Thomas Steenbergen

Setting up or maintaining a FOSS compliance processes is not simple as most organizations use a wide variety of programming languages, code build tools and delivery methods. Ideally, you want to automate most of the compliance work but as most Open Source Program Offices (OSPO) have found out, there are often significant gaps between what is offered by most tools and what you would like to have. Given this, several OSPOs have been collaborating to build OSS Review Toolkit (ORT). In this session Thomas demonstrates how one can use ORT to safely use, integrate, modify and redistribute third party software including FOSS in your software project(s). He will show a FOSS review from start to finish e.g. from scanning a repository for packages, licensing and vulnerabilities to fixing found issues and generating attribution documents, source bundles and SBOMs (CycloneDX/SPDX). By the end of this session you should be able to replicate an ORT-based compliance process within your organization including automating your FOSS policy using Policy as Code and save process/review time by using an InnerSource-based review process and re-using FOSS clearance artifacts from the community.

Other people: Surya Santhi

During this talk, Thomas will demonstrate how you can in a few simple steps likely generate SBOMs for your software projects using ORT and GitHub action or GitLab pipeline. He will highlight some of the challenges of creating an accurate SBOM that reflects the reality in the source code and how ORT and its community has build and shared the tooling, data and policies needed to overcome some of these challenges to enable you to produce enterprise-grade SBOMs.

In this talk Thomas will present how one can use OSS Review Toolkit (ORT) to build a CI/CD workflow to do license/security compliance and generate SBOMs. The talk will include a demonstration of OSS Review Toolkit and how its various features in combination with GitLab-based process can be used to automated FOSS reviews requirements (incl. SPDX SBOM generation) and use crowdsourcing within an organization and the FOSS community to overcome challenges such as large amounts of scan results or missing/incorrect FOSS package metadata.

In this session we will demonstrate how to write a license policy in OSS Review Toolkit to automatically check the licenses found in a project and its dependencies.

One of the reasons OSS Review Toolkit was started by its creators was a need to go beyond the usual allow/deny license policy in most SCA tools. For instance we wanted to be able to write checks with multiple levels of compliance depending on what was being reviewed or based on package meta data. In this session we will demonstrate how one can write license policy with checks/rules that take into account package metadata date or the code, license and product context.

In this session we will provide an update on OSS Review Toolkit (ORT) - which features have been recently added and what they ORT team is currently working on.

License Compliance has become big business. Many proprietary tools exist, but fortunately in recent years FLOSS tools to aid understanding the licenses of codebases have been created. This panel includes developers of many of these freely available tools. We'll discuss what these tools do, if they can actually address compliance problems in the wild yet, and the general challenges of developing freely available tools in a heavily proprietarized industry.

Other people: Bradley M. Kuhn Michael Jaeger Philippe Ombredanne Valerio Cosentino Max Sills