OSS Review Toolkit

Thanks to some great community work with OWASP CycloneDX SBOM/xBOM Standard, and esp. the contributions done by Alexander Alzate, several bugs in CycloneDX's Java library version 9.0.x were fixed in short time, allowing the integration in ORT to pass ORT's test suite. As a result, we're happy to announce that today's ORT release 22.6.0 comes with full CycloneDX 1.6 support (although format version 1.5 is still written out by default, until there is wider adoption for version 1.6). Enjoy the new ORT release: https://lnkd.in/gtFnjX4h

The ORT Community Days are a wrap, and all slides are available now for download at https://lnkd.in/ekPaKxqK. Thanks to everyone who made this such a great event, first and foremost our speakers, the organizing team, and our generous hosts at Bosch Digital!

Big thanks to our friends at Bosch Digital for their continued contributions to the ORT ecosystem (see https://lnkd.in/ezwQDHaW), and esp. the creation of the ORT Server as part of Eclipse Apoapsis (see https://lnkd.in/eudfZRYK)!

At this year's ORT Community Days at the Bosch IoT Campus on 6 March, I had the opportunity to present the use of the OSS Review Toolkit (ORT) at Volkswagen. Correct and complete data is a fundamental part of Open Source Clearing in software development. In my presentation I showed how we have developed a curated database of copyrights and licences for software components, using the OSS Review Toolkit as a data pipeline and allowing curators to check for correct and complete data via a rich web front-end. This is a huge relief to the software development teams and allows us to do the OSS clearance process much more quickly.

ClearlyDefined at the ORT Community Days, the annual event organized by the OSS Review Toolkit community. ORT is an Open Source suite of tools to automate software compliance checks.

Want to learn how you can automate your organization's #opensource policy? Join us at the #ORTCommunityDays (https://lnkd.in/ekPaKxqK) this March 6 & 7 in #Berlin - we still have a few seats available. Several of our community members will also be present at FOSS Backstage in case 6 & 7 don't work for you.

We are happy to announce that the preliminary schedule for the upcoming #ORTCommunityDays is now live at https://lnkd.in/ekPaKxqK. Some of our speakers include: - Martin Nonnenmacher & Vladimir Slavov 🇪🇺 will give talks their work on ORT within Bosch Digital - Philippe Ombredanne will share updates on many of his amazing tools such as #ScanCode & #VulnerableCode - Sebastian Schuberth will talk about the Double Open Server for ORT - Petteri Kivimäki will speak how he used ORT to automate open source license compliance for the #xroad project If you are interested in OSS Review Toolkit, automating #opensource policy or #SBOM then this is the event for you. We still have a few seats available, see our event page to learn how you can sign up

We are happy to announce that the preliminary schedule for the upcoming #ORTCommunityDays is now live at https://lnkd.in/ekPaKxqK. Some of our speakers include: - Martin Nonnenmacher & Vladimir Slavov 🇪🇺 will give talks their work on ORT within Bosch Digital - Philippe Ombredanne will share updates on many of his amazing tools such as #ScanCode & #VulnerableCode - Sebastian Schuberth will talk about the Double Open Server for ORT - Petteri Kivimäki will speak how he used ORT to automate open source license compliance for the #xroad project If you are interested in OSS Review Toolkit, automating #opensource policy or #SBOM then this is the event for you. We still have a few seats available, see our event page to learn how you can sign up

Martin Nonnenmacher something for the ORT Server logo?

Very good read on the complexity of creating the "right" type of #SBOM: https://lnkd.in/ecF92QQB. This is one of the reasons why ORT analyzes the application context (the "project" in ORT-speak), leveraging the original package manager programmatically, instead of parsing package manager files statically, or re-implementing the resolution algorithm, or assuming that NPM would resolve the same dependencies as e.g. Yarn does.