Roundtable Session – Automation  ## Metadata - Author: [[YouTube]] - Full Title: Roundtable Session – Automation - Category: #articles - Document Note: --- tags: [openchain, automation, supply-chain-security] author: OpenSSF source: YouTube reference: https://www.youtube.com/watch?v=lwPBetw7sa4 date created: 2024-12-28 10:30 --- # 🏷️ Title: Roundtable Session – Automation ## 🧰 Action Inbox - [H1] Evaluate openchain automation working group participation — meets bi-weekly for tool capability mapping #automation - [H2] Review fossilite tool for open source automation — promising example for technical capability gaps #tooling - [H3] Consider openchain ISO 5230 conformance announcement — security assurance standard ISO 18974 coming soon #compliance ## 🧭 Table of Contents - [📝 Summary](#-summary) - [📖 Main Content](#-main-content) - [🗒️ Notes](#️-notes) - [📚 References](#-references) - [🗣️ Paraphrase](#️-paraphrase) - [📰 Newsletter](#-newsletter) - [✅ Action Items](#-action-items) - [🧪 Hypotheses](#-hypotheses) - [📊 Methodology](#-methodology) - [❓ Questions](#-questions) - [🔮 Future Research](#-future-research) - [💡 Implications](#-implications) - [🧠 Learning Styles Assessment](#-learning-styles-assessment) - [📊 Accessibility Assessment](#-accessibility-assessment) - [🌍 DEIB Assessment](#-deib-assessment) - [✅ Logical Validity](#-logical-validity) - [🛡️ DARVO Analysis](#-darvo-analysis) - [🎯 Conclusion](#-conclusion) ### 🔗 References - [OpenChain Project](https://www.openchainproject.org/) - [ISO 5230 Standard](https://www.iso.org/standard/81039.html) ## 📝 Summary - OpenChain project focuses on automation for supply chain security and compliance, despite being high-level process management - Market adoption requires accessible automation tools, particularly for open source projects with limited technical capability - ISO standards for license compliance (5230) and security assurance (18974) are gaining widespread industry adoption - Community provides extensive resources and support to bridge knowledge gaps in supply chain compliance - Ultimate goal is end-to-end supply chain process management from upstream projects to final implementation ## 📖 Main Content The OpenChain project has made automation a central focus because market feedback indicates it's critical for adopting process standards that fix supply chain issues. The project maintains an active automation working group that meets bi-weekly to map tool capabilities, identify market gaps, and develop solutions. A key challenge emerged from a case study where a Chinese board member company deliberately limited their OSPO's technical access and asked them to set up fossology and SW360 tools. Despite budgeting three hours, the team spent a week before giving up and purchasing BlackDuck instead. This revealed a critical market gap in implementation tools for teams with limited technical capability. OpenChain has developed two main ISO standards: one for open source license compliance (ISO 5230) and another for security assurance (soon to be ISO 18974). These standards are seeing significant adoption across industry verticals, with PWC analysis showing 20% of German companies with over 2,000 employees using the license compliance standard. ## 🗒️ Notes #### ⏱️ [00:00](https://www.youtube.com/watch?v=lwPBetw7sa4?t=0) — [H1] Automation focus rationale - Key idea: OpenChain covers automation despite being high-level because market adoption requires it - Evidence: "our greatest concern isn't the existing process standards our greatest concern is making sure the market adopts and applies these to fix the supply chain" #### ⏱️ [00:45](https://www.youtube.com/watch?v=lwPBetw7sa4?t=45) — [H2] Active automation working group - Key idea: Bi-weekly meetings focus on tool capability mapping and closing market gaps - Evidence: "openchain has an extremely active automation group it meets every two weeks" #### ⏱️ [01:15](https://www.youtube.com/watch?v=lwPBetw7sa4?t=75) — [H2] Accessibility for non-technical users - Key idea: Goal is enabling companies without technical capability to download, install and use tools - Evidence: "quickly locate a tool that they can download install and use even if they don't have technical capability" #### ⏱️ [01:30](https://www.youtube.com/watch?v=lwPBetw7sa4?t=90) — [H1] Chinese company case study - Key idea: OSPO with limited technical access failed to implement open source tools in budgeted time - Evidence: "they budgeted three hours and they took a week and then gave up and bought blackduck" #### ⏱️ [02:15](https://www.youtube.com/watch?v=lwPBetw7sa4?t=135) — [H2] Market gap identification - Key idea: Case study revealed implementation gaps for teams with limited technical capability - Evidence: "there's a market gap on implementation and we're still filling that" #### ⏱️ [02:30](https://www.youtube.com/watch?v=lwPBetw7sa4?t=150) — [H3] Fossilite as promising solution - Key idea: New tools like fossilite show promise for filling automation implementation gaps - Evidence: "stuff like fossilite are promising examples of how we can fill it" #### ⏱️ [04:00](https://www.youtube.com/watch?v=lwPBetw7sa4?t=240) — [H1] ISO standards