[2024-02-22] TODO General Member & OSPOlogy Touchpoint - Open Office Hours

[anajsana]

Agenda (2024-02-22)

This meeting follows Chatham House Rules. Regular calls are not being recorded and discussions noted during the meeting do not share people's names nor organization affiliation.

• Welcome and attendees intro (use chat)

Featured Topics

• Updates on EU Policies by LF Europe (Presented by Mirko) - 5 minutes
• OSPO landscape and 2024 TODO Strategic Goals(Presented by Ana) - 5 minutes
  • See the proposal drafted here)
• OSPO Strategic Value Initiative (Presented by Leslie) - 10 minutes
• Licensing Champions (Presented by Stephen K.) - 10 minutes
  • See the idea in the forum.

Open Work Hours

15-30 minutes

This is a free space governed under Chatham House Rules. Please add any questions/pain points you’d like to raise below!

• Which core Responsibilities and day-to-day ops are being prioritized in your OSPO in 2024? Can we identify common pain points?

Essential Information

• 👩‍🏫 Find the meeting call on our website
• 🕛 Thursday 22nd, 2:00 - 3:00 pm CET
• 📝 g.doc agenda

Meeting	Frequency	Duration	First 30’	Next 30’	Zoom link
Thursday Touchpoints	Monthly	1 hour	Agenda	Open Office Hours	Here

[anajsana]

Updates on EU Policies by LF Europe

CRA

• Regulations for all companies that operate in EU
• Manufacturers must work with the OS stewards to ensure compliance
• Supposed to provide security, updates and information for consumers
• Distinguishes between FOSS and manufacturer releases through products
• OS stewards do not have the obligation
• OS developers are not covered by CRA
• US manufacturers
  • Mandatory support period - not less than 5 years
  • Disclose vulnerabilities
  • Manufacturers should provide SBOMs to authorities on request
• Enforcement
  • CE marking - compliance with CRA
  • CRA standards will be written later
• Implementation 3 years from Q2 2024
• Does Github provide a usable SBOM - NO! As a manufacturer you have the responsibility to ensure an usable SBOM.
• Does CRA cover UK? - NO! It regulates all products sold in the EU market.

[anajsana]

2024 TODO Strategic Goals

3 pillars where the community can focus on

• Cross-community collaboration: special focus on leveraging OpenSSF, Inner source commons
• Adoption and project sustainability - update the touchpoint calls to enable conversation between OSPOs and c-level executes

[anajsana]

Licensing Champions

• See the idea in the forum.
• Licensing champion
  • Provide license compliance expertise to dev teams
  • Not part of the OSPO!
• Areas of knowledge
  • Technical
  • Legal compliance
  • Process
  • Tooling
  • Training
• Ensure that the champions are trained
• Ensure that Dev Teams are trained
• Communication channels
• Incentives

[alldo-dev]

Thanks to @stephenkilbaneadi for his presentation!

We touched upon the subject of incentivizing the people behind the role during the OSPOlogy exchange on 02/22/2024.
There's an article posted in the IEEE Xplore site titled: Knights and Gold Stars: A Tale of InnerSource Incentivization.

I know every OSPO is built different, and this article could help others establish baselines and starting points for their own incentivizing programmes.

[stephenkilbaneadi]

Hey, @anajsana - where would you like me to put slides? Just as an attachment to a comment here, or do you want a PR to a repo?

[anajsana]

Attachment would work! Thank you 😊

[stephenkilbaneadi]

LicensingChampions-TODO-CC-BY-4.0.pptx

Sold!

[anajsana]

Open Work Hours:

• Has anyone been given any SBOMs from their vendors?
  • Supplier vs vendor
  • Automotive, SBOM is per-product https://opensource.apple.com/releases/ isn’t ideal
  • Can be missing transitive dependencies / source locations
  • some companies in Europe has started to publish SBOMs for products
• “If you’re distributing source, should you list direct and transitive dependencies”
  • No (according to CRA)
  • Yes (it’s a better way to do it, can clarify we want the “runtime SBOM” not the “source SBOM” to make sure you get the right things)
• Transitive dependencies when across languages that don’t fully lock everything?
  • May want to do reproducible builds, work in a fully lockfile-driven ecosystem
  • From chat: Attach the SBOM to your build-artifact immediately
  • Referenced https://fosdem.org/2024/schedule/event/fosdem-2024-1896-12-months-of-sboms-an-experience-report/
• Should we be prioritizing developer experience vs enterprise compliance?
  • A topic to discuss in the next touchpoint call