Open Source on Purpose; Strategy, Process and Tools to Succeed
summary
An enterprise OSPO builds and ships an open source tool called Barista that recursively analyzes dependency trees (one demo shows 239 transitive dependencies), flags licenses (AGPL, MIT, Apache etc.), and pulls CVE data from the NIST National Vulnerability Database to produce searchable SBOMs and downloadable attribution bundles. The system is API driven, runs via Docker/Compose or Kubernetes, integrates with GitHub for internal and public repos, automates rules and governance at 28,000 engineers scale, and proves to increase developer remediation and adoption.
AI-written summary · about
chapters (12)
- 0:00Start
- 0:36Introductions
- 2:18Disclaimer
- 7:05Open Source Consumption Governance
- 10:34Live Demo
- 12:44Licenses and Security
- 16:42Software Build Materials
- 17:34Module Search
- 24:57Attribution Tab
- 31:03Upstream Engineering
- 36:25Public Community Contributions File
- 37:52Engineering Page
related talks
28mGoverning Open Source in the Enterprise: OSPO Strategies for Innovation and Compliance
20mOpen source in the enterprise
40mHow Can Your OSPO Drive Open Source Business Value for Your Organization?
26mNavigating Open Source: Establishing an OSPO for Organizational Success
18mExploration of Compliance Governance Based on Operating Systems
26mLooking at Open Source Security from the Community Angle
34mSupply Chain Security, SBOMs and How OSPOs Can Play An Important Role Going Forward - An Ecosystem and Compliance Update
23mSupply Chain Security using Free and Open Tools