development - Key idea: Built standards for license compliance and security assurance becoming ISO standards - Evidence: "we've built the iso standard for open source license compliance we've built the standard for security Assurance" #### ⏱️ [04:30](https://www.youtube.com/watch?v=lwPBetw7sa4?t=270) — [H2] Cross-industry adoption - Key idea: Standards adoption spans multiple industry verticals with significant growth since 2015 - Evidence: "crossing all types of Industry verticals as we get people using the standards" #### ⏱️ [06:00](https://www.youtube.com/watch?v=lwPBetw7sa4?t=360) — [H2] German market penetration - Key idea: PWC analysis shows 20% of large German companies using the license compliance standard - Evidence: "20 percent of companies in Germany with more than 2 000 employees are using the iso standard" #### ⏱️ [07:00](https://www.youtube.com/watch?v=lwPBetw7sa4?t=420) — [H3] Security standard timeline - Key idea: Security assurance standard will become ISO 18974 within months - Evidence: "it'll be one eight nine seven four we're already seeing companies like LG announcing use of it" #### ⏱️ [08:00](https://www.youtube.com/watch?v=lwPBetw7sa4?t=480) — [H2] Supply chain knowledge gap - Key idea: Despite big company adoption, most supply chain participants still at zero knowledge level - Evidence: "the most common question we get from companies is how do open source licenses work what are they isn't this dangerous" #### ⏱️ [08:30](https://www.youtube.com/watch?v=lwPBetw7sa4?t=510) — [H2] Global community support - Key idea: Worldwide meetings, multiple languages, and reference library support adoption - Evidence: "we have meetings all over the world in multiple languages we've got Global work groups and we've got an enormous reference library of over a thousand documents" #### ⏱️ [10:00](https://www.youtube.com/watch?v=lwPBetw7sa4?t=600) — [H1] Eclipse Foundation conformance - Key idea: Eclipse Foundation is OpenChain ISO 5230 conformant across all projects - Evidence: "Eclipse Foundation is open chain ISO 5230 conformant all of it every project in Eclipse is following our processes" ## 📚 References - [OpenChain Project Website](https://www.openchainproject.org/) - [ISO 5230 Standard](https://www.iso.org/standard/81039.html) - [Fossology Tool](https://www.fossology.org/) - [SW360 Tool](https://www.eclipse.org/sw360/) ## 🗣️ Paraphrase - OpenChain prioritizes automation because market feedback shows it's essential for companies to actually implement supply chain security processes, not just understand them conceptually - A revealing case study showed that teams without strong technical capabilities struggle to implement even budgeted open source compliance tools, creating a market opportunity for more accessible solutions - The project has successfully developed two ISO standards gaining significant industry adoption, but recognizes most supply chain participants still lack basic knowledge about open source licensing and security ## 📰 Newsletter 🔧 **OpenChain Automation: Bridging the Gap Between Standards and Implementation** The OpenChain project is tackling a critical challenge in supply chain security: while ISO standards for compliance exist, many organizations struggle with practical implementation, especially those with limited technical resources. **Key Learning**: A telling case study revealed that when technical access was restricted, a team budgeted 3 hours to set up compliance tools but gave up after a week and purchased commercial software instead. This highlights the urgent need for more accessible automation tools. **Practical Application**: Organizations can join OpenChain's bi-weekly automation working group to access tool evaluations, identify implementation gaps, and connect with solutions like fossilite that make compliance more approachable. The project's ISO 5230 (license compliance) and upcoming ISO 18974 (security assurance) standards are seeing impressive adoption - 20% of large German companies are already using the compliance standard, with major players like LG and Eclipse Foundation announcing conformance. **Community Connection**: OpenChain offers global meetings in multiple languages plus a 1000+ document reference library to help organizations at any knowledge level get started with supply chain compliance. **Resources**: [OpenChain Project](https://www.openchainproject.org/), [Learn WordPress](https://learn.wordpress.org/), [Developer Docs](https://developer.wordpress.org/), [WP-CLI](https://wp-cli.org/) ## ✅ Action Items #### OSPO - License Compliance: Evaluate OpenChain ISO 5230 conformance process and announcement strategy - Security Management: Assess upcoming ISO 18974 security assurance standard for organizational adoption - Software Inventory: Review fossilite and similar automation tools for SBOM generation and compliance workflows - Community Engagement: Join OpenChain automation working group bi-weekly meetings for tool capability insights - Strategic Alignment: Map OpenChain standards adoption to organizational compliance KPIs and risk reduction metrics #### Community - Maintainers: Consider OpenChain conformance for project