Open Source distributions in a cloud-native world: from a technical to a legal point of view
summary
Explains concrete steps: add a license file, NOTICE and an SBOM, embed legal docs into artifacts (META-INF), publish images with a commit hash or tag, and prefer trusted base images to keep builds small. Mandates automated license scans of every dependency and Docker layer, warns that scan Docker images is required before publishing. Notes that AGPL/SSPL trigger cloud-facing obligations, AI output ownership is uncertain so scan AI output with snippet scanner, and always include commit hash in releases.
AI-written summary · about
chapters (9)
- 0:00Open source distributions intro
- 3:19License compliance matters
- 8:33Open source licenses explained
- 12:47Legal start for projects
- 18:58Publishing with compliance
- 27:10Docker images scanning
- 35:22Cloud deployments licensing
- 39:21AI-generated code and intellectual property
- 42:34EU open source security
related talks
32mOpen Source Contributions in Today’s World
19mDocker and Legal Compliance: Navigating the Containerized World
52mRisk management: best practices for people with legal compliance to ship open source
13mBuild license management into your pipelines
01h 38mOpen Source Licensing: Types, Strategies and Compliance
25mOpen Source Compliance
57mWhat You Need to Know About Open Source—Trust Me, I'm a Lawyer
31mOperationalizing Open Source Projects: When the Rubber Meets the Road