Linux Foundation Announces Workgroup to Standardize the Future of the Software Supply Chain

DUBLIN, IRELAND--(Marketwired - Oct 5, 2015) - LinuxCon Europe and Embedded Linux Conference Europe -- The Linux Foundation, the nonprofit organization dedicated to accelerating the growth of Linux and collaborative development, today announced the OpenChain Workgroup, a community effort to standardize common best practices for open software compliance. It is expected to reduce costs and duplication of efforts and ease friction points in the software supply chain.

Founding members of the OpenChain Workgroup include ARM, Qualcomm, Samsung, SanDisk and Wind River.

"Because nearly every new technology today is built using Linux and open source software, today's software supply chain is the open source software supply chain," said Jim Zemlin, executive director at The Linux Foundation. "This means we need to revisit the way we standardize processes and compliance for checking code and ensure the cost and efficiency benefits of open source are sustained for decades to come. This is a long-term commitment to open compliance and one we take very seriously."

Linux and open source software are being used to build the most innovative technologies of our time. It is being used everywhere, by more developers than ever before. Understanding the security and nature of open source components included in software packages that are delivered throughout the supply chain is critical to ensuring the benefits of Linux and open source software -- cost, speed of development, freedom in innovation -- are realized time and again.

The OpenChain Workgroup will provide a baseline process that can be customized as companies and developers see fit. It will initially provide a set of guidelines intended to be used as a basis for monitoring and developing compliance programs. OpenChain will leverage existing best practices in the Linux ecosystem such as Debian, as well as compatible formats with the Software Package Data Exchange® (SPDX), a standard format for communicating the components, licenses and copyrights associated with a software package. The SPDX standard helps facilitate compliance with free and open source software licenses by standardizing the way license information is shared across the software supply chain.