Blog on OpenChain KWG

CISA 2026 SBOM Minimum Elements: What to Prepare and Which Tools Fill the Gaps

Sun, 09 Aug 2026 00:00:00 +0000

This article was written with Claude Code, and the key facts cited here were cross-checked against primary sources.

Summary

On July 29, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) and 17 other agencies published a revised set of minimum elements for a Software Bill of Materials (SBOM)A2. The document states plainly that it replaces, rather than amends, the baseline established in 2021 by the National Telecommunications and Information Administration (NTIA).

What the US AI Executive Order (2026-06-02) Means for Enterprise Open Source Managers

Wed, 10 Jun 2026 00:00:00 +0000

This article was written with Claude Code, and the key facts cited here were cross-checked against primary sources.

Summary

The executive order “Promoting Advanced Artificial Intelligence Innovation and Security,” signed on June 2, 2026, imposes no obligations on enterprises. Its substance is the Treasury Department-led AI Cybersecurity Clearinghouse (a relay body that pools, verifies, and distributes vulnerability information, to be established within 30 days) and a voluntary pre-disclosure framework for frontier models (to be designed within 60 days); mandatory licensing and pre-approval are explicitly excluded A1. No provision applies directly to enterprise open source managers either. Still, there is a reason to read this order: the context behind it. AI finding open source vulnerabilities faster than humans do has already become reality. Ahead of the executive order, an unreleased Anthropic model found 6,202 high- or critical-severity vulnerabilities in open source projects over two months, and patching has not kept pace A6·C1. What open source managers need to prepare is not compliance with the executive order, but a response system that can handle a check of patch-processing capacity, cleanup of end-of-life (EOL) components, and the EU Cyber Resilience Act reporting obligation taking effect September 11, 2026, all at once.

The EU Open Source Strategy: Institutionalizing Open Source for Tech Sovereignty

Tue, 09 Jun 2026 00:00:00 +0000

This article was written with Claude Code, and the key facts cited here were cross-checked against primary sources.

Summary

The European Commission’s “Communication on European Tech Sovereignty” (COM(2026) 503 final), published on June 3, 2026, comes with an EU Open Source Strategy attached. It is the first time open source has been placed at the center of EU digital policy. The strategy sets four objectives — leveraging open source for sovereignty, strengthening the ecosystem, opening up public administration, and reinforcing standards and international cooperation — and calls for roughly EUR 2 billion in public and private funding to be mobilized for open-source-related measures over the next seven years. The aim is to reduce the EU’s dependence on US proprietary IT, on which it spends an estimated EUR 264 billion annually. Civil society (FSFE) and policy analysts have welcomed the direction while flagging limits: whether the funding is sufficient, how open standards relate to open source, the light treatment of open hardware, and the practitioner skills gap. For Korean public-sector and enterprise practitioners, the points worth watching directly are the opening of EU procurement, the open-source steward regulation, and the open-source default for the EUDI Wallet.

AI-Generated Code: How Far Should Open-Source Scanning Go?

Mon, 08 Jun 2026 00:00:00 +0000

About this article

This article was written with the help of Claude Code, and its key facts were cross-checked against public sources.

Disclaimer

This article reflects the author’s personal analysis and is not legal advice. The cited facts were verified against public sources, but for any specific situation please consult a qualified professional such as an attorney.

First, one thing to get straight

There is no quick yes-or-no answer to this question, because the deciding factor is not AI itself — as we will see. AI coding raises the rate at which code fragments enter a codebase without being declared as packages, but it does not change the conditions under which a license obligation arises. So instead of asking “does scanning still matter in the AI era,” it helps to ask “under what conditions does snippet-level scanning matter more, and under what conditions less.”

EU Cyber Resilience Act (CRA) Vulnerability Reporting Obligations — A Research Report for the 2026-09-11 Compliance Date

Mon, 18 May 2026 00:00:00 +0000

This article was written with Claude Code, and the key facts cited here were cross-checked against primary sources.

