Jan Thielscher

In this talk I want to present the recently open sourced deepscan tooling, which allows the comfortable analysis of repositories for effective licenses, copyrights and known files. I will show how the tool is structured and how it works. How the similarity analysis is used and what the current results are. Also I will demonstrate how the free analysis service can be used and how it may be used to review and re-assess findings.

Openchain is a comprehensive set of requirements allowing to cope with the open source compliance challenge. Recently it even has been accepted as ISO standard. However, compliance in todays world is not possible without tool support. To get a grip on the different tools, understand what they can do and where their limitations are, the OC tooling workgroup decided to develop a capability model. This model outlines all required capabilities to cope with the open source challenge and allows to map the functionality of tools. Thus the model can be seen as a map through the djungle of tools. In this talk, Jan will introduce the model as well as briefly outline the most relevant capabilities. Links to further resources as well as first maps will be provided.

Open Source Compliance (OSC) is not a might anymore. It is part of good manufacturing practise. Since manufacturing and software grow closer, the insight that not only the Software Bill of Materials (SBOMs) become essential for maintainability and security of software but also the legal documentation can't be seen as a once printed and never read paperwork anymore. The acceptance of CI/CD as development best practise and the ever growing amount of components used from open source stacks and their imminent dependencies prevent further manual delivery of compliance artefacts. But what is required to cope with that challenge? Where do you have to put your efforts in? Which tools are the right tools to check for your purpose? To help you answer these questions, the Capability model has been designed.
This talk introduces the motivation as well as the basic aspects of the model without going into details. Guiding thoughts and ideas will be transported as well as links for further studies will be provided. Finally the talk will conclude with a few mapping samples and an outlook in which directions the work will proceed.

A short overview of the OpenChain project, its purpose, goals and the current state

We will introduce the project, its current state, especially the ISO adoption, give a short overview of the requirements and link to the different certification schemes. Finally we will expose the working procedures and link the international working groups.