OpenChain KWG

1. Open Source Policy (Sample)

Mon, 01 Jan 0001 00:00:00 +0000

Note:

This sample open source policy was written with reference to the following two materials. 1. [OpenChain Open Source Policy Template](https://github.com/OpenChain-Project/Reference-Material/blob/master/Open-Source-Policy/Official/2.1/en/Open-Source-Policy-Template-en-OpenChain2.1-ISO5230.xlsx) 2. [Linux Foundation Generic FOSS Policy](https://github.com/todogroup/policies/blob/master/linuxfoundation/lf_compliance_generic_policy.pdf)

1. Purpose

(1) Purpose of the policy_(3.1.3.1)

This policy provides the following principles for all organizations involved in software development, service, and distribution in [COMPANY] (hereinafter referred to as the “Company”) to properly utilize open source software (hereinafter referred to as “Open Source”).

1. OpenChain Specification

Mon, 01 Jan 0001 00:00:00 +0000

OpenChain 프로젝트는 곧 OpenChain Specification 1.0을 제작하여 배포했다. OpenChain Specification은 오픈소스 컴플라이언스를 위한 핵심 요구사항을 정의한 12페이지 분량의 표준 규격으로, 기업의 규모나 업종과 관계없이 모든 분야의 회사에 적합하도록 고안되었다. 2019년 4월에는 버전 2.0의 Specification이 배포됐으며, 기업이 오픈소스 컴플라이언스 달성을 위해 꼭 수행해야 할 여섯 가지 주요 요건에 대한 설명과 이를 수행하고 있음을 입증하기 위한 검증 자료 목록을 정의하고 있다.

오픈소스 컴플라이언스를 관리하기 위한 프로그램
효과적인 리소스 제공을 위한 업무 정의 및 지원
오픈소스 검토 및 승인을 관리하는 프로세스
컴플라이언스 결과물 생성 및 제공을 위한 프로세스
오픈소스 커뮤니티 참여를 이해하고 관리하기 위한 정책
OpenChain Specification 요건 준수

오픈소스 컴플라이언스를 처음 시작하는 기업이라면 이와 같은 OpenChain Specification의 요건을 하나씩 충족해가면서 수준을 향상시키는 것이 좋은 전략이다.

1. 샘플 오픈소스 정책 for OpenChain 2.1

Mon, 01 Jan 0001 00:00:00 +0000

Note:

이 오픈소스 정책 for OpenChain 2.0\(예\)은 다음 두가지 자료를 참고하여 작성하였다. 1. OpenChain Open Source Policy Template : [https://github.com/OpenChain-Project/Reference-Material/blob/master/Policy-Templates/Official/en/2.0/Open-Source-Policy-Template-2.0-en.xlsx](https://github.com/OpenChain-Project/Reference-Material/blob/master/Policy-Templates/Official/en/2.0/Open-Source-Policy-Template-2.0-en.xlsx) 2. Linux Foundation Generic FOSS Policy : [https://github.com/todogroup/policies/blob/master/linuxfoundation/lf\_compliance\_generic\_policy.pdf](https://github.com/todogroup/policies/blob/master/linuxfoundation/lf_compliance_generic_policy.pdf)

OO회사 오픈소스 정책

1. 목적

이 정책은 오픈소스를 사용하는 조직 전체가 오픈소스 컴플라이언스 활동을 수행하도록 수립되었다. 또한 이 정책은 직원들이 오픈소스의 가치를 이해하게 하고, 오픈소스 커뮤니티에 기여하기 위한 방법을 제공한다.

<OO회사>의 직원은 이 정책의 근거와 내용을 이해하고 필요한 활동을 충실히 수행함으로써 정책의 효과 및 회사의 컴플라이언스 수준 향상에 기여한다.

1. 프로그램 성립

Mon, 01 Jan 0001 00:00:00 +0000

1.1 정책 (Policy)

오픈소스를 이용하여 소프트웨어를 개발하고 배포하는 기업이라면 오픈소스를 관리하기 위한 정책과 프로세스를 구축하고, 이를 위한 인력과 자원을 할당해야 한다. OpenChain에서는 이러한 일련의 활동을 관리하는 체계를 오픈소스 프로그램이라고 부르고, OpenChain Specification을 준수하기 위한 첫번째 요건은 바로 이 프로그램을 설립해야 하는것이다. 여기서 오픈소스 프로그램이란 정책, 프로세스, 인원 등 기업이 오픈소스 컴플라이언스 활동을 수행하기 위한 일련의 관리 체계를 의미한다. OpenChain Specification에서는 이를 입증하기 위한 자료로 우선 문서화된 오픈소스 정책을 요구한다. 이 안내서에서는 참고를 위해 OpenChain Specification의 요건을 충족하는 오픈소스 정책 문서 예시를 “[부록 01] 샘플 오픈소스 정책”에서 제공한다.

FOSSology

Mon, 01 Jan 0001 00:00:00 +0000

오픈소스 컴플라이언스를 위해 소프트웨어 내에 포함된 오픈소스와 라이선스 정보를 검출하기 위해 소스코드 스캔 도구를 사용할 수 있다.

< https://www.fossology.org/ >

Linux Foundation의 FOSSology 프로젝트는 이러한 스캔 도구를 개발하고 오픈소스로 공개해 누구나 자유롭게 사용할 수 있게 한 도구이다.

주요 특징

FOSSology는 웹기반의 프로그램으로 사용자는 웹사이트에 로그인하여 개별 파일 혹은 소프트웨어 패키지를 업로드할 수 있다. FOSSology는 업로드된 파일 내에 라이선스 텍스트와 Copyright 정보를 검출한다. 개발자는 사용하고자 하는 오픈소스의 라이선스가 무엇인지, Copyright은 어떻게 되는지에 대한 정보를 확인하고자 할때 FOSSology를 이용하는 것이 좋다. FOSSology는 개발자가 업로드한 오픈소스 패키지 내의 모든 파일을 스캔하여 각 파일 내 라이선스 관련 텍스트와 Copyright 정보를 자동으로 검출하고, 이를 리포트로 생성한다. FOSSology 주요 특징에 대한 자세한 내용은 다음 페이지를 참고할 수 있다. : https://www.fossology.org/features/

2. OpenChain Conformance

Mon, 01 Jan 0001 00:00:00 +0000

OpenChain Project는 기업이 OpenChain Specification을 충족하는지 자체적으로 확인할 수 있도록 온라인 자체 인증 웹사이트를 제공한다.