Summary

The EU Cyber Resilience Act (Cyber Resilience Act, CRA — Regulation (EU) 2024/2847) is the EU’s first comprehensive product security regulation, imposing horizontal cybersecurity obligations on every “product with digital elements” (PDE) placed on the EU market. The regulation entered into force on December 10, 2024, and applies in phases. From September 11, 2026, the Article 14 reporting obligations take effect, requiring manufacturers, importers, and distributors to notify ENISA (the European Union Agency for Cybersecurity) and Member State CSIRTs of actively exploited vulnerabilities and severe incidents within a staged 24-hour, 72-hour, and 14-day window. Companies that have not stood up a reporting workflow by this date face fines of up to €15 million or 2.5% of worldwide annual turnover, and Korean companies that place products on the EU market are subject to the obligation immediately. A1, B1, E1

Rockchip and FFmpeg: A License Dispute Case Study

Fri, 20 Feb 2026 00:00:00 +0000

This article was written using Claude Code, and the key facts cited were cross-verified against primary sources.

Notice

This article reflects the author’s personal analysis and summary, and does not constitute legal advice. The facts cited have been verified based on publicly available sources, but legal determinations such as whether infringement has occurred are matters that can be disputed, so please have specific matters reviewed by an attorney or other expert.

The AVM Lawsuit: Revisiting LGPL-2.1 User Rights and the Obligation to Provide Installation Information

Mon, 13 Jan 2025 00:00:00 +0000

This post is based on Ars Technica’s article “German router maker is latest company to inadvertently clarify the LGPL license”. The article covers the details of the lawsuit between AVM and Sebastian Steck and the importance of LGPL license compliance.

1. Case Overview

On January 9, 2025, the Software Freedom Conservancy (SFC) announced that the lawsuit it had filed against AVM, a German network equipment manufacturer, had concluded. The core of this lawsuit concerned the rights of users specified in the GNU Lesser General Public License (LGPL) version 2.1, particularly the obligation to provide installation information.

What the Oracle v. Rimini Street Case Tells Us About the Scope of GPL Derivative Works

Mon, 23 Dec 2024 00:00:00 +0000

Introduction

In disputes over software intellectual property infringement, the concept of “derivative works” is critically important. This concept becomes a central issue especially when dealing with open source licenses such as the GNU General Public License (GPL). The recent litigation between Oracle and Rimini Street has drawn renewed attention to the legal interpretation of what counts as a derivative work. This article looks at the background of the case, the key rulings, and the implications for open source licensing.

Key Points of the EU's Three Major Digital Regulations That Korean Software Companies Need to Know

Tue, 12 Nov 2024 00:00:00 +0000

Introduction

Three major pieces of legislation the European Union (EU) has recently introduced carry very significant implications for Korean companies. The Product Liability Directive (PLD), the Cyber Resilience Act (CRA), and the AI Act present a comprehensive regulatory framework governing the development, deployment, and use of software and AI systems.

These pieces of legislation matter to Korean companies for the following reasons:

Access to the EU market: The EU is one of the largest single markets in the world, and many Korean companies aim to enter it. Failure to comply with these laws can restrict access to the EU market.
Setting a global standard: EU regulation tends to become a de facto global standard. This is the so-called ‘Brussels effect’, and other countries are likely to introduce similar regulations.
Expanded corporate liability: These laws significantly expand the scope of corporate liability. In particular, the strict liability principle under the PLD could pose a new challenge for Korean companies.

Important perspectives for Korean companies to keep in mind when approaching these laws include the following:

To Mine or Not To Mine: A German Court's Ruling on the Copyright Dilemma of the AI Era

Wed, 06 Nov 2024 00:00:00 +0000

This post is based on JBB Rechtsanwält:innen’s blog post “To Mine or Not To Mine” (https://jbb.de/to-mine-or-not-to-mine/) and is published to explain a recent German court ruling on text and data mining (TDM) and to share related knowledge.

Please note that I am not a legal professional, and this content cannot serve as a legal basis. For specific situations related to license and legal issues, please be sure to seek advice from a legal professional.

A Chinese Copyright Infringement Case: "Since GPL-Based Software Products Already Have an Obligation to Disclose Source Anyway, Isn't It Fine to Copy Them?"

Mon, 23 Sep 2024 00:00:00 +0000

As the use of open source software has spread widely, the legal issues surrounding it have grown increasingly complex. In particular, the question of copyright over derivative works based on open source projects that use a copyleft license such as GPL (GNU General Public License) is a thorny subject for many companies. A recent software copyright infringement lawsuit in China offers important implications for this issue.