governance and supply chain transparency - Contributors: Participate in OpenChain reference library development and translation efforts - Ecosystem: Coordinate cross-project adoption of OpenChain standards for supply chain consistency ## 🧪 Hypotheses - Organizations with limited technical capability are significantly more likely to abandon open source compliance tools in favor of commercial solutions - Market adoption of supply chain security standards requires accessible automation tools more than comprehensive documentation - Bi-weekly automation working group participation correlates with successful implementation of OpenChain standards - Companies announcing OpenChain conformance experience measurable reduction in supply chain compliance overhead ### 📊 Methodology - Study design to test hypothesis 1: Survey organizations that evaluated both open source and commercial compliance tools, measuring technical capability versus tool selection - Data sources and analysis for hypothesis 2: Compare adoption rates of standards with automation support versus documentation-only approaches - Experiments to validate hypothesis 3: Track implementation success rates among working group participants versus non-participants ### ❓ Questions - How can automation tools better serve organizations with limited technical resources while maintaining security rigor? - What specific market gaps exist between current open source compliance tools and enterprise adoption needs? - How might OpenChain standards evolution adapt to emerging supply chain security challenges beyond licensing and SBOMs? ### 🔮 Future Research - Comprehensive analysis of technical capability barriers in supply chain compliance tool adoption - Market study of automation tool accessibility requirements across different organization sizes and sectors - Investigation of Eclipse Foundation's OpenChain implementation as a model for open source project compliance ### 💡 Implications - Practice: Organizations need to assess technical capability gaps before selecting open source versus commercial compliance solutions - Policy: Supply chain security policies should account for implementation accessibility, not just standard comprehensiveness - Security: Market gaps in accessible automation tools may drive organizations toward less secure or less transparent commercial alternatives - Education: Training programs should emphasize practical tool implementation alongside theoretical compliance understanding - Funding: Investment in user-friendly open source compliance automation could significantly improve supply chain security adoption rates ### 🧠 Learning Styles Assessment Reading level estimate: 12th grade #### 👀 Visual learners - Present: Company adoption snapshots showing industry vertical distribution - Improve: Process flow diagrams showing OpenChain automation tool evaluation workflows #### 🔊 Aural learners - Present: Live roundtable session format with speaker presentation - Improve: Podcast-style breakdown of case study findings and tool comparisons #### 🗣️ Verbal learners - Present: Clear definitions of ISO standards, compliance processes, and market gaps - Improve: Industry-specific analogies for supply chain compliance challenges #### 🧩 Kinesthetic learners - Present: Hands-on case study example with specific time budgets and outcomes - Improve: Step-by-step automation tool evaluation checklist with measurable criteria #### 🧠 Logical learners - Present: Clear timeline for ISO standard development and adoption metrics - Improve: Decision trees for selecting open source versus commercial compliance solutions #### 🧑‍🤝‍🧑 Social learners - Present: Bi-weekly working group meetings and global community calls - Improve: Peer mentoring programs for organizations implementing OpenChain standards #### 🧘‍♀️ Solitary learners - Present: Extensive reference library with 1000+ documents for self-study - Improve: Self-assessment tools for organizational compliance readiness #### 🌿 Naturalistic learners - Present: Supply chain ecosystem thinking and end-to-end process management - Improve: Environmental impact considerations of compliance tool choices ### 📊 Accessibility Assessment #### Screen reader semantics - Present: Clear heading structure with logical flow from automation focus to standards adoption - Improve: More descriptive alt text for company adoption snapshots and visual examples #### Keyboard navigation - Present: Standard YouTube video controls with keyboard accessibility - Improve: Transcript navigation with timestamp jump links #### Contrast and readability - Present: Standard video presentation format - Improve: High-contrast transcript formatting with clear section breaks #### Text resizing and reflow - Present: YouTube's responsive video player - Improve: Responsive transcript layout supporting 200% zoom without horizontal scrolling #### Media and captions - Present: Video content with available transcript - Improve: Time-synced captions and downloadable transcript with speaker identification #### Forms and interactions - Present: Basic video playback controls - Improve: Interactive timeline with section bookmarks for easy navigation #### Standards