ORT: Automate your open source policy using Open Source & Inner Source
summary
An open source compliance pipeline that runs in CI (GitHub/GitLab/Jenkins) using OSS Review Toolkit (ORT) scans code, emits SBOMs (SPDX/CycloneDX), and enforces policy-as-code with curations and package configs; remediation loops are limited to three outcomes: code change, curation, or security exception. ORT is battle tested (hundreds of thousands of scans) and real runs show surprising scale like 329 unique dependencies and 240 detected vs 7 declared licenses, and the inner source curation model materially reduces repeated work.
AI-written summary · about
chapters (7)
- 0:00Introduction to ORT
- 6:01Introducing ORT
- 8:50ORT features and compliance
- 11:42InnerSource with ORT
- 21:51ORT GitHub Action demo
- 27:54Scaling license clearance
- 29:42Q&A
related talks
33mORT Automate compliance using Open Source & InnerSource
30mSuccess Stories in Open Source: Security Audits with OSTIF
42mBenefits of Automated Open-Source Intake Management
28mGoverning Open Source in the Enterprise: OSPO Strategies for Innovation and Compliance
32mAutomating Open-Source License Compliance
44mSecurity Research with Open Source Software: Vol. Omega
15mOpen Source License Compliance and Ory Open Source
35mOSCAR - Automate software analysis, compliance and security