< https://certification.openchainproject.org/ >

기업의 오픈소스 담당자는 OpenChain 자체 인증 웹사이트에 가입해 온라인 자체 인증을 시작할 수 있으며, Yes/No 질문에 답변하는 방식으로 진행된다.

< https://certification.openchainproject.org/ >

자체 인증을 통해 부족한 부분이 무엇인지, 추가로 필요한 활동이 무엇인지 판단할 수 있다.

만약, 오픈소스 컴플라이언스 체계가 잘 구축된 기업이 OpenChain 자체 인증 질문지의 모든 항목을 Yes로 대답할 수 있다면 이 결과를 웹사이트상에 제출할 수 있다(Conforming Submission). 그러면 OpenChain 준수(Conformant) 기업으로 인정됨과 동시에, OpenChain 프로젝트의 웹사이트에서 OpenChain 준수 프로그램을 갖춘 기업 목록에 기업의 로고를 등록할 수 있게 된다.

2. 관련 업무 정의 및 지원

Mon, 01 Jan 0001 00:00:00 +0000

2.1 접근성 (Access)

OpenChain Specification 2.0

2.1 접근성

외부 오픈소스 문의에 효과적으로 대응할 수 있는 프로세스를 유지한다. 제 3자가 오픈소스 컴플라이언스 문의를 할 수 있는 방법을 공개적으로 밝힌다.

입증 자료:

2.1.1 제 3자가 오픈소스 컴플라이언스 문의를 할 수 있게 공개적으로 알려진 방법 (공개된 연락처 이메일 주소, 또는 Linux Foundation의 Open Compliance Directory 등).
2.1.2 제 3자의 오픈소스 라이선스 컴플라이언스 문의에 대응하기 위한 내부의 문서화된 절차.

2.1 Access

Maintain a process to effectively respond to external Open Source inquiries. Publicly identify a means by which a third party can make an Open Source compliance inquiry.

Verification Material(s):

2.1.1 Publicly visible method that allows any third party to make an Open Source license compliance inquiry (e.g., via a published contact email address, or the Linux Foundation’s Open Compliance Directory).
2.1.2 An internal documented procedure for responding to third party Open Source license compliance inquiries.

2. 오픈소스 컴플라이언스 프로세스 (template)

Mon, 01 Jan 0001 00:00:00 +0000

오픈소스 컴플라이언스의 주요 두가지 목적은 다음과 같다.

의무 파악 : 공급 대상 소프트웨어가 포함하고 있는 오픈소스를 식별하고 각 오픈소스 라이선스가 요구하는 의무를 파악한다.
의무 사항 이행 : 식별한 의무 사항을 이행한다.

이를 위해 기업은 공급 대상 소프트웨어를 배포하는 시점에 오픈소스 라이선스 의무사항을 준수할 수 있도록 오픈소스 컴플라이언스 프로세스를 구축해야 한다. 여기서는 일반적인 오픈소스 컴플라이언스 프로세스의 구성요소와 각각의 기능 및 역할을 포함하는 프로세스(예시)를 제안한다.

Note:

이 오픈소스 컴플라이언스 프로세스 \(예시\)는 다음 자료를 참고하여 작성하였다. * Open Source Compliance In The Enterprise / Ibrahim Haddad : [https://www.linuxfoundation.org/compliance-and-security/2018/12/open-source-compliance-in-the-enterprise/](https://www.linuxfoundation.org/compliance-and-security/2018/12/open-source-compliance-in-the-enterprise/)

<OO 회사> 오픈소스 컴플라이언스 프로세스 (예시)

<OO 회사>의 오픈소스 정책에 근거하여 오픈소스를 사용하기 위해서는 먼저 오픈소스 라이선스가 무엇인지 식별하고, 라이선스가 요구하는 의무 사항을 검토하고 확인해야 한다. 그렇게 공급 대상 소프트웨어에 포함된 오픈소스와 라이선스 의무사항을 식별하고, 소프트웨어를 배포 시 라이선스 의무사항을 준수하기 위한 오픈소스 컴플라이언스 활동을 해야 한다.

SW360

Mon, 01 Jan 0001 00:00:00 +0000

오픈소스를 포함하는 제품을 개발하고 배포하는 기업이라면 각 제품과 릴리스 버전마다 사용한 오픈소스의 버전, 라이선스 등의 정보를 수집하고 추적해야 한다. 이를 통해 기업은 올바른 오픈소스 컴플라이언스 활동을 수행할 수 있다.

특히, NVD (https://nvd.nist.gov/vuln)에서 특정 오픈소스 버전에 보안 취약점이 보고 되었을때, 해당 버전을 사용하고 있는 제품이 무엇인지 추적을 할 수 없다면, 그 기업은 어느 제품에 보안 패치를 적용해야 할 지 알 수 없는 상황에 처하게 되고, 그 기업의 제품들은 보안취약점에 그대로 노출이 될 수 밖에 없다.

3. OpenChain Curriculum

Mon, 01 Jan 0001 00:00:00 +0000

OpenChain 프로젝트에서는 기업이 컴플라이언스 프로그램을 구축하는데 필요한 정책 문서 템플릿, 교육 자료 등 다양한 참고자료를 제공한다. 이 자료들은 OpenChain Specification 및 일반적인 오픈소스 컴플라이언스 활동을 지원하기 위해 고안됐으며, 누구나 자유롭게 사용할 수 있도록 Public Domain으로 제공된다.

< https://www.openchainproject.org/resources >

3. 오픈소스 콘텐츠 검토 및 승인

Mon, 01 Jan 0001 00:00:00 +0000

3.1 BOM (Bill of Materials)

OpenChain Specification 2.0

3.1 BOM

공급 대상 소프트웨어를 구성하는 각 오픈소스 컴포넌트(및 식별된 라이선스)를 포함하는 BOM을 작성하고 관리하는 프로세스가 있다.

입증 자료:

3.1.1 공급 대상 소프트웨어를 구성하는 오픈소스 컴포넌트 모음에 대한 정보를 식별, 추적, 검토, 승인 및 보관하는 문서화된 절차
3.1.2 공급 대상 소프트웨어에 대해 문서화된 절차가 적절히 준수되었음을 입증하는 오픈소스 컴포넌트 기록.