reference - Map to WCAG 2.2 AA: 1.2.2 (captions), 1.4.3 (contrast), 2.1.1 (keyboard access) ### 🌍 DEIB Assessment #### Cultural breadth - Present: Global community with meetings in multiple languages across regions - Improve: More specific examples from non-Western organizations and regulatory contexts #### Inclusive language - Present: Technical terminology with business context explanations - Improve: Plain language summaries of ISO standards and compliance concepts #### Neurodiversity support - Present: Structured presentation with clear topic transitions - Improve: More frequent signposting and summary points for information processing #### Representation - Present: Mix of organizational types from different sectors and regions - Improve: Diverse speaker representation and varied company size examples #### Psychological safety - Present: Professional conference setting with respectful technical discussion - Improve: More explicit encouragement for questions and learning at all knowledge levels ### ✅ Logical Validity #### Strong reasoning - Deductive strength: ISO standards adoption → improved supply chain security (strong logical connection) - Inductive strength: Chinese company case study → broader market implementation gaps (reasonable generalization from specific example) - Causal reasoning: Technical capability limitations → tool abandonment → commercial solution adoption (clear causal chain) - Analogical strength: Eclipse Foundation conformance → potential model for other organizations (appropriate analogy with relevant similarities) #### Fallacies - Hasty generalization: Single Chinese company case study may not represent broader market patterns without additional evidence - Appeal to popularity: Emphasis on adoption numbers (20% of German companies) without quality metrics for implementation success #### Tone of voice - Overall tone: - Document Tags: [[tooling]] [[automation]] [[compliance]] - Summary: Roundtable Session – Automation - URL: https://www.youtube.com/watch?v=lwPBetw7sa4 we spent a lot of time talking about Automation and that might sound a little strange because you're in a project which is very high level right we do Process Management ISO standards the reason we covered automation is because our greatest concern isn't the existing process standards our greatest concern is making sure the market adopts and applies these to fix the supply chain and the biggest feedback we've had in the last year has been automation is critical and it's hard to get particularly open source automation for open source tooling when something like phoslight came along and we had something to show you about how things can get a lot simpler a lot quicker we felt it was very important to put that in front of you and you should be aware if you don't know already that openchain has an extremely active automation group it meets every two weeks I think and this automation work group is focused on mapping out the capabilities of tools like this finding Market gaps and then seeking ways to close those Market gaps the end goal is that a company looking at something like open chain would then ask the question of what s-bomb do I use and quickly locate something like spdx and then ask the question of how do I automate it and quickly locate a tool that they can download install and use even if they don't have technical capability our very best case study came approximately two years ago when one of our Chinese board member companies purposefully prevented their ospo accessing the technical team and asked the osbo to set up at the time fossology and sw360 they budgeted three hours and they took a week and then gave up and bought blackduck now the reason that they did that test was actually to see what would be happening in their supply chain for teams with limited technical capability that start thinking how do we get started how do we begin to do automation once we've understand that we're going to have a process we're going to have an s-bomb how do we make sure that can scale and their Discovery was then there's a market gap on implementation and we're still filling that stuff like fossilite are promising examples of how we can fill it and that's why we're talking about it this project openchain is concerned with the Practical Market reality I'm not sure where the oh you have a HDMI thingy okay uh we're about to end I'm smiling because my computer put up a warning it's like you've connected an unknown accessory do you want to give it access to your computer I was like yeah sure whatever clicked yes okay so going right back to the start here um it's okay we we we we will we will not do that again I'll I'll just show this picture again because I liked it um I like that one don't tell legal okay okay so um the open chain project what I wanted to touch on was going right back here so we've built the iso standard for open source license compliance we've built the standard for security Assurance it'll be an ISO standard in around a month and a half we're crossing all types of Industry verticals as we get people using the standards this is a tremendous change from where we were when we started 2015 