Parties to the Lawsuit

Plaintiff: Wangjing Technology (Wangjing)
Defendants:
- Yibang Communication Technology (Yibang)
- Qi’ao Network Technology (Qi’ao)
- and three individuals (Liu, Wu, Xie)

Overview of the Case

In 2009, Wangjing developed a converged communication smart gateway product called “OfficeTen.”

Elasticsearch Changes Its License Again: How Should Companies Respond?

Fri, 06 Sep 2024 00:00:00 +0000

Introduction: The Background of the Elasticsearch License

Elasticsearch began as an open source project and has since gone through several changes in licensing policy. Initially it was distributed under the Apache 2.0 license, but in 2021 Elastic changed its license to the Elastic License 2.0 and the Server Side Public License. Then, on August 30, 2024, it drew attention again with an announcement (Elasticsearch is Open Source, Again) adding back the AGPL-3.0.

Introduction to SPDX 3.0 and Enterprise Adoption Strategy

Fri, 06 Sep 2024 00:00:00 +0000

1. Introduction to SPDX 3.0

SPDX (Software Package Data Exchange) is an open standard for communicating software component, license, copyright, and security information in a standardized way. SPDX 3.0 is the latest version of this standard, released in April 2024, and is a major update that significantly improves the transparency and security of the software supply chain[2].

Definition and Purpose of SPDX

SPDX is a Linux Foundation project that provides a standard format for sharing important information related to software packages. Its main purposes are as follows:

French Court Orders Major Telecom Orange to Pay Damages for GPL Violation

Mon, 19 Feb 2024 00:00:00 +0000

Hello.

Today I want to look at a case in which a French court ordered the telecom company Orange to pay damages for violating the GPL. This case seemed especially worth noting for two main reasons.

First, the defendant in this case is Orange, a major telecom operator. (Since I work at a telecom operator myself…)
Second, while GPL violation lawsuits mostly arise in embedded devices, in this case the open source at issue was used to build a B2B web service. This underscores that open source license compliance matters across every area of software development.

Through these aspects, this case looks set to reaffirm the importance of open source license compliance. It stands as an important example emphasizing that companies must thoroughly understand and comply with license requirements when using open source.

Effective Corporate Open Source Management (1): The OpenChain Project for Global Collaboration

Tue, 28 Mar 2023 00:00:00 +0000

Using open source has become almost essential to modern software development, to the point that it is said over 93% of the software products companies develop use open source. Yet there are reports that 53% of the open source used has license compliance issues, and 81% has security vulnerabilities. Given the complexity of modern software development environments and the vast software supply chain, companies developing products with open source need open source management efforts to minimize license compliance and security vulnerability risks. The Linux Foundation’s OpenChain Project is a project for carrying out these efforts at the community level, with multiple companies sharing and collaborating together.

Buy Anaconda If You Use It. If Not, Use conda-forge!

Mon, 13 Mar 2023 00:00:00 +0000

Hello.

Do you often use Anaconda when setting up a Python development environment? Python is widely used for everything from simple task automation to data analysis, AI training, and modeling, and running multiple Python projects can create the inconvenience of package version conflicts. Anaconda has the advantage of providing a virtual environment for each development project to prevent version conflicts, and it is widely used because it can be easily downloaded and installed from the homepage.

Akka Is No Longer Open Source.

Fri, 30 Sep 2022 00:00:00 +0000

There is a growing number of cases where software companies that started out as open source change their license policy. Lightbend, a US company that had maintained an Apache-2.0 open source license policy, announced in September 2022 that it would change Akka’s license to BUSL-1.1 (Business Source License). Let’s take a look at what the Business Source License is, and what the background and impact are of Lightbend changing Akka’s license to BSL.

A Quick Look at the SFC v. Vizio Ruling

Tue, 14 Jun 2022 00:00:00 +0000

Hello, this is Haksung Jang.

SFC (Software Freedom Conservancy) filed suit against Vizio, a US smart TV manufacturer, alleging violations of the GPL. On May 13, 2022, a US federal court issued a ruling related to this case.