3.1 Bill of Materials

A process exists for creating and managing a bill of materials that includes each Open Source component (and its Identified Licenses) from which the Supplied Software is comprised.

Verification Material(s):

3.1.1 A documented procedure for identifying, tracking, reviewing, approving, and archiving information about the collection of Open Source components from which the Supplied Software is comprised.
3.1.2 Open Source component records for the Supplied Software that demonstrates the documented procedure was properly followed.

4. 컴플라이언스 결과물 생성 및 전달

Mon, 01 Jan 0001 00:00:00 +0000

OpenChain Specification 2.0

4.1 컴플라이언스 결과물

공급 대상 소프트웨어에 대한 컴플라이언스 결과물 세트를 생성하는 프로세스가존재한다.

입증 자료:

4.1.1 식별된 라이선스에서 요구하는 대로 컴플라이언스 결과물을 준비하고 공급 대상 소프트웨어와 함께 배포하기 위한 프로세스를 설명하는 문서화된 절차.
4.1.2 공급 대상 소프트웨어의 컴플라이언스 결과물 사본을 보관하기 위한 문서화된 절차 - 보관 파일은 공급 대상 소프트웨어의 마지막 제공 이후 적절한 기간(혹은 식별된 라이선스가 요구하는 기간 (둘 중 더 긴 시간)) 동안 보관되어야 한다. 절차가 올바르게 지켜졌음을 입증하는 기록이 존재한다.

4.1 Compliance Artifacts

A process exists for creating the set of Compliance Artifacts for the Supplied Software.

Verification Materials(s):

4.1.1 A documented procedure that describes the process under which the Compliance Artifacts are prepared and distributed with the Supplied Software as required by the Identified Licenses.
4.1.2 A documented procedure for archiving copies of the Compliance Artifacts of the Supplied Software - where the archive is planned to exist for a reasonable period of time since the last offer of the Supplied Software; or as required by the Identified Licenses (whichever is longer). Records exist that demonstrate the procedure has been properly followed.

5. 오픈소스 커뮤니티 참여에 대한 이해

Mon, 01 Jan 0001 00:00:00 +0000

5.1 기여 (Contributions)

OpenChain Specification 2.0

5.1 기여

조직이 오픈소스 프로젝트에 기여를 고려한다면

오픈소스 프로젝트에 대한 기여를 관리하는 문서화된 정책이 존재한다;
이 정책이 내부적으로 전달되어야 한다;
정책을 구현하는 프로세스가 존재한다.

입증 자료:

조직이 오픈소스 프로젝트에 대한 기여를 허용한다면 다음이 존재해야 한다:
5.1.1 문서화된 오픈소스 기여 정책;
5.1.2 오픈소스 기여를 관리하는 문서화된 절차;
5.1.3 모든 소프트웨어 공급 담당자가 오픈소스 기여 정책의 존재를 인식하도록 하는 문서화된 절차 (교육, 내부 위키, 또는 기타 실질적인 의사소통 방법 등).

5.1 Contributions

If an organization considers contributions to Open Source projects then

a written policy exists that governs contributions to Open Source projects;
the policy must be internally communicated; and
a process exists that implements the policy

Verification Materials(s):

If an organization permits contributions to Open Source projects then the following must exist:

5.1.1 a documented Open Source contribution policy;
5.1.2 a documented procedure that governs Open Source contributions; and
5.1.3 a documented procedure that makes all Software Staff aware of the existence of the Open Source contribution policy (e.g., via training, internal wiki, or other practical communication method).

6. 설명서 요건 준수

Mon, 01 Jan 0001 00:00:00 +0000

6.1 준수 (Conformance)

OpenChain Specification 2.0

6.1 준수

프로그램이 OpenChain을 준수한다고 간주되려면 조직은 프로그램이 이 설명서에 제시된 요건을 충족하는지 확인해야 한다.

입증 자료:

6.1.1 요건 1.4에 명시된 프로그램을 확인하는 문서는 이 설명서의 모든 요건을 충족한다.

6.1 Conformance

In order for a Program to be deemed OpenChain Conformant, the organization must affirm that the program satisfies the requirements presented in this specification.

Verification Materials(s):

6.1.1 A document affirming the Program specified in requirement 1.4 satisfies all the requirements of this specification.

CISA 2026 SBOM Minimum Elements: What to Prepare and Which Tools Fill the Gaps

Sun, 09 Aug 2026 00:00:00 +0000

This article was written with Claude Code, and the key facts cited here were cross-checked against primary sources.

Summary

On July 29, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) and 17 other agencies published a revised set of minimum elements for a Software Bill of Materials (SBOM)A2. The document states plainly that it replaces, rather than amends, the baseline established in 2021 by the National Telecommunications and Information Administration (NTIA).

What the US AI Executive Order (2026-06-02) Means for Enterprise Open Source Managers

Wed, 10 Jun 2026 00:00:00 +0000

This article was written with Claude Code, and the key facts cited here were cross-checked against primary sources.

Summary

The executive order “Promoting Advanced Artificial Intelligence Innovation and Security,” signed on June 2, 2026, imposes no obligations on enterprises. Its substance is the Treasury Department-led AI Cybersecurity Clearinghouse (a relay body that pools, verifies, and distributes vulnerability information, to be established within 30 days) and a voluntary pre-disclosure framework for frontier models (to be designed within 60 days); mandatory licensing and pre-approval are explicitly excluded A1. No provision applies directly to enterprise open source managers either. Still, there is a reason to read this order: the context behind it. AI finding open source vulnerabilities faster than humans do has already become reality. Ahead of the executive order, an unreleased Anthropic model found 6,202 high- or critical-severity vulnerabilities in open source projects over two months, and patching has not kept pace A6·C1. What open source managers need to prepare is not compliance with the executive order, but a response system that can handle a check of patch-processing capacity, cleanup of end-of-life (EOL) components, and the EU Cyber Resilience Act reporting obligation taking effect September 11, 2026, all at once.

The EU Open Source Strategy: Institutionalizing Open Source for Tech Sovereignty

Tue, 09 Jun 2026 00:00:00 +0000

This article was written with Claude Code, and the key facts cited here were cross-checked against primary sources.

