Leveraging FOSS is an attractive proposition, yet managing FOSS and licensing obligations is often an after thought. Business risks and negative branding impacts are ignored, or willingly glimpsed upon, when an organization is in startup mode, however in larger companies and organizations, no lines of code should be pushed upstreamed or shipped with product unless, development shouldn’t even begin unless a comprhensive and state of the art FOSS license compliance policy and practice is in place. So do you go about building a new one, when none exists yet. Which standard do you look at? Which best practices do you follow? What processes do you build to make sure that the policy ultimately folllows the busines needs while mitigating risks as opposed to blocking business completely?

1. FOSS Compliance Must Come First.
A Compliance Tale, or There and Back Again.
Davide Ricci
SFSCON 2020, Nov 13th, 2020
Davide Ricci FOSS Compliance Must Come First.

2. Agenda
Chapter 1: The Author
Chapter 2: openharmony
Chapter 3: Open source and Huawei
Chapter 4: The Open Source Technology Center
Chapter 5: openharmony hits the road in Europe
Chapter 6: The nature of the beast
Chapter 7: The Tale
Chapter 8: One Policy to rule them
Chapter 9: Can never be too prepared
Chapter 10: Release Early, Release Often
Chapter 11: Back Again
Davide Ricci FOSS Compliance Must Come First.

3. Chapter 1: The author
Director, Open Source
Technology Center at Huawei
MS in Computer Engineering,
AI and Robotics
15+ year in Open Source @
Wind River and Intel OTC
Kernel developer, FAE, PM,
Director of Product, GM
Contributed to Yocto
Project, Zephyr, Openchain,
OVA, Eclipse
Davide Ricci FOSS Compliance Must Come First.

4. Chapter 2: openharmony
Edge to cloud o.s. for IoT and consumer devices
Initially developed by Huawei
Leverages broad spectrum of open source components
Delivers on the promise of autonomous, cooperative devices
Cooperation at the edge, with efficiency and privacy in mind
Initial China code @ https://gitee.com/openharmony
European code base being prepared
Davide Ricci FOSS Compliance Must Come First.

5. Chapter 3: Open source and Huawei
FOSS compliance must come first
Open Source is strategic to Huawei
Breaks vendor lock-in
Huawei products built on technology shared by most
If done right, increases Huawei’s brand value
All eyes on us
Davide Ricci FOSS Compliance Must Come First.

6. Chapter 4: The Open Source Technology Center
Pan European
Built with Best In Class in
mind
Milan, Munich, Warsaw,
Helsinki, London, Cork, Lyon
Engineering, Marketing,
Product Management, Field
Eng, Evangelism
First big project: take
openharmony to Europe
Come talk to us
ohos-eu-incubator on freenode
incubateohos@huawei.com
Davide Ricci FOSS Compliance Must Come First.

7. Chapter 5: openharmony hits the road in Europe
Figure 1: openharmony EU roadmap
Davide Ricci FOSS Compliance Must Come First.

8. Chapter 6: The nature of the beast
Intended for source
distribution
Source only compliance
envelope
Compliance tools for device
makers
Potential issues from
software dependencies
Avoid incompatible
combinations
OSI/FSF approved licenses
only
Davide Ricci FOSS Compliance Must Come First.

9. Chapter 7: A Compliance Tale
The Fellowship of the IP
OSTC: Davide Ricci, Christian Paterson (OW2 Good
Governance)
NOI Techpark / Free Software Lab: Project Management,
Devops
FSFE: Training
Array: Legal
Figure 2: Project Plan
Davide Ricci FOSS Compliance Must Come First.

10. Chapter 8: A Policy to rule them
Public Policy
Value
Scope
Upstream First
Contributions
REUSE/SPDX
Open Invention Network
Patent Promise
Trademark Policy
Internal Policy
Openchain 2.0 Compliance
Roles and Competences
Awareness and Funding
Training
Access to Legal Expertise
Continuous Improvement
License compliance process
External inquiries
Davide Ricci FOSS Compliance Must Come First.

11. Chapter 9: Can never be too prepared
Three phases
1 Policy training for all stakeholders
2 Tailored devops training: Project Management VS Engineering
3 Tailored BOM analysis and decision taking training
You can’t expect if you don’t ... train
Davide Ricci FOSS Compliance Must Come First.

12. Chapter 10: Release Early, Release Often
Figure 3: Open Souce Continuous License Compliance
Davide Ricci FOSS Compliance Must Come First.

13. Chapter 11: Back Again
Thank You
Download slides at
SFSCON 2020 OSTC Slides
Come talk to us
ohos-eu-incubator on freenode
incubateohos@huawei.com
Davide Ricci FOSS Compliance Must Come First.