I have put together a superficial summary of the background and implications of this ruling. Since I am not a legal expert, there may be errors in terminology or interpretation. I would appreciate it if experts could provide feedback. ^^

Challenges and Effects of Adopting InnerSource

Sun, 03 Apr 2022 00:00:00 +0000

Hello, this is Haksung Jang.

InnerSource is a method of introducing open source development methodology inside an organization to maximize cross-team sharing and collaboration, and to gain effects such as faster development speed, transparent communication, and improved code quality.

Several documents explain methods for InnerSource. Today I have briefly summarized the ways to start InnerSource and the expected effects as described in the following material, so please refer to it.

Can I Use a Publicly Available Dataset to Build a Commercial AI Service?

Mon, 14 Feb 2022 00:00:00 +0000

Hello, I’m Haksung Jang.

AI has become such an essential technology in modern business that virtually no company operates without using it. Building an AI service requires large volumes of data, and publicly available datasets are also widely used for this purpose. However, even a publicly available dataset carries copyright, so using it in a commercial AI service requires checking its license to minimize legal risks such as copyright infringement.

Is Open Source Compliance Necessary Even When Providing a Service as SaaS?

Mon, 20 Dec 2021 00:00:00 +0000

Most open source licenses place no restrictions on simply running the software, but they do require compliance with obligations such as source code disclosure and attribution when the open source is redistributed. Here, “distribution” generally means the physical delivery of software, such as selling an embedded device that carries the software or distributing a mobile app through an app market.

SaaS providers do not distribute software to deliver their service, so they can be relatively free of license obligations even when they use open source. However, some open source licenses, such as AGPL, impose license obligations even when a service is provided over a network, so care is needed there.

The Log4j 2 Security Vulnerability Incident (Log4Shell)

Sun, 12 Dec 2021 00:00:00 +0000

A vulnerability in Apache Log4j 2 (CVE-2021-44228, NVD) could lead to further damage such as malware infection, prompting urgent security update measures worldwide (2021.12.10). This post summarizes the related details.

Log4j

Log4j is an open source project from the Apache Software Foundation, used for logging purposes in most Java-based web services.

Timeline

2021.11.24 First discovered by the Alibaba Cloud security team (Apache announcement)
2021.11.30 The Log4j team opened the pull request Restrict LDAP access via JNDI (merged 12/5)
2021.11.30 The Log4j team opened the pull request no longer formats lookups in messages by default (merged 12/5)
2021.12.09 The issue began to spread after a tweet posted the Log4j 2 security PR along with a screenshot reproducing the vulnerability
2021.12.10 The issue gained widespread attention after Minecraft’s technical lead announced via tweet that the issue had been fixed
2021.12.10 The security vulnerability was patched with the release of Log4j 2.15.0
2021.12.12 The Log4j team added Disable JNDI by default
2021.12.12 Log4j 2.15.1 release candidate (JNDI disabled by default)

Scope of Impact

Log4j versions from 2.0-beta9 up to (but not including) 2.15.x
Regarding Spring Boot
- Spring Boot defaults to a different logging library, Logback, and is affected by the vulnerability only
  if the default logging system has been switched to Log4j2.
- As of 2021.12.12, in Spring Boot 2.6.1 (the latest version at the time), switching to Log4j2 without specifying a version installs 1.14.1
- Spring Boot 2.6.2, not yet released at the time, was planned to update to Log4j 2.15.x

NIPA Publishes Four Guides for Using Open Source Software

Tue, 23 Nov 2021 00:00:00 +0000

NIPA has published four guides for using open source software. (Source: https://www.oss.kr/news/show/ef0900db-f5b4-40fb-8745-f1b937fbd8d0)

The four open source software guides cover the following. The Corporate Open Source Software Governance Guide was co-authored by current OpenChain KWG steering committee members Haksung Jang, Seoyeon Lee, and Minho Hwang.

Open Source Software License Guide (Revised Edition)

Download the Open Source Software License Guide

Covers an overview and introduction to open source software licenses, how to comply with license obligations, copyright and patent considerations, license-related checklists, management approaches, notable dispute cases, and frequently asked questions, organized so the core content applicable to a company or organization can be identified and used across a range of situations.