Summary

The European Commission’s “Communication on European Tech Sovereignty” (COM(2026) 503 final), published on June 3, 2026, comes with an EU Open Source Strategy attached. It is the first time open source has been placed at the center of EU digital policy. The strategy sets four objectives — leveraging open source for sovereignty, strengthening the ecosystem, opening up public administration, and reinforcing standards and international cooperation — and calls for roughly EUR 2 billion in public and private funding to be mobilized for open-source-related measures over the next seven years. The aim is to reduce the EU’s dependence on US proprietary IT, on which it spends an estimated EUR 264 billion annually. Civil society (FSFE) and policy analysts have welcomed the direction while flagging limits: whether the funding is sufficient, how open standards relate to open source, the light treatment of open hardware, and the practitioner skills gap. For Korean public-sector and enterprise practitioners, the points worth watching directly are the opening of EU procurement, the open-source steward regulation, and the open-source default for the EUDI Wallet.

AI-Generated Code: How Far Should Open-Source Scanning Go?

Mon, 08 Jun 2026 00:00:00 +0000

About this article

This article was written with the help of Claude Code, and its key facts were cross-checked against public sources.

Disclaimer

This article reflects the author’s personal analysis and is not legal advice. The cited facts were verified against public sources, but for any specific situation please consult a qualified professional such as an attorney.

First, one thing to get straight

There is no quick yes-or-no answer to this question, because the deciding factor is not AI itself — as we will see. AI coding raises the rate at which code fragments enter a codebase without being declared as packages, but it does not change the conditions under which a license obligation arises. So instead of asking “does scanning still matter in the AI era,” it helps to ask “under what conditions does snippet-level scanning matter more, and under what conditions less.”

EU Cyber Resilience Act (CRA) Vulnerability Reporting Obligations — A Research Report for the 2026-09-11 Compliance Date

Mon, 18 May 2026 00:00:00 +0000

This article was written with Claude Code, and the key facts cited here were cross-checked against primary sources.

Summary

The EU Cyber Resilience Act (Cyber Resilience Act, CRA — Regulation (EU) 2024/2847) is the EU’s first comprehensive product security regulation, imposing horizontal cybersecurity obligations on every “product with digital elements” (PDE) placed on the EU market. The regulation entered into force on December 10, 2024, and applies in phases. From September 11, 2026, the Article 14 reporting obligations take effect, requiring manufacturers, importers, and distributors to notify ENISA (the European Union Agency for Cybersecurity) and Member State CSIRTs of actively exploited vulnerabilities and severe incidents within a staged 24-hour, 72-hour, and 14-day window. Companies that have not stood up a reporting workflow by this date face fines of up to €15 million or 2.5% of worldwide annual turnover, and Korean companies that place products on the EU market are subject to the obligation immediately. A1, B1, E1

Rockchip and FFmpeg: A License Dispute Case Study

Fri, 20 Feb 2026 00:00:00 +0000

This article was written using Claude Code, and the key facts cited were cross-verified against primary sources.

Notice

This article reflects the author’s personal analysis and summary, and does not constitute legal advice. The facts cited have been verified based on publicly available sources, but legal determinations such as whether infringement has occurred are matters that can be disputed, so please have specific matters reviewed by an attorney or other expert.

The AVM Lawsuit: Revisiting LGPL-2.1 User Rights and the Obligation to Provide Installation Information

Mon, 13 Jan 2025 00:00:00 +0000

This post is based on Ars Technica’s article “German router maker is latest company to inadvertently clarify the LGPL license”. The article covers the details of the lawsuit between AVM and Sebastian Steck and the importance of LGPL license compliance.

1. Case Overview

On January 9, 2025, the Software Freedom Conservancy (SFC) announced that the lawsuit it had filed against AVM, a German network equipment manufacturer, had concluded. The core of this lawsuit concerned the rights of users specified in the GNU Lesser General Public License (LGPL) version 2.1, particularly the obligation to provide installation information.

What the Oracle v. Rimini Street Case Tells Us About the Scope of GPL Derivative Works

Mon, 23 Dec 2024 00:00:00 +0000

Introduction

In disputes over software intellectual property infringement, the concept of “derivative works” is critically important. This concept becomes a central issue especially when dealing with open source licenses such as the GNU General Public License (GPL). The recent litigation between Oracle and Rimini Street has drawn renewed attention to the legal interpretation of what counts as a derivative work. This article looks at the background of the case, the key rulings, and the implications for open source licensing.

Key Points of the EU's Three Major Digital Regulations That Korean Software Companies Need to Know

Tue, 12 Nov 2024 00:00:00 +0000

Introduction

Three major pieces of legislation the European Union (EU) has recently introduced carry very significant implications for Korean companies. The Product Liability Directive (PLD), the Cyber Resilience Act (CRA), and the AI Act present a comprehensive regulatory framework governing the development, deployment, and use of software and AI systems.

These pieces of legislation matter to Korean companies for the following reasons:

Access to the EU market: The EU is one of the largest single markets in the world, and many Korean companies aim to enter it. Failure to comply with these laws can restrict access to the EU market.
Setting a global standard: EU regulation tends to become a de facto global standard. This is the so-called ‘Brussels effect’, and other countries are likely to introduce similar regulations.
Expanded corporate liability: These laws significantly expand the scope of corporate liability. In particular, the strict liability principle under the PLD could pose a new challenge for Korean companies.

Important perspectives for Korean companies to keep in mind when approaching these laws include the following:

To Mine or Not To Mine: A German Court's Ruling on the Copyright Dilemma of the AI Era

Wed, 06 Nov 2024 00:00:00 +0000

This post is based on JBB Rechtsanwält:innen’s blog post “To Mine or Not To Mine” (https://jbb.de/to-mine-or-not-to-mine/) and is published to explain a recent German court ruling on text and data mining (TDM) and to share related knowledge.

Please note that I am not a legal professional, and this content cannot serve as a legal basis. For specific situations related to license and legal issues, please be sure to seek advice from a legal professional.

A Chinese Copyright Infringement Case: "Since GPL-Based Software Products Already Have an Obligation to Disclose Source Anyway, Isn't It Fine to Copy Them?"

