跳到主要內容

How OpenChain can transform the supply chain


The OpenChain Project's open source compliance standards aim to make supply chains simpler, faster, safer, and more efficient.

OpenChain is all about increasing open source compliance in the supply chain. This issue, which many people initially dismiss as a legal concern or a low priority, is actually tied to making sure that open source is as useful and frictionless as possible. In a nutshell, because open source is about the use of third-party code, compliance is the nexus where equality of access, safety of use, and reduction of risk can be found. OpenChain accomplishes this by building trust between organizations.

Many companies today understand open source and act as major supporters of open source development; however, addressing open source license compliance in a systematic, industry-wide manner has proven to be a somewhat elusive challenge. The global IT market has not seen a significant reduction in the number of open source compliance issues in areas such as consumer electronics over the past decade.

The majority of compliance issues originate in the midst of sharing multiple hardware and software components across numerous entities. The global supply chain is long and the participants are simultaneously intertwined and disparate. It is possible to have companies making hardware, companies making software, and companies doing both, all collaborating around a relatively small component. The products that result are often outstanding, but the challenge of keeping track of everything is substantial.

Complexities of supply change compliance

Open source presents a specific challenge in the global supply chain. This is not because open source is inherently complex, but because of companies' varying degrees of exposure and domain knowledge. By way of example, the staff of a company developing a small component that requires a device driver may be entirely unfamiliar with open source. One mistake, one misunderstanding, and one component deployed in dozens of devices can present problems. Most compliance challenges arise from mistakes. Few, if any, originate with intent.

Ultimately, solving open source compliance challenges involves solving open source compliance in the supply chain. This is no small task: There are thousands of companies in play across dozens of national borders using numerous languages. Because no single company makes a finished device, no single company can solve the compliance challenges. Therefore, the global supply chain must align behind certain shared approaches.

Compliance is not a device or code issue. It is a process challenge that spans multiple organizations.Awareness of this fact and the provision of a practical solution are two different matters. It takes time for ideas and suggested approaches to percolate and mature. It takes input from lawyers and managers and developers and political scientists. It takes, in short, a while for a community to bounce ideas back and forth until a simple, clear approach can be found. This is how the OpenChain Project came to be.
The OpenChain Project

The OpenChain Project, hosted by The Linux Foundation, is intended to make open source license compliance more predictable, understandable, and efficient for the software supply chain. Formally launched in October 2016, the OpenChain Project started three years earlier with discussions that continued at an increasing pace until a formal project was born. The basic idea was simple: Identify recommended processes for effective open source management. The goal was equally clear: Reduce bottlenecks and risk when using third-party code to make open source license compliance simple and consistent across the supply chain. The key was to pull things together in a manner that balanced comprehensiveness, broad applicability, and real-world usability.

OpenChain conformance

There are three interconnected part to the OpenChain Project:

        • a Specification that defines the core requirements of a quality compliance program,
        • a Conformance method that helps organizations display adherence to these requirements, and
        • a Curriculum to provide basic open source processes and best practices.
The core of the project is the Specification. This identifies a series of processes that help ensure organizations of any size can effectively address open source compliance issues. The main goal of organizations using the OpenChain Specification is to become conformant; that is, to meet the requirements of a certain version of the OpenChain Specification. A conformant organization can advertise this fact on its website and promotional material, which enables potential suppliers and customers to understand and trust its approach to open source compliance.

OpenChain Conformance can be easily checked via a free, online self-certification questionnaire. This is the quickest, easiest, and most effective way to check and confirm adherence to the OpenChain Specification. There is also a manual conformance document available for organizations whose process requires a paper review or disallows web-based submissions. Either online or manual conformance can be completed at a pace decided by the conforming organization, and both methods remain private until a submission is completed.

The OpenChain Curriculum helps organizations meet the training and process requirements of the OpenChain Specification. It provides a generic, refined, and clear example of an open source compliance training program that can either be used directly or incorporated into existing training programs. It can also be applied to various processes for managing open source inside an organization. The OpenChain Curriculum is available with very few restrictions to ensure organizations can use it in as many ways as possible. It is licensed as CC-0, effectively public domain, so it can be remixed or shared freely for any purpose.

A strong backing community

The OpenChain Project provides a compelling approach to making open source compliance more consistent and more effective across multiple market segments. However, good ideas need implementation, and in open source this inevitably hinges on a supporting community. Fourteen Platinum Members currently support the OpenChain Project's development and adoption: Adobe, ARM, Cisco, Comcast, GitHub, Harman, Hitachi, HPE, Qualcomm, Siemens, Sony, Toyota, Western Digital, and Wind River. There is also a wide community of almost 200 participants on the main mailing list that listen, share, and remix ideas.

At its core, the OpenChain Project is about providing a simple, clear method of building trust between organizations that rely on each other to share code and create products. Any organization that is OpenChain Conformant is aligning behind key requirements that its peers agree are required in a quality compliance program. It is about confirming overarching processes and policies, while allowing the specifics of each process and policy to be crafted by each organization to suit its specific needs.