China's First GPL Lawsuit Case: VirtualApp

Mon, 15 Nov 2021 00:00:00 +0000

Hello, this is Haksung Jang.

In September 2021, it was reported through a Chinese news article that the first GPL-related ruling in China had been handed down. I’ve summarized what I understood of it using a translation tool. Please keep in mind that, since I’m not a lawyer and don’t know Chinese, there may be errors in the content. :) If you find any errors, I’d be grateful if you’d let me know at any time (haksung@sk.com).

(Thanks to Jin-Young Choi, Center Director at the Korea Copyright Commission, for helping review this. ^^)

Does GPLv2 Also Require Installation Information?

Sun, 01 Aug 2021 00:00:00 +0000

Hello.

P. McCoy Smith, a well-known open source license attorney in the United States, recently published an article titled Does GPLv2 Require ‘Installation Information’ in JOLTS (Journal of Open Law, Technology & Society) (JOLTS).

In March 2021, the SFC (Software Freedom Conservancy) (SFC) blog published a post titled “Understanding Installation Requirements in GPLv2,” arguing that GPLv2 also requires the provision of installation information. This article analyzes that claim and explains, with detailed grounds, the view that GPLv3’s ‘Installation Information’ requirement does not apply to GPLv2.

This translation renders the original text while adding background explanations wherever possible to improve readability and help readers understand the content.

If you find any errors or have additional comments, please feel free to contact me at haksung@sk.com.

Thank you. :)

Distribution of Dockerfiles: Who Is Responsible for Compliance?

Tue, 04 May 2021 00:00:00 +0000

Hello!

In April 2021, Till Jaeger, a well-known German open source lawyer, published an article on who is responsible for the license compliance of the open source software included in the Docker image generated from a Dockerfile. Based on German law and the case law of the Court of Justice of the European Union (CJEU), Till explains that the Dockerfile provider must comply with license obligations.

This is a Korean translation of Till’s original English text. I added images to aid understanding, and here and there I added my own personal comments as blockquotes (in the polite register).

If you find translation errors or have questions, please contact me by email at haksung@sk.com

I am deeply grateful to Sean of Kakao for his help reviewing this translation. ^^

What Is an OSPO?

Sun, 18 Apr 2021 00:00:00 +0000

This paper was translated by Haksung Jang from the English version available at the OSPO Definition. The original document is licensed under CC-BY-SA-4.0.

Hello!

TODO Group¹ is a group² under the Linux Foundation that advocates Talk Openly, Develop Openly, aiming to build successful open source projects and programs through collaboration. TODO Group creates and publishes open source guides³, tools⁴, and more, making them available to anyone interested in open source.

For an organization such as a company to effectively manage and use open source, it is said that establishing an OSPO_{Open Source Program Office} is needed for activities such as developer education, ensuring compliance, engaging with and building community, releasing open source, and code review. This article carries over the article defining⁵ what an OSPO is and what role it plays, as written by TODO Group.

Elastic License 2.0 and the Evolution of Open Source Licensing

Sun, 28 Mar 2021 00:00:00 +0000

This paper was translated by Haksung Jang from the English version available at this white paper. The original author, Heather Meeker, has not reviewed this translation.

Hello.

This article is based on a white paper about the Elastic License published on March 11, 2021 by Heather Meeker, a U.S. attorney specializing in open source law. Most of it is a translation of the original article, and I have added my own opinions as blockquotes.

For reference, while Heather Meeker presented this white paper as her personal view, she also disclosed that it received some funding from Elastic. Perhaps for that reason, the original article takes a favorable stance toward the Elastic License.

(A bit of digging turned up that Heather Meeker wrote Elastic License 2.0 herself.)

In any case, as the times change and software distribution methods shift, commercial open source companies have had to think about which licensing model to adopt in order to pursue both development and business at once, and I think this article helps in understanding one aspect of the background behind the Elastic License. If you find any errors in this article, please feel free to contact me at any time. :-)

My deep thanks to Sean and Robin of Kakao, and Kyoungae Kim of LG Electronics, for their help reviewing this article.

ISO Standard, OpenChain

Wed, 16 Dec 2020 00:00:00 +0000

On December 15, 2020, OpenChain Specification 2.1 was officially published as an international standard ISO/IEC 5230:2020.