Mon, 23 Sep 2024 00:00:00 +0000

As the use of open source software has spread widely, the legal issues surrounding it have grown increasingly complex. In particular, the question of copyright over derivative works based on open source projects that use a copyleft license such as GPL (GNU General Public License) is a thorny subject for many companies. A recent software copyright infringement lawsuit in China offers important implications for this issue.

Parties to the Lawsuit

Plaintiff: Wangjing Technology (Wangjing)
Defendants:
- Yibang Communication Technology (Yibang)
- Qi’ao Network Technology (Qi’ao)
- and three individuals (Liu, Wu, Xie)

Overview of the Case

In 2009, Wangjing developed a converged communication smart gateway product called “OfficeTen.”

Elasticsearch Changes Its License Again: How Should Companies Respond?

Fri, 06 Sep 2024 00:00:00 +0000

Introduction: The Background of the Elasticsearch License

Elasticsearch began as an open source project and has since gone through several changes in licensing policy. Initially it was distributed under the Apache 2.0 license, but in 2021 Elastic changed its license to the Elastic License 2.0 and the Server Side Public License. Then, on August 30, 2024, it drew attention again with an announcement (Elasticsearch is Open Source, Again) adding back the AGPL-3.0.

Introduction to SPDX 3.0 and Enterprise Adoption Strategy

Fri, 06 Sep 2024 00:00:00 +0000

1. Introduction to SPDX 3.0

SPDX (Software Package Data Exchange) is an open standard for communicating software component, license, copyright, and security information in a standardized way. SPDX 3.0 is the latest version of this standard, released in April 2024, and is a major update that significantly improves the transparency and security of the software supply chain[2].

Definition and Purpose of SPDX

SPDX is a Linux Foundation project that provides a standard format for sharing important information related to software packages. Its main purposes are as follows:

French Court Orders Major Telecom Orange to Pay Damages for GPL Violation

Mon, 19 Feb 2024 00:00:00 +0000

Hello.

Today I want to look at a case in which a French court ordered the telecom company Orange to pay damages for violating the GPL. This case seemed especially worth noting for two main reasons.

First, the defendant in this case is Orange, a major telecom operator. (Since I work at a telecom operator myself…)
Second, while GPL violation lawsuits mostly arise in embedded devices, in this case the open source at issue was used to build a B2B web service. This underscores that open source license compliance matters across every area of software development.

Through these aspects, this case looks set to reaffirm the importance of open source license compliance. It stands as an important example emphasizing that companies must thoroughly understand and comply with license requirements when using open source.

Checklist for Preparing an In-Person Meeting

Wed, 05 Apr 2023 00:00:00 +0000

Hello. Last March 28 was a time everyone will remember. It was our first in-person meeting in three years, since before COVID. Having gone so long without one, I learned that hosting a venue takes more ~~miscellaneous~~ preparation than I expected.

We’ll hold another in-person meeting like this at some point, so drawing on this experience, I put together a checklist for preparing one. (The next host might end up being me again… oops, better not jinx it!)

Effective Open Source Management Practices for Companies (2): OpenChain Korea Work Group

Mon, 03 Apr 2023 00:00:00 +0000

In the previous post, I introduced the OpenChain Project for global collaboration as an effective open source management practice for companies. This time, I would like to introduce the OpenChain Korea Work Group, a collaborative community for Korean companies to effectively manage open source.

OpenChain Korea Work Group

The OpenChain Korea Work Group (KWG) is a subgroup of the Linux Foundation’s OpenChain Project. This group is a gathering where, through the open source spirit of collaboration and sharing, everyone thinks about and shares ways to succeed at effective open source management. Open source managers from Korea’s major ICT companies participate in the KWG.

Effective Corporate Open Source Management (1): The OpenChain Project for Global Collaboration

Tue, 28 Mar 2023 00:00:00 +0000

Using open source has become almost essential to modern software development, to the point that it is said over 93% of the software products companies develop use open source. Yet there are reports that 53% of the open source used has license compliance issues, and 81% has security vulnerabilities. Given the complexity of modern software development environments and the vast software supply chain, companies developing products with open source need open source management efforts to minimize license compliance and security vulnerability risks. The Linux Foundation’s OpenChain Project is a project for carrying out these efforts at the community level, with multiple companies sharing and collaborating together.

Buy Anaconda If You Use It. If Not, Use conda-forge!

Mon, 13 Mar 2023 00:00:00 +0000

Hello.

Do you often use Anaconda when setting up a Python development environment? Python is widely used for everything from simple task automation to data analysis, AI training, and modeling, and running multiple Python projects can create the inconvenience of package version conflicts. Anaconda has the advantage of providing a virtual environment for each development project to prevent version conflicts, and it is widely used because it can be easily downloaded and installed from the homepage.

Akka Is No Longer Open Source.

Fri, 30 Sep 2022 00:00:00 +0000

There is a growing number of cases where software companies that started out as open source change their license policy. Lightbend, a US company that had maintained an Apache-2.0 open source license policy, announced in September 2022 that it would change Akka’s license to BUSL-1.1 (Business Source License). Let’s take a look at what the Business Source License is, and what the background and impact are of Lightbend changing Akka’s license to BSL.

A Quick Look at the SFC v. Vizio Ruling

Tue, 14 Jun 2022 00:00:00 +0000

Hello, this is Haksung Jang.

SFC (Software Freedom Conservancy) filed suit against Vizio, a US smart TV manufacturer, alleging violations of the GPL. On May 13, 2022, a US federal court issued a ruling related to this case.

I have put together a superficial summary of the background and implications of this ruling. Since I am not a legal expert, there may be errors in terminology or interpretation. I would appreciate it if experts could provide feedback. ^^

Challenges and Effects of Adopting InnerSource

Sun, 03 Apr 2022 00:00:00 +0000

Hello, this is Haksung Jang.

InnerSource is a method of introducing open source development methodology inside an organization to maximize cross-team sharing and collaboration, and to gain effects such as faster development speed, transparent communication, and improved code quality.

Several documents explain methods for InnerSource. Today I have briefly summarized the ways to start InnerSource and the expected effects as described in the following material, so please refer to it.

Can I Use a Publicly Available Dataset to Build a Commercial AI Service?

Mon, 14 Feb 2022 00:00:00 +0000

Hello, I’m Haksung Jang.