The OpenChain Specification is at version 1.2 and is ready for adoption by any organization that creates, uses, or distributes open source code. The online conformance is free of charge, and the mailing list and work team calls are open to everyone. This is the first time there has been a single, unifying approach to addressing the challenge of open source compliance in the supply chain, and it has the potential to be truly transformative for the industry.

https://www.openchainproject.org

留言

這個網誌中的熱門文章

COSCUP 2024 徵稿辦法 / COSCUP 2024 Call for Proposals

COSCUP 2024 Call for Proposals: Until 9th, May Submit Your Proposals HERE! 今年 COSCUP 一如往常,徵求各式各樣不同的 Open Source 相關稿件。請於 05 月 09 日(AoE) 前投稿,徵稿主題可參考本頁下方各議程軌資訊。 請注意,每場議程長度預設為 30 分鐘 ,惟部分議程軌開放其他議程長度,會在報名表單第二頁選填。 為了增添 COSCUP 的國際能見度,今年所有入選稿件希望都可以提供中英文版雙語資訊。徵稿階段,您可先以自己偏好的語言準備演講或撰寫 CfP 稿件。 提醒您,COSCUP 是一個倡導開放的研討會,所有演講將錄影並以創用 YouTube CC 姓名標示-相同方式分享 4.0 釋出。如果您的演講有任何不能錄影或不願以此條款釋出的狀況,請務必於投稿表單上註明。 We are looking for talks in several open-source related areas, please submit your proposal before May 09th, 2024 (AoE, Anywhere on Earth) . The theme for submissions can be referenced from the information on various tracks at the bottom of this page. Please note that the length of each agenda is preset to 30 minutes, only the specific tracks are open to other agenda lengths for selection, which will be filled in on the second page of the registration form. To make it more accessible for international audiences, we kindly request CFP information to be provided in both Chinese and

COSCUP Booth now release/社群攤位錄取名單正式公布啦

COSCUP Booth now release. See which community you can meet on COSCUP 2024.  Community Booth:  Wikimedia Taiwan  COSCUP Volunteers  Medical Image Standards Association of Taiwan  Google Developer Party  HKCOTA x HKOSCon  Open Culture Foundation  Kubernetes Community Day Taipei  Ruby Taiwan  sciwork  Taipei Ethereum Meetup  JVM Assembly Hall  開源香港 + PyCon Hong Kong  PyCon TW   Items provided  One table (180 x 60 cm), with two chairs. Tables might probably share with other communities if necessary.  At least ONE 110V AC socket (Total power consumption mustn’t exceed 550W), bring an own power strip if it is needed.  Further information would be provided if applicants are adopted. Any questions, please contact program@coscup.org  社群攤位錄取名單正式公布啦~ 快來看看有哪些社群參與!  社群攤位:  台灣維基媒體協會  COSCUP 行政組 - 志工服務台  社團法人台灣醫療影像資訊標準協會  Google 開發者派對  HKCOTA x 香港開源年會  OCF 開放文化基金會  Kubernetes Community Day Taipei  Ruby Taiwan  sciwork  Taipei Ethereum Meetup  JVM 集會所  Open Source Hong Kong x PyCON Hong Ko

COSCUP 2024 Call for Participation 議程軌與攤位即日起開放申請

COSCUP 2024 Call for Participation, 議程軌與攤位即日起開放申請 COSCUP 2024 的社群議程/攤位即日起開始接受申請,社群議程於 3 月 17 日截止申請,社群攤位於 6 月 3 號截止。請有興趣在今年與我們共襄盛舉的社群把握機會! 點此快速報名 / Quick Apply 點此跳到社群攤位 Jump to Community Track English Ver. Jump to Community Booth English Ver. 社群議程 Community Room COSCUP 2024 社群議程提供場地與行政協助,您可以在此舉辦一整天關於特定開源議題的討論、座談、工作坊等。 特色包括: 自訂議程時長:各社群可以自己決定每段議程的時間,無論 15 分鐘、30 分鐘、45 分鐘,甚至直接開設數個小時的工作坊都可以。 自訂休息時間:各社群可以決定是否有休息時間,或是連番上陣。 What's new in COSCUP 2024 今年 COSCUP 有一些新的合作注意事項,歡迎欲報名的社群夥伴們確認,報名即視為貴社群同意今年度的合作注意事項 COSCUP 歡迎社群夥伴宣傳、分享社群在 COSCUP 的活動相關資訊,包含且不限於規劃獨立報名系統、架設宣傳活動網頁,或是使用票卷系統等,惟須請在相關管道中註明合作夥伴為 COSCUP 團隊。且秉持 COSCUP 精神,所有以 COSCUP 名義相關的活動,請避免限定會眾參與身分,若因特殊原因需限定參與身分,請與議程組聯絡與討論。 申請加入 COSUCP 的夥伴將視為同意大會 CoC準則,敬請夥伴們一同宣導大會 CoC ,為會眾創造尊重與友善的活動 更多社群合作準則,請參考 本文件,報名即視為同意本文件所提到的各項注意事項 Changes in COSCUP 2024 今年 COSCUP 將基於 20