For more information on this, please refer to the following article. : https://world.einnews.com/pr_news/532725924/iso-iec-5230-2020-is-the-international-standard-for-open-source-compliance

Kakao Training Material

Tue, 24 Nov 2020 00:00:00 +0000

The open source technology part of Kakao has released open source educational materials for in-house developers so that anyone can read it.

Download

Training materials can be downloaded from the following page.

http://t1.kakaocdn.net/olive/assets/opensource_guide_kakao.pdf

NCSOFT Training Material

Mon, 23 Nov 2020 00:00:00 +0000

NCSOFT has released lecture slides and scripts, which are open source educational materials in-house, on GitHub based on the spirit of sharing open source so that anyone can use them.

Companies that develop/distribute software can use this slide as it is or extract/modify necessary parts when preparing for in-house open source training.

Anyone can participate in modifying and supplementing these materials through GitHub.

Download

These materials can be downloaded from the following page.

Open Source Compliance in the Enterprise

Mon, 23 Nov 2020 00:00:00 +0000

Introducing the Open Source Compliance in the Enterprise book

This book was written by Ibrahim Haddad and published by the Linux Foundation.

It explains in detail what to consider when building an open source compliance program in a business, and anyone can download it from the following link : Download

Korean summary

NCSOFT summarized the main contents of this book in Korean, and after getting permission from the author, Ibrahim, they released it so that open source people of Korean companies can refer to it.

Blog on OpenChain KWG

CISA 2026 SBOM Minimum Elements: What to Prepare and Which Tools Fill the Gaps

Summary

What the US AI Executive Order (2026-06-02) Means for Enterprise Open Source Managers

The EU Open Source Strategy: Institutionalizing Open Source for Tech Sovereignty

AI-Generated Code: How Far Should Open-Source Scanning Go?

First, one thing to get straight

EU Cyber Resilience Act (CRA) Vulnerability Reporting Obligations — A Research Report for the 2026-09-11 Compliance Date

Rockchip and FFmpeg: A License Dispute Case Study

The AVM Lawsuit: Revisiting LGPL-2.1 User Rights and the Obligation to Provide Installation Information

1. Case Overview

What the Oracle v. Rimini Street Case Tells Us About the Scope of GPL Derivative Works

Introduction

Key Points of the EU's Three Major Digital Regulations That Korean Software Companies Need to Know

Introduction

To Mine or Not To Mine: A German Court's Ruling on the Copyright Dilemma of the AI Era

A Chinese Copyright Infringement Case: "Since GPL-Based Software Products Already Have an Obligation to Disclose Source Anyway, Isn't It Fine to Copy Them?"

Parties to the Lawsuit

Overview of the Case

Elasticsearch Changes Its License Again: How Should Companies Respond?

Introduction: The Background of the Elasticsearch License

Introduction to SPDX 3.0 and Enterprise Adoption Strategy

1. Introduction to SPDX 3.0

Definition and Purpose of SPDX

French Court Orders Major Telecom Orange to Pay Damages for GPL Violation

Effective Corporate Open Source Management (1): The OpenChain Project for Global Collaboration

Buy Anaconda If You Use It. If Not, Use conda-forge!

Akka Is No Longer Open Source.

A Quick Look at the SFC v. Vizio Ruling

Challenges and Effects of Adopting InnerSource

Can I Use a Publicly Available Dataset to Build a Commercial AI Service?

Is Open Source Compliance Necessary Even When Providing a Service as SaaS?

The Log4j 2 Security Vulnerability Incident (Log4Shell)

Log4j

Timeline

Press Coverage (Korea)

Response Measures

Response Examples (Reference)

Scope of Impact

NIPA Publishes Four Guides for Using Open Source Software

Open Source Software License Guide (Revised Edition)

China's First GPL Lawsuit Case: VirtualApp

Does GPLv2 Also Require Installation Information?

Distribution of Dockerfiles: Who Is Responsible for Compliance?

What Is an OSPO?

Elastic License 2.0 and the Evolution of Open Source Licensing

ISO Standard, OpenChain

Kakao Training Material

Download

NCSOFT Training Material

Download

Open Source Compliance in the Enterprise

Introducing the Open Source Compliance in the Enterprise book

Korean summary