AI has become such an essential technology in modern business that virtually no company operates without using it. Building an AI service requires large volumes of data, and publicly available datasets are also widely used for this purpose. However, even a publicly available dataset carries copyright, so using it in a commercial AI service requires checking its license to minimize legal risks such as copyright infringement.

Is Open Source Compliance Necessary Even When Providing a Service as SaaS?

Mon, 20 Dec 2021 00:00:00 +0000

Most open source licenses place no restrictions on simply running the software, but they do require compliance with obligations such as source code disclosure and attribution when the open source is redistributed. Here, “distribution” generally means the physical delivery of software, such as selling an embedded device that carries the software or distributing a mobile app through an app market.

SaaS providers do not distribute software to deliver their service, so they can be relatively free of license obligations even when they use open source. However, some open source licenses, such as AGPL, impose license obligations even when a service is provided over a network, so care is needed there.

The Log4j 2 Security Vulnerability Incident (Log4Shell)

Sun, 12 Dec 2021 00:00:00 +0000

A vulnerability in Apache Log4j 2 (CVE-2021-44228, NVD) could lead to further damage such as malware infection, prompting urgent security update measures worldwide (2021.12.10). This post summarizes the related details.

Log4j

Log4j is an open source project from the Apache Software Foundation, used for logging purposes in most Java-based web services.

Timeline

2021.11.24 First discovered by the Alibaba Cloud security team (Apache announcement)
2021.11.30 The Log4j team opened the pull request Restrict LDAP access via JNDI (merged 12/5)
2021.11.30 The Log4j team opened the pull request no longer formats lookups in messages by default (merged 12/5)
2021.12.09 The issue began to spread after a tweet posted the Log4j 2 security PR along with a screenshot reproducing the vulnerability
2021.12.10 The issue gained widespread attention after Minecraft’s technical lead announced via tweet that the issue had been fixed
2021.12.10 The security vulnerability was patched with the release of Log4j 2.15.0
2021.12.12 The Log4j team added Disable JNDI by default
2021.12.12 Log4j 2.15.1 release candidate (JNDI disabled by default)

Scope of Impact

Log4j versions from 2.0-beta9 up to (but not including) 2.15.x
Regarding Spring Boot
- Spring Boot defaults to a different logging library, Logback, and is affected by the vulnerability only
  if the default logging system has been switched to Log4j2.
- As of 2021.12.12, in Spring Boot 2.6.1 (the latest version at the time), switching to Log4j2 without specifying a version installs 1.14.1
- Spring Boot 2.6.2, not yet released at the time, was planned to update to Log4j 2.15.x

NIPA Publishes Four Guides for Using Open Source Software

Tue, 23 Nov 2021 00:00:00 +0000

NIPA has published four guides for using open source software. (Source: https://www.oss.kr/news/show/ef0900db-f5b4-40fb-8745-f1b937fbd8d0)

The four open source software guides cover the following. The Corporate Open Source Software Governance Guide was co-authored by current OpenChain KWG steering committee members Haksung Jang, Seoyeon Lee, and Minho Hwang.

Open Source Software License Guide (Revised Edition)

Download the Open Source Software License Guide

Covers an overview and introduction to open source software licenses, how to comply with license obligations, copyright and patent considerations, license-related checklists, management approaches, notable dispute cases, and frequently asked questions, organized so the core content applicable to a company or organization can be identified and used across a range of situations.

China's First GPL Lawsuit Case: VirtualApp

Mon, 15 Nov 2021 00:00:00 +0000

Hello, this is Haksung Jang.

In September 2021, it was reported through a Chinese news article that the first GPL-related ruling in China had been handed down. I’ve summarized what I understood of it using a translation tool. Please keep in mind that, since I’m not a lawyer and don’t know Chinese, there may be errors in the content. :) If you find any errors, I’d be grateful if you’d let me know at any time (haksung@sk.com).

(Thanks to Jin-Young Choi, Center Director at the Korea Copyright Commission, for helping review this. ^^)

SK Telecom is the first Telecommunications Operator to adopt OpenChain ISO 5230

Thu, 09 Sep 2021 00:00:00 +0000

SK Telecom, South Korea’s largest wireless carrier, is the first telecommunications operator to adopt OpenChain ISO 5230. This leap forward in governance builds on their long-term mission to lead in technological capabilities in 5G, AI, big data analysis, IoT and quantum cryptography communications as a global ICT leader.

SK telecom

“SK Telecom is preparing for its transition to an AI company, and is strategically using open source to develop advanced technologies in AI, 5G, and cloud technology”, says Kim Yoon, CTO, SK Telecom. “Open source, essential for the early introduction of new technologies and rapid technological change, forms a key part of our strategy. We adopted OpenChain ISO 5230, the International Standard for open source compliance, to ensure effective process management in this space. We are also spreading our know-how around complying with open source international standards to SK affiliates and software supply chains to drive further expansion of open source ecosystems and to deliver even greater social value.”

Does GPLv2 Also Require Installation Information?

Sun, 01 Aug 2021 00:00:00 +0000

Hello.

P. McCoy Smith, a well-known open source license attorney in the United States, recently published an article titled Does GPLv2 Require ‘Installation Information’ in JOLTS (Journal of Open Law, Technology & Society) (JOLTS).

In March 2021, the SFC (Software Freedom Conservancy) (SFC) blog published a post titled “Understanding Installation Requirements in GPLv2,” arguing that GPLv2 also requires the provision of installation information. This article analyzes that claim and explains, with detailed grounds, the view that GPLv3’s ‘Installation Information’ requirement does not apply to GPLv2.

This translation renders the original text while adding background explanations wherever possible to improve readability and help readers understand the content.

If you find any errors or have additional comments, please feel free to contact me at haksung@sk.com.

Thank you. :)

Samsung Electronics Announces OpenChain ISO 5230 Conformance

Thu, 08 Jul 2021 00:00:00 +0000

Samsung Electronics announces adoption of OpenChain ISO 5230, the International Standard for open source compliance. They join a growing community of companies in the consumer electronics, automotive, cloud computing and telecommunications field in using this standard to manage supply chains.

