Quarterly OpenChain Partner Summit Today (Monday) @ 07:00 UTC / 00:00 PST / 08:00 BST / 09:00 CEST / 12:30 IST / 15:00 CST / 16:00 KST / 16:00 JST. Two hours of talks, panels and roundtables covering key items in the OpenChain ISO 5230 vendor ecosystem. No registration or fee to attend.

The OpenChain Q2 Mini-Summit will be held on the 14th of June at 14:00 UTC / 07:00 PST / 15:00 BST / 16:00 CEST / 19:30 IST / 22:00 CST / 23:00 KST / 23:00 JST.

This three-hour event will have two live collaboration sessions.

We will open with one hour for the OpenChain education work team. The focus will be on final review of the online course and a discussion of what education work we should do next. This will be lead by Balakrisha, chair of the education work team.

We will continue with a two hour live-editing session for the OpenChain ISO 5230 security usage reference document. The goal will be to have an output that can be immediately used by our community regarding application of OpenChain ISO 5230 in security contexts. This discussion will be lead by Mark, chair of the specification work team.

Everyone is welcome to the event and encouraged to attend. There is no registration or fee to access. Your thoughts and requests for additional activities during the event are also welcome.

Dial in:
https://us02web.zoom.us/j/9990120120?pwd=NzVCaFE2L1RRRFZaSkk0dm8xdlplUT09

Dear all

It is time to explore the results of our Q1 survey! Attached is the full document. Let’s check out the highlights:

(1) Engagement and satisfaction is rated as very good or (more frequently) excellent across the board. The vast majority of respondents believe that we are “Very Good” or “Excellent” in putting forward what we are doing and sharing our information – either the business value, conformance, reference materials, and our website. Most importantly, people see us as a community that is easy to engage with and easy to get help from.

(2) Our conformance response revealed something interesting. About half of our respondents are primarily interested in something other than a private health of their compliance program or being listed publicly as having an OpenChain conformant program.This is worth digging into more (and we will), but some preliminary notes are:
(i) Feedback indicates that a relatively small percentage are seeking public announcements regarding conformance at this juncture, regardless of internal compliance activities. Their focus is instead on internal (or inter-supply chain) improvements and conformance.
(ii) We additionally have a number of companies engaging with OpenChain ISO 5230 with applications outside of our core scope of conformance for the purpose of license compliance. These include entities engaging for activities related to security, mergers and acquisitions, and other business processes. We knew this from participants on our calls and so on, but it’s interesting how many of our community participants appear to fit into this demographic.

(3) About a third of respondents have used our online conformance web app, and those that have found it excellent in its ease of use, while about a third of respondents are not interested in getting more help conforming with OpenChain ISO 5230:2020 in the future. From other sources we have indications that this is due to two factors:
(i) People are using the specification directly for conformance or using our downloadable questionnaire.
(ii) People are getting assistance from third parties such as participants in our partner program.

(4) We asked broader questions in the survey than those related only to OpenChain. For example, we asked about tooling, software bill of materials and interoperability. The interoperability questions were framed around determining what is important to the community in the context of open source license compliance and interoperability around Software Bill of Materials and/or automation. Respondents overwhelmingly expressed interest in greater interoperability for all tools and automation. This means supporting ingest and export of SPDX. It means greater interoperability between open source tooling as well as between open source and proprietary tooling.

Now we know what people want, it is time to make it happen.

You can expect the project as a whole to lean into supporting to diverse use-cases for OpenChain ISO 5230. You can expect the tooling group to lean into the interoperability question.

And…you are the community. Let’s get started!

Regards

Shane

The OpenChain Telco Work Group is off to a strong start. This includes a new mailing list for those interested. Sign up here:
https://lists.openchainproject.org/g/telco

Catch up: Telco Work Group Meeting #1– Recording:
https://www.openchainproject.org/news/2021/05/13/openchain-telco-work-group-meeting-1-2021-05-06-full-recording

Dear all

We are under a coordinated automated attack against our self-certification web app. Over 57,000 false accounts were created in a matter of a few hours in an attempt to take down the system. Thanks to the quick thinking of Gary, the brunt of this attack has been mitigated. However, there are a few consequences:
(1) Access to the self-certification web app is disabled for non-registered users
(2) Our May quota of emails sent by the service for May has been used
(3) We are still digging into how to harden the service and ensure full return

If you can assist, that would be much appreciated. Gary is heading into vacation and will be offline until Mid-May. While we are calling in LF Technical to assist, a community member familiar with AWS would be of incredible use to us right now.

My apologies for the interruption. As Gary noted, the attack was planned out and beyond a typical “script kiddie” event. We have no idea why and we have yet to isolate and report the computer(s) involved. Once we do, they will be reported to law enforcement in the relevant jurisdiction.

Regards

Shane

—
Shane Coughlan
General Manager, OpenChain
e: scoughlan@...
p: +81 (0) 80 4035 8083
w: www.linuxfoundation.org

Schedule a call:
https://meetings.hubspot.com/scoughlan

Greetings all! Our webinar starts in ten minutes. Look forward to seeing you there.

Our regular bi-weekly webinar takes place at 14:00 UTC.

