OpenChain, SPDX and FOSSology
Download as PPTX, PDF0 likes716 views
The document discusses the challenges of open source license compliance and the collaborative efforts being made through initiatives like OpenChain and SPDX to create a standardized process for managing licensing data. It emphasizes the importance of having a common language and tools to facilitate better compliance with less effort in the software supply chain. Various upcoming sessions and opportunities for involvement in these initiatives are also mentioned.
OpenChain, SPDX and FOSSology
- 2. OpenChain, SPDX, FOSSology Jilayne Lovejoy, Principal Open Source Counsel, ARM
- 3. We’ve come a long way, but ... Open source license compliance is still a challenge • Source code shared between projects to enable rapid development of new features • Product companies may have different focus than open source developers • Licensing focused on after development • So. Much. Open Source Software!
- 4. How we can ease the pain... via collaborative efforts in open source compliance • Common process for managing licensing data • Common language to communicate licensing data • Open source tools to generated licensing data summaries
- 5. A software supply chain where FOSS is delivered with trusted and consistent compliance information
- 7. PLATINUM MEMBERS & GOVERNING BOARD
- 8. How to get involved • By Leveraging the SPDX, OpenChain and Hyperledger Initiatives, We Can Solve the Open Source Management Supply Chain Puzzle, Mark Gisi & Sameer Ahmed, Wind River • Tuesday, 2:00-12:30, Monument Peak • OpenChain for Projects and SMEs, Jonas Öberg, FSFE • Tuesday, 4:50-5:20, Grand Sierra C/D • OpenChain working group • Wednesday, 2:00-5:00 Castle Peak B Join the general or curriculum mailing list (or both!), attend calls https://www.openchainproject.org/community 8
- 9. Software Package Data Exchange 9
- 10. What is SPDX? Standard: • A standard format for communicating the licenses and copyrights associated with software packages Guiding principles: • Human and machine readable • Focus on capturing facts; avoid interpretations Vision: • To help reduce redundant work in determining software license information and facilitate compliance 10
- 11. (Part of the) Solution A file format for license information to accompany open source packages Benefits • Allows easy exchange of license information between companies reducing burden on both suppliers and consumers • Avoids due diligence redundancy where the same source code package is analyzed multiple times by different receivers • Ultimately yields better compliance with less effort 11
- 12. SPDX Specification License List Tools
- 13. Package Information SPDX v2.0 Document contains: Document Creation Information Package Information Other Licensing InformationOther Licensing Information Other Licensing InformationFile Information Other Licensing Information Annotations Other Licensing InformationRelationships An SPDX Doc Version 2.1 13
- 14. Document Creation Information 2.1 SPDX Version. 2.2 Data License 2.3 SPDX Identifier 2.4 Document Name 2.5 SPDX Document Namespace 2.8 Creator 2.9 Created Provide an SPDX document 14 Package Information 3.1 Package Name 3.2 Package SPDX Identifier 3.7 Package Download Location 3.8 Package Verification Code 3.12 Concluded License 3.13 All Licenses Information from Files 3.14 Declared License 3.16 Copyright Text File Information 4.1 File Name 4.2 File SPDX Identifier 4.4 File Checksum 4.5 Concluded License 4.6 License Information in File 4.8 Copyright Text 1 per document 1 per package in document 1 per file in each package
- 15. License List ~300 Licenses • Short IDs for easy reference • Exact text of licenses • Available on SPDX® website – URLs won’t change License Matching Guidelines • For matching licenses against those included on the SPDX License List License Templates • Denote license text which is optional or replaceable per the license matching guidelines Exceptions List • Common modifications to some licenses • Simple expression language for expressing Actively maintained by SPDX Legal Team 15
- 16. How to get involved SPDX Generation via Yocto and the New LID code License Scanner, Mark Charlebois & Craig Northway, Qualcomm Technologies • Tuesday, 11:20-11:50, Monument Peak From EXIF to SPDX: How Persistent Metadata is Changing the World, Jonas Öberg, Free Software Foundation Europe • Tuesday, 3:30-4:00, Grand Sierra C/D SPDX working group • Thursday, 11-4, Castle Peak B Join the technical, outreach or legal team to contribute to the spec, tools, documentation and presentations, license list and related work https://spdx.org/participate
- 17. 19
- 18. An open source license system and toolkit. • Run license copyright and export control scans • Database and web UI provide a compliance workflow • Generate reports 20 Page 20
- 19. FOSSology: handing compliance tasks 21 Generate ▪ Upload an open source package to the server ▪ Select scan agents to analyze the software ▪ Review the licenses detected that scanners have found ▪ Compare and correct findings if necessary ▪ Generate report output ▪ SPDX (both formats: tag value and RDF) ▪ Spreadsheet of license information ▪ Set of File Notices applicable ▪ Export Control Information
- 20. Current version info • 3.1 info as to newest features • Who is involved • What CP is shipping/the product • How is the CP changing the world/creating bigger outcomes • How to get involved 22 Page 22
- 21. FOSSology Community 23 and more to be added …
- 22. FOSSology Project Information ▪ Making Compliance Easy: Filling in the Missing Pieces, Kate Stewart, The Linux Foundation ▪ Wednesday, 2:40-3:10, Monument Peak ▪ SW360 - An Open Component Hub, Steffen Evers, Bosch Software Innovations ▪ Wednesday, 3:20-3:50, Grand Sierra B Contribute code, ideas, documentation, testing https://www.fossology.org/about/support-fossology 24
- 23. Bringing it all together • Common language to communicate licensing data • Open source tools to generated licensing data summaries • Transparency of software licensing data • Keep licensing data current with every change or update • Common process for managing licensing data • Adoption in key projects, distributions, repositories
- 24. Bringing it all togetherStatus Goal How? Common language to communicate licensing data SPDX Open Source tools to generate licensing data summaries FOSSology, SPDX-tools Transparency of software’s licensing data ? Keep licensing data current with every source change ? Common processes to pass licensing data with OpenChain