Samsung

“Samsung Electronics has been consistently striving to build an open source compliance process. Our adoption of OpenChain ISO 5230 reflects our ongoing commitment to excellence in our field,” says Daniel Park, Head of Open Source Group. “OpenChain has greatly helped improve the efficiency and confidence of the process. We are pleased to be a part of OpenChain and sincerely look forward to further developing this standard with our peers and suppliers.”

오픈소스SW 관리 툴 ‘포스라이트’ 공개한 LG전자, “글로벌 표준 거듭나겠다”

Mon, 28 Jun 2021 00:00:00 +0000

최근 LG전자가 자체 개발해 2014년부터 운영해오고 있는 오픈소스 SW관리 도구인 ‘포스라이트(FOSSLight ; Free and Open Source Software Light)’를 공개해 주목을 받고 있다. 포스라이트는 개발자의 SW를 분석해 오픈소스를 사용했는지, 오픈소스 사용 조건이나 의무사항을 준수했는지 등을 검증해 주는 툴이다.

LG전자 오픈소스 태스크. 사진 왼쪽부터 방재권 선임, 김소임 선임, 최혜성 책임, 김경애 리더, 석지영 선임, 박원재 선임
백지영 기자

‘포스라이트’라는 이름으로 외부에 공개하면서 안정성과 기능을 확대하는 한편 글로벌 인지도를 높일 수 있게 할 계획이다. 포스라이트에는 ‘세상에 빛을 밝혀줄 오픈소스’라는 의미가 담겼다.

한 달 걸리던 카카오톡 오픈소스 관리, 이틀이면 충분

Mon, 28 Jun 2021 00:00:00 +0000

“한 달이 걸리던 카카오톡 오픈소스 관리 작업을 올리브를 사용하면 하루 이틀이면 충분할 것이다.”

카카오의 황은경 오픈소스기술파트장은 오픈소스 관리 서비스 ‘올리브’의 정식 버전에 대해 소개하며 위와 같이 말했다.

카카오가 오픈소스 관리플랫폼 '올리브'를 29일 정식 출시한다(이미지=카카오)
카카오

올리브는 복잡한 오픈소스 라이선스 관리를 자동화하는 개발 지원 도구다. 자동으로 소프트웨어를 분석해 오픈소스를 사용했는지, 오픈소스 사용 조건이나 의무사항 등을 목록별로 정리해 제공한다.

자세한 내용은 기사 원문에서 확인하세요. : https://zdnet.co.kr/view/?no=20210628143239

SK텔레콤, 개발자와 소통하는 커뮤니티 ‘DEVOCEAN’ 론칭

Mon, 14 Jun 2021 00:00:00 +0000

SK텔레콤이 스타트업·대학 등 외부 개발자들과 소통하는 오픈 커뮤니티를 론칭하며 SK의 ICT 역량을 적극 공유에 나선다.

‘데보션’은 개발자들을 위한 영감의 바다(Developer’s Ocean)라는 뜻으로, 개발자들이 지식과 경허을 공유하는 커뮤니티를 ‘바다’에 비유했다.

SK텔레콤은 SK하이닉스, SK㈜C&C, SK브로드밴드, SK플래닛 등 SK ICT패밀리사 개발전문가들과 외부 개발인재간 소통과 기술 공유를 위한 디벨로퍼 릴레이션 채널인 ‘데보션’을 론칭했다. 사진=SK텔레콤
SK텔레콤

자세한 내용은 기사 원문에서 확인하세요. : https://www.fntimes.com/html/view.php?ud=202106140855478693645ffc9771_18

Distribution of Dockerfiles: Who Is Responsible for Compliance?

Tue, 04 May 2021 00:00:00 +0000

Hello!

In April 2021, Till Jaeger, a well-known German open source lawyer, published an article on who is responsible for the license compliance of the open source software included in the Docker image generated from a Dockerfile. Based on German law and the case law of the Court of Justice of the European Union (CJEU), Till explains that the Dockerfile provider must comply with license obligations.

This is a Korean translation of Till’s original English text. I added images to aid understanding, and here and there I added my own personal comments as blockquotes (in the polite register).

If you find translation errors or have questions, please contact me by email at haksung@sk.com

I am deeply grateful to Sean of Kakao for his help reviewing this translation. ^^

What Is an OSPO?

Sun, 18 Apr 2021 00:00:00 +0000

This paper was translated by Haksung Jang from the English version available at the OSPO Definition. The original document is licensed under CC-BY-SA-4.0.

Hello!

TODO Group¹ is a group² under the Linux Foundation that advocates Talk Openly, Develop Openly, aiming to build successful open source projects and programs through collaboration. TODO Group creates and publishes open source guides³, tools⁴, and more, making them available to anyone interested in open source.

For an organization such as a company to effectively manage and use open source, it is said that establishing an OSPO_{Open Source Program Office} is needed for activities such as developer education, ensuring compliance, engaging with and building community, releasing open source, and code review. This article carries over the article defining⁵ what an OSPO is and what role it plays, as written by TODO Group.

Elastic License 2.0 and the Evolution of Open Source Licensing

Sun, 28 Mar 2021 00:00:00 +0000

This paper was translated by Haksung Jang from the English version available at this white paper. The original author, Heather Meeker, has not reviewed this translation.

Hello.

This article is based on a white paper about the Elastic License published on March 11, 2021 by Heather Meeker, a U.S. attorney specializing in open source law. Most of it is a translation of the original article, and I have added my own opinions as blockquotes.

For reference, while Heather Meeker presented this white paper as her personal view, she also disclosed that it received some funding from Elastic. Perhaps for that reason, the original article takes a favorable stance toward the Elastic License.

(A bit of digging turned up that Heather Meeker wrote Elastic License 2.0 herself.)

In any case, as the times change and software distribution methods shift, commercial open source companies have had to think about which licensing model to adopt in order to pursue both development and business at once, and I think this article helps in understanding one aspect of the background behind the Elastic License. If you find any errors in this article, please feel free to contact me at any time. :-)

My deep thanks to Sean and Robin of Kakao, and Kyoungae Kim of LG Electronics, for their help reviewing this article.

Opensource license used by IT Companies

Thu, 14 Jan 2021 00:00:00 +0000

EPAM, Github Activity Ranking and License Status by Enterprise in 2020 (OSCI)

EPAM, which develops and consults Enterprise Software, provides a ranking service called OSCI (Open Source Contributor Index) that measures Github usage.