or so Mark I think you're later to the room so you haven't seen all of this this slide is just showing a snapshot of some of the companies that have announced conformance via our website and it's just a snapshot of some of the largest uh the actual setup of the companies that announced on our website looks more like this and that's only a tiny subset because we know from pwc's analysis that for example 20 percent of companies in Germany with more than 2 000 employees are using the iso standard for open source compliance but this vertical thing was just me messing around cherry picking just a handful of the companies on our website who've announced conformance putting them up there and another thing I flagged was here are other companies that haven't announced conformance but are actually active in our community like for instance Lockheed which is co-chairing future spec development via Chris Wood so lots of movement lots of activity and all of it based around the fact that we have some very practical simple ISO standards for getting things done the primary one that we're interested in in terms of existing Market traction is our license compliance standard and then the primary one we're interested in in solving the hot new problem is our security Assurance standard as I told you these uh standards are both in a pretty good stage they're both coming to Market in ways that I think are beneficial you know the security Assurance standard will be out as an ISO number very shortly we can already tell you what that number will be if the vote is successful it'll be one eight nine seven four we're already seeing companies like LG announcing use of it the license compliance standard obviously is everywhere and we're just seeing a continual run of companies in multiple different sectors announcing usage we do hope that you will go and tell people that not only are the standards important but this community exists because beyond the fact that we've built the standards and there's lots of adoption and big companies like LG we'll talk about what they're doing and they'll release tools that help people use these standards despite that in the supply chain the most common question we get from companies is how do open source licenses work what are they isn't this dangerous so we're still at the stage for most of the supply chains level is pretty much zero okay so one of the big jobs of the open chain project is to provide a way to capture people and to guide them towards the information they need obviously we want them using our standards but to get them to that stage we have meetings all over the world in multiple languages we've got Global work groups and we've got an enormous reference library of over a thousand documents to do everything from explain what is open source to give people adoption kanban workflows and what I hope is that you will go and tell people about this if you're new and curious and confused about all the stuff we talked about today come to our website learn about it join our calls everything is designed to try to get the help and support from the most knowledgeable people or from the biggest companies out to everyone else as quickly as possible no limits no catches no nothing for us it's simple the better the supply chain works the more all of us can focus on getting great solutions to Market final note As We End Community of course is number one and there's soum again hi sew them uh at the same time as having a great fun Community um we're also truly a community org and we're aware of one thing that what's this what's this hacking my computer now oh my computer's got a security response sorry someone else makes it okay so uh we're very much an open source project I mentioned we edited our standards on GitHub we do our calls but more than that we're aware of something which I think is vital to keep reiterating to solve compliance and Security in the end for the supply chain we have to solve final Upstream okay so what we're doing a lot of it is the corporate lifting that has been incredibly hard to build traction on but at the same time as that we're not losing sight of the pure Community side of things and helping projects fostering that type of Engagement and interaction one thing that you probably didn't see on the slides to end is that on this massive list of companies and organizations somewhere down here is Eclipse Foundation Eclipse Foundation is open chain ISO 5230 conformant all of it every project in Eclipse is following our processes for our standards software bill of materials compliance they're doing that and you know this is kind of our vision that the whole supply chain from beginning to end will have better Process Management save time save money reduce risk etc etc etc so please be part of that thank you for your time today and your patience I do apologize that we haven't had enough time for free discussion but if you have any ending questions you're most welcome to pose them now everyone's like no we want to get out just let us go okay fine go thank you everyone and have a beautiful day thank you, Roundtable Session – Automation, YouTube, 01ka7m3s69sg0d7pd65h7r43b0.