We have two speakers on two important topics:
Andreas Kotulla from Bitsea on Linux license clean-up disorder dispelled
Reza Alavi from Wipro on OpenChain ISO 5230 in the Context of Security

OpenChain Bi-Weekly Webinar at 14:00 UTC Today

• Join Zoom Meeting ( https://us02web.zoom.us/j/9990120120?pwd=NzVCaFE2L1RRRFZaSkk0dm8xdlplUT09 )

Meeting ID: 999 012 0120
Password: 123456

One Tap Telephone (no screensharing)

• +358 9 4245 1488,,9990120120# Finland

• +33 7 5678 4048,,9990120120# France

• +49 69 7104 9922,,9990120120# Germany

• +852 5808 6088,,9990120120# Hong Kong

• +39 069 480 6488,,9990120120# Italy

• +353 6 163 9031,,9990120120# Ireland

• +81 524 564 439,,9990120120# Japan

• +82 2 6105 4111,,9990120120# Korea

• +34 917 873 431,,9990120120# Spain

• +46 850 539 728,,9990120120# Sweden

• +41 43 210 71 08,,9990120120# Switzerland

• +44 330 088 5830,,9990120120# UK

• +16699006833,,9990120120# US (San Jose)

• +12532158782,,9990120120# US

Find your local number: https://zoom.us/u/abeUqy3kYQ
Not all countries have available numbers.

After dialing the local number enter 9990120120#

We have created a single, simple supplier education pack for open source license compliance. Get it from our website and enjoy a "one email" solution to aligning your supply chain around ISO 5230, the International Standard for compliance:
https://www.openchainproject.org/

If you have not already done so, please help us capture the current state of OpenChain and the broader open source compliance community via our Q1 survey. It’s about to close!
https://forms.gle/BHC9Z9qM16ukDWun9

Shane Coughlan
OpenChain General Manager
+818040358083
Book a meeting:
https://meetings.hubspot.com/scoughlan

Dear all

Please see details below:

Join Zoom Meeting

https://zoom.us/j/98647515621?pwd=bE42c0sxZmpURlFEMnNabTBQZlRDUT09

Meeting ID: 986 4751 5621

Passcode: 592899

Marie, can you send me the dial in details? I did not receive a mail with the final access link.

Dear all

Here is the agenda for the next OpenChain UK Work Group meeting, taking place via Zoom on Thursday 25 March from 14:00 – 15:30 GMT.

The meeting will be an interactive session with plenty of opportunity to ask questions and discuss OpenChain adoption and best practice.

Agenda

We have a full agenda planned with a fantastic line-up of speakers:

14:00: Welcome and introduction by Andrew Katz (Orcro) & Sami Atabani (Arm)
14:05: News and Updates by Andrew Katz, Sami Atabani & Shane Coughlan
14:30: Any other news from people present
14:45: Open source compliance for containers by Armijn Hemel
15:15: Q&As
15:25: AOB
15:30: Thank you and Goodbye

To register your attendance and receive the Zoom login details, please complete the Eventbrite booking form.

The OpenChain meeting in 20 minutes (14:00 UTC) will be heading straight into super practical territory. You get 30 minutes from the reference tooling workgroup expanding on an example automation workflow, and you get 15 minutes each on "How to approach the “legal solver” topic” and "Protecting Your IP from Devaluation via OpenChain Compliance” by two of our partners. Join for free and without registration.
https://us02web.zoom.us/j/9990120120?pwd=NzVCaFE2L1RRRFZaSkk0dm8xdlplUT09

We have a busy schedule of work group meetings this month. Here are the highlights:

OpenChain Korea Work Group - 14:00 KST March 11th

OpenChain Japan Work Group - 14:00 JST March 17th

OpenChain Automotive Q1 Meeting - 14:00 UTC March 18th

OpenChain Taiwan Work Group - 14:00 CST March 19th

OpenChain UK Work Group - 14:00 UTC March 25th

You can check out the details, including dial in, via our Global Calendar:
https://calendar.google.com/calendar/embed?src=c_08seb6095ofjtfr5fjb5tabgl4%40group.calendar.google.com&ctz=Asia%2FTokyo

iCal format:
https://calendar.google.com/calendar/ical/c_08seb6095ofjtfr5fjb5tabgl4%40group.calendar.google.com/public/basic.ics

The OpenChain Global Calendar is one click to join from this page:
https://www.openchainproject.org/community
Click “+ Google Calendar” to add this calendar to your computer/phone/tablet.

OpenChain Mini-Summit is coming soon! Date & Times: March 10th 7 am PST  / 3 pm UTC /  3 pm GMT / 4 pm CET / 8:30 pm IST / 11 pm Taiwan / 11 pm CST  / 12 am (March 11th) KST / 12 am (March 11th) JST Agenda:  First Hour: Specification editing with focus on optional security extension to ISO 5230. This will take the form of an explanatory document illustrating OpenChain usage in this context. Second Hour: Education editing with focus on finalizing submission for LF training to turn into the OpenChain online course. Third Hour: Automation review, to provide a summary of the experience and knowledge gained from the OpenChain reference tooling work group, and to identity the “pain points” for interoperability between open source tooling for open source compliance. Location: Event will be held on Zoom: Meeting ID: 999 012 0120 Password: 123456

On the talk today we will be covering a lot

1) OpenChain online training status

2) New onboarding slides

3) Updated overview slides

I would also like to talk about an optional security extension to ISO 5230 (a guide document rather than a specification).

Looking forward to seeing you there.

Shane

Shane Coughlan
OpenChain General Manager
+818040358083
Book a meeting:
https://meetings.hubspot.com/scoughlan