Linux Training: Getting Started with OSS Compliance (Excerpt)

### Overview In this webinar excerpt presented by Phil Colton, Director of the Open Compliance Program for the Linux Foundation, the discussion introduces practical guidance for organizations seeking to establish open source compliance. Colton defines open source compliance as the blend of policies, processes, training, and tools that allows an organization to adopt free and open-source software (FOSS) and engage with open communities while honoring copyrights, meeting licensing obligations, and protecting intellectual property.

### Key Topics - **Definition of Open Source Compliance**: Managing the balance between consuming or contributing to open source and adhering to legal obligations such as copyrights and licenses. - **Appointing a FOSS Compliance Manager**: Designating an individual to spearhead, track, and advocate for compliance efforts across an entire organization. - **Discovering Code Composition**: Overcoming the challenges of identifying open-source components embedded in modern, multi-source software products.

### Technical Details - **Role and Skill Set of the FOSS Compliance Manager**: - Oversees planning, resource acquisition from senior management, task tracking, and handling compliance inquiries from the open-source community. - Required competencies include expertise in open-source technology and licensing, active involvement in open communities, and strong project management skills. - Must possess internal organizational awareness, maintaining functional relationships across Engineering, Supply Chain, and Legal departments to resolve obstacles and escalate issues when necessary. - **Auditing and Identifying Open Source Components**: - Modern codebases frequently incorporate code from external vendors, internal teams, and legacy systems, regularly exceeding one million lines of code. - **Manual Audits**: Team leaders for each subsystem and component review source code for copyright and license notices embedded in header comments. Leaders track findings using a standardized spreadsheet template detailing: package name, package version number, license name, license version number, source download URL, and whether the code was modified. - **Automated Scanning**: Supplemental code scanning using commercial or open-source scanner tools to catch software packages missed during manual inspections.

### Takeaways - Getting started with compliance begins by centralizing responsibility under a dedicated FOSS compliance manager who bridges technical and business departments. - Organizations must know what code they distribute to understand applicable licenses and obligations. - Initial compliance tracking can start pragmatically via manual audits by team leaders with structured spreadsheets, followed by automated scanning solutions to achieve deeper coverage. Note that the transcript cuts off while introducing scanner capabilities.