This slide deck contains an Open Source Compliance Toolchain proposal from Oliver Fendt at Siemens. The slides have been distributed via the OpenChain mailing lists and will be discussed in detail on the June First Monday call from 9am Pacific.

1. Open Source
Compliance Tool Chain
Meeting May 6th 2019: Open Chain
siemens.tld/keywordRestricted © Siemens AG 2019

2. 2019Unrestricted Oliver Fendt
Resources4
Specific Elements3
Big Picture2
General description1
OSS Compliance Tool Chain

3. 2019Unrestricted Oliver Fendt
Resources4
Specific Elements3
Big Picture2
General description1
OSS Compliance Tool Chain

4. 2019Unrestricted Oliver Fendt
The tools need to be “orchestrable” as needed as well as adaptable as neededd
The compliance workflow / process needs to be part of the development / CI/CD processc
We have a huge network of suppliers / their deliverables must be license compliantb
Compliance is required by lawa
OSS Compliance Tool Chain why the OSS way
Budget constraints for license compliance work are given at all companiese
The only approach which copes with all constraints is an OSS based compliance toolchain
Installed legacyf

5. 2019Unrestricted Oliver Fendt
The Project “Sharing Creates Value”
“Combining the existing tools to an integrated OSS Compliance Tool Chain”c
Sharing OSS compliance artifactsb
“This repo realizes the idea that Open Source Software (OSS) compliance activities will be less expensive by applying OSS principles”a
https://github.com/Open-Source-Compliance/Sharing-creates-value

6. 2019Unrestricted Oliver Fendt
Big Picture – Integrated Compliance Toolchain
CI / CD Infrastructure
License &
Copyright
Scanner
Component
Analysis
Service
Compliance
artifact
consistency
Component
inventory
(Metadata
Repository)
Dependency
resolver
Source
package
downloader
Container
content
resolver
License
Obligations
Database
Policy
checker
(Compliance
Checker)
Obligation
fulfillment
Build Tools
Continous IntegrationArtifact Repository
Source Code Repo
outbound
software
&
compliance
artifacts
FOSS
Compliance
Bundle
generator
Binary
analyser
Inbound
software
Public
compliance
artifact
repos
contributions
Integration layer (API/Data) Integration layer (API/Data)
Integration layer (API/Data)
Integration layer (API/Data) Integration layer (API/Data) Integration layer (API/Data) Integration layer (API/Data)
Integration layer (API/Data) Integration layer (API/Data) Integration layer (API/Data) Integration layer (API/Data) Integration layer (API/Data)
License: CC-BY-SA-4.0

7. 2019Unrestricted Oliver Fendt
Big Picture – Integrated Compliance Toolchain
Instance
CI / CD Infrastructure
Component
Analysis
Service
Compliance
artifact
consistency
Container
content
resolver
Build Tools
Continous IntegrationArtifact Repository
Source Code Repo
outbound
software
&
compliance
artifacts
Binary
analyser
Inbound
software
Public
compliance
artifact
repos
contributions
Integration layer (API/Data) Integration layer (API/Data)
Integration layer (API/Data)
Integration layer (API/Data) Integration layer (API/Data) Integration layer (API/Data) Integration layer (API/Data)
Integration layer (API/Data) Integration layer (API/Data) Integration layer (API/Data) Integration layer (API/Data) Integration layer (API/Data)
License: CC-BY-SA-4.0

8. 2019Unrestricted Oliver Fendt
Conclusion and Plans
Define the interfaces to implement the use casesc
b
Define and describe most relevant use casesa
Let‘s build an OSS compliance tool chain together, this is no
differentiating business element – it is simply required by law
Define a suited data model for implementing the use cases
Implement use casesd