Measures the contributions of members of a commercial organization using publicly available Github Committed event data. Contributions from universities, research institutes and free email providers were not included. The target is contributors who have performed more than 10 commits, and the activity score is measured by an algorithm they have studied. The algorithm is published in OSCI Github.

ISO Standard, OpenChain

Wed, 16 Dec 2020 00:00:00 +0000

On December 15, 2020, OpenChain Specification 2.1 was officially published as an international standard ISO/IEC 5230:2020.

For more information on this, please refer to the following article. : https://world.einnews.com/pr_news/532725924/iso-iec-5230-2020-is-the-international-standard-for-open-source-compliance

Kakao Training Material

Tue, 24 Nov 2020 00:00:00 +0000

The open source technology part of Kakao has released open source educational materials for in-house developers so that anyone can read it.

Download

Training materials can be downloaded from the following page.

http://t1.kakaocdn.net/olive/assets/opensource_guide_kakao.pdf

NCSOFT Training Material

Mon, 23 Nov 2020 00:00:00 +0000

NCSOFT has released lecture slides and scripts, which are open source educational materials in-house, on GitHub based on the spirit of sharing open source so that anyone can use them.

Companies that develop/distribute software can use this slide as it is or extract/modify necessary parts when preparing for in-house open source training.

Anyone can participate in modifying and supplementing these materials through GitHub.

Download

These materials can be downloaded from the following page.

Open Source Compliance in the Enterprise

Mon, 23 Nov 2020 00:00:00 +0000

Introducing the Open Source Compliance in the Enterprise book

This book was written by Ibrahim Haddad and published by the Linux Foundation.

It explains in detail what to consider when building an open source compliance program in a business, and anyone can download it from the following link : Download

Korean summary

NCSOFT summarized the main contents of this book in Korean, and after getting permission from the author, Ibrahim, they released it so that open source people of Korean companies can refer to it.

How to blog

Sat, 29 Aug 2020 00:00:00 +0000

The blog on the OpenChain Korea Work Group website shares articles on open source.

Any member of the OpenChain Korea Work Group can write.

Please refer to the guide on the next page. : How to write a blog

The sample blog post

Sat, 29 Aug 2020 00:00:00 +0000

Text can be bold, italic, or ~~strikethrough~~. Links should be blue with no underlines (unless hovered over).

There should be whitespace between paragraphs. There should be whitespace between paragraphs. There should be whitespace between paragraphs. There should be whitespace between paragraphs.

There should be no margin above this first sentence.

Blockquotes should be a lighter gray with a border along the left side in the secondary color.

There should be no margin below this final sentence.

Search Results

Mon, 01 Jan 0001 00:00:00 +0000

OpenChain KWG

1. Open Source Policy (Sample)

1. Purpose

(1) Purpose of the policy(3.1.3.1)

1. OpenChain Specification

1. 샘플 오픈소스 정책 for OpenChain 2.1

OO회사 오픈소스 정책

1. 목적

1. 프로그램 성립

1.1 정책 (Policy)

FOSSology

주요 특징

2. OpenChain Conformance

2. 관련 업무 정의 및 지원

2.1 접근성 (Access)

OpenChain Specification 2.0

2.1 접근성

입증 자료:

2.1 Access

Verification Material(s):

2. 오픈소스 컴플라이언스 프로세스 (template)

<OO 회사> 오픈소스 컴플라이언스 프로세스 (예시)

SW360

3. OpenChain Curriculum

3. 오픈소스 콘텐츠 검토 및 승인

3.1 BOM (Bill of Materials)

OpenChain Specification 2.0

3.1 BOM

입증 자료:

3.1 Bill of Materials

Verification Material(s):

4. 컴플라이언스 결과물 생성 및 전달

OpenChain Specification 2.0

4.1 컴플라이언스 결과물

입증 자료:

4.1 Compliance Artifacts

Verification Materials(s):

5. 오픈소스 커뮤니티 참여에 대한 이해

5.1 기여 (Contributions)

OpenChain Specification 2.0

5.1 기여

입증 자료:

5.1 Contributions

Verification Materials(s):

6. 설명서 요건 준수

6.1 준수 (Conformance)

OpenChain Specification 2.0

6.1 준수

입증 자료:

6.1.1 요건 1.4에 명시된 프로그램을 확인하는 문서는 이 설명서의 모든 요건을 충족한다.

6.1 Conformance

Verification Materials(s):

CISA 2026 SBOM Minimum Elements: What to Prepare and Which Tools Fill the Gaps

Summary

What the US AI Executive Order (2026-06-02) Means for Enterprise Open Source Managers

The EU Open Source Strategy: Institutionalizing Open Source for Tech Sovereignty

AI-Generated Code: How Far Should Open-Source Scanning Go?

First, one thing to get straight

EU Cyber Resilience Act (CRA) Vulnerability Reporting Obligations — A Research Report for the 2026-09-11 Compliance Date

Rockchip and FFmpeg: A License Dispute Case Study

The AVM Lawsuit: Revisiting LGPL-2.1 User Rights and the Obligation to Provide Installation Information

1. Case Overview

What the Oracle v. Rimini Street Case Tells Us About the Scope of GPL Derivative Works

Introduction

Key Points of the EU's Three Major Digital Regulations That Korean Software Companies Need to Know

Introduction

To Mine or Not To Mine: A German Court's Ruling on the Copyright Dilemma of the AI Era

A Chinese Copyright Infringement Case: "Since GPL-Based Software Products Already Have an Obligation to Disclose Source Anyway, Isn't It Fine to Copy Them?"

Parties to the Lawsuit

Overview of the Case

Elasticsearch Changes Its License Again: How Should Companies Respond?

Introduction: The Background of the Elasticsearch License

Introduction to SPDX 3.0 and Enterprise Adoption Strategy

1. Introduction to SPDX 3.0

Definition and Purpose of SPDX

French Court Orders Major Telecom Orange to Pay Damages for GPL Violation

Checklist for Preparing an In-Person Meeting

Effective Open Source Management Practices for Companies (2): OpenChain Korea Work Group

OpenChain Korea Work Group

Effective Corporate Open Source Management (1): The OpenChain Project for Global Collaboration

(1) Purpose of the policy_(3.1.3.1)