The Automotive OSPO
summary
Automotive companies now run OSPOs that tie license scanning into CI so a build breaks on forbidden licenses, maintain internal open source policies and trainings (e‑learning, Japanese-style comics) and track upstream contribution informally while acknowledging they lack precise metrics. Vehicles disallow GPLv3 but accept GPLv2 with compliance steps, suppliers must meet contract and SBOM expectations, and cross-industry work is underway around the Cyber Resilience Act with a three-year CRA deadline Feb 2027 to clarify obligations. Publish-or-perish push to increase company-origin projects
AI-written summary · about
chapters (14)
- 0:00Automotive OSPO panel intro
- 1:27Panelist backgrounds
- 6:06Why OSPO matters in auto
- 8:13Convincing management
- 12:54Innersource role
- 13:58Open source innovation balance
- 17:35OSPO challenges ahead
- 20:46Licenses and liabilities
- 24:54Lowering contribution barriers
- 29:53Training materials
- 31:00OSPO team structure
- 34:14Supplier expectations
- 37:03EU Cyber Resilience Act
- 40:41Closing remarks
related talks
43mPanel Discussion: The Automotive OSPO
39mPanel Discussion: OSPO Panel of Japan
26mOpen Source Program Offices
05mKeynote: Honda’s OSPO Challenge: Accelerating Strategic Collaboration for Softwar...
39mOSPOs in Energy, Transport, Automotive & Public Sector
19mDriving Automotive with Open Source: From Compliance to Collaboration
28mGoverning Open Source in the Enterprise: OSPO Strategies for Innovation and Compliance
36mOSPO Issues in a Conglomerate Company