Exploration of Compliance Governance Based on Operating Systems
summary
Open Oiler describes concrete governance work: a custom IT pipeline generates dependency graphs and reverse‑dependency traces for its ~40–48k packages, enforces one package one SBOM and per‑package SPDX data, and integrates commercial scanners plus open tools for package/source/build/release security. Community maps and mapped ISO 5230 and achieves certification, passes ISO 18974 conformance, runs 20 training lectures with exams, and is building an SBOM‑based CVE management system slated for delivery by year end.
AI-written summary · about
chapters (11)
- 0:00OpenAtom and OpenEuler intro
- 1:05What is OpenEuler
- 2:30OS compliance challenges
- 5:43License compliance solutions
- 8:38ISO 5230 certification
- 9:46SBOM implementation details
- 12:18Supply chain security
- 13:43Security lifecycle management
- 15:56Human factor in security
- 17:21ISO 18974 conformance
- 18:02OpenEuler resources
related talks
28mGoverning Open Source in the Enterprise: OSPO Strategies for Innovation and Compliance
45mOpen Source on Purpose; Strategy, Process and Tools to Succeed
27mEvolving Open Source Governance From Compliance To Program Offices: The LGE Case Study
15mShifting Open Source Compliance Activities Left
25mOpen Source Compliance
38mPanel: Open Source Management Based on Open Source
39mComplex Made Simple
31mOperationalizing Open Source Projects: When the Rubber Meets the Road