> wrote:

The UK OpenChain workgroup had a meeting last week, and there was a lot of great info passed on about what’s been going on in the OpenChain project worldwide over the past few months. There was also some fascinating and thoughtful commentary on the current landscape from Andrew. Perhaps it was the format of the Zoom session, but it seemed to be very much a one-directional session, and it made me wonder what the UK workgroup is up to, right now. Are there specific activities in progress? Are there UK-specific issues under consideration, or that orgs are running into, of which the UK workgroup is aware?

With the publication of OpenChain as an ISO/IEC standard, there’s been a lot of adoption over the past couple of years, so it’s possible that there are people who are new to the UK mailing list too. If so, like me, they might benefit from a better understanding of what the UK workgroup is up to, presently.

I think that, towards the end of the session, Andrew and Sami were asking for suggested topics to address, and presumably this mailing list would be the place to make suggestions.

Thank you for you this!

I think fostering a round-table discussion format would be an excellent evolution, and the sharing of knowledge from the UK market - and ensuring it goes outward - could be really useful.

How about at the next meeting with focus on having a couple of specific items for workshopping, designed explicitly for interactive discussion?

Regards

Shane

On Oct 19, 2022, at 14:16, Steve Kilbane <stephen.kilbane@...> wrote:
The UK OpenChain workgroup had a meeting last week, and there was a lot of great info passed on about what’s been going on in the OpenChain project worldwide over the past few months. There was also some fascinating and thoughtful commentary on the current landscape from Andrew. Perhaps it was the format of the Zoom session, but it seemed to be very much a one-directional session, and it made me wonder what the UK workgroup is up to, right now. Are there specific activities in progress? Are there UK-specific issues under consideration, or that orgs are running into, of which the UK workgroup is aware?
With the publication of OpenChain as an ISO/IEC standard, there’s been a lot of adoption over the past couple of years, so it’s possible that there are people who are new to the UK mailing list too. If so, like me, they might benefit from a better understanding of what the UK workgroup is up to, presently.
I think that, towards the end of the session, Andrew and Sami were asking for suggested topics to address, and presumably this mailing list would be the place to make suggestions.