Open Source Leadership Summit 2017

The SPDX and OpenChain projects provide two critical pieces for solving the supply chain open source compliance puzzle. SPDX reduces the cost and friction around the collection and exchange of critical open source compliance information. OpenChain provides the means by which to establish trust of a specific supplier’s creation of open source compliance artifacts (source code, notices, SPDX data, …) for the their software offering. The remaining missing puzzle piece is a way to manage accountability and providence tracking of the collection of all compliance artifacts of a product as it takes form traversing the supply chain from conception to end user. We discuss how the Linux Foundation’s Hyperledger project could help create a “ComplianceLedger” to solve the puzzle and how the SPDX and OpenChain projects are highly complementary to that solution.