Jeff McAffer

The days of having only a few open source dependencies are over. Projects often have thousands of open source dependencies in their supply chain and companies may have millions. Even worse, risk is viral -- projects inherit and pass on the risks of all their dependencies. At the same time, software is shipping more frequently.

This creates numerous challenges for commercial and open source projects of any size -- how to discover the myriad of components being used across a range of ecosystems and scenarios, where to get high quality data to drive smart decisions, how to capture and evaluate comprehensive policies.

Enabling high-confidence, rapid delivery, requires integrating supply chain management automation deep into the engineering system. Core to this is accurate discovery and identification of dependencies and trustworthy, high-quality compliance and security data about the discovered components.

In this talk we detail the challenges in this space, look at various approaches such as ClearlyDefined, a crowd-sourced, open source project aimed at discovering and curating compliance data about open source components, and relate experiences running high performance, massive scale compliance systems for a wide range of open source and commercial projects.

Projects today often have thousands of FOSS dependencies. Since risk flows downstream in the supply chain; projects inherit and pass on the risks of all their dependencies. In response, licensing bill of materials tools often seek to push well-formed licensing inventory data upstream in an effort to ease downstream compliance challenges. At the same time, there has been a stark increase in license violations, especially, though not exclusively, on copyleft licenses. Is this approach to improving compliance working?

Affirmative position: Compliance at scale through tool-driven assembly of bills of materials is essential for FOSS

1. First Affirmative Constructive (1AC) = 7 minutes a. Cross-examination of First Affirmative by Second Negative = 3 minutes
2. First Negative Constructive (1NC) = 7 minutes a. Cross-examination of First Negative by First Affirmative = 3 minutes
3. Second Affirmative Constructive (2AC) = 7 minutes a. Cross-examination of Second Affirmative by First Negative = 3 minutes
4. Second Negative Constructive (2NC) = 7 minutes a. Cross-examination of Second Negative by Second Affirmative = 3 minutes
5. First Negative Rebuttal (1NR) = 3 minutes
6. First Affirmative Rebuttal (1AR) = 3 minutes
7. Second Negative Rebuttal (2NR) = 3 minutes
8. Second Affirmative Rebuttal (2AR) = 3 minutes

Other people: Bradley M. Kuhn Carol Smith

Companies regularly use and contribute to FOSS. Most larger companies now employee internal staff who make policy decisions, recommend Tools, oversee license compliance, teach others about FOSS, and interpret community politics for the company. Different offices and departments usually differ in their approaches to managing, using, contributing to, and releasing FOSS. This second annual Open Source Program Office (OSPO) panel explores the different approaches companies have to FOSS.

Other people: Tom Marble Charles Eckel Nithya Ruff Duane O'Brien