OSS: Open Source Software

Let's check OSS compliance of your company !
When your company uses OSS for business operations or developments, it is important to confirm yourcompany using OSS propery. Start your company’s OSS compliance by checking six items.

Background

Check proper OSS usage
in your company.

In recent years, OSS has been used in various places such as home appliances,
communication devices, personal computers, software products, or cloud services.
OSS is usually released publicly and ready for use, such as freely copying, modifying, ordistributing, with conditions described in a license which developer of the OSS developer
attached with the OSS. When your company use OSS, it is important to be prepared for issues
arising from using OSS, because OSS is usually released under conditions that OSS developer
do not take any responsibility for the issues.

1. Observe OSS licenses before use
Please use OSS
complying withthe licenses.

You can only use OSS that your company can comply with conditions described in the OSS
license. Therefore, when you obtain OSS and use it in your own business operations ordevelopments, it is important to investigate conditions of the OSS.
Variations of OSS licenses are much less than numbers of OSS and there are several
condition types, though OSS licenses are freely decided by individual developers.
One common condition type is an attribution requirement. For example, if you distribute
OSS to someone else, the license condition requires you attaching the license and leaving
original copyright information.
Another common condition type is a distribution requirement. For example, if you provide
OSS binary code to someone else, the license condition requires you providing the OSS sourcecode to the provided one. For another example of the distribution requirement, when you
distribute software that combines OSS and other programs, the license condition requires
you distributing entire combination as OSS.
Let's check OSS licenses conditions of OSS your company use.

2. Take Care Providing OSS with OSS information
If you provide OSS to someone, OSS provided person or organization as well as you isrequired to follow the OSS licenses. It is also important to make the person or theorganization prepared for future issues, such as bugs or vulnerabilities found in the OSS.
Accordingly, when you provide OSS to a customer, even in cases of embedding OSS intoa product or providing OSS with other software under contract development, it isimportant to provide adequate OSS information with the customer, such as names,
versions, or licenses of the OSS provided, for the customer’s license compliance or futuretechnical issues.

I will provide you
OSS information.

3. Keep in mind terrible impact amount of license violation
The reputation of
our company has
damaged.

You will have a terrible risk if you sell product using OSS in a way not complying withthe OSS license, resulting damage of your company’s trust. For example, customer of theproduct would spread bad reputation by making a post to point out OSS license violationin Internet. You may also have a risk of having injunction or damages lawsuits for
copyright infringement.
To avoid those situations, it is important to make sure whether shipping productcontains OSS, OSS licenses is properly complied, and shipping the product with required
information, if the product contains OSS.

4. Be prepared for bugs and vulnerabilities
Not limited to OSS, software users have to deal with bugs or vulnerabilities. If
those issues are left unattended, your company will have risks, such as leaking
confidential or personal information.
And since OSS developers are not responsible for bugs or vulnerabilities of theOSS, it is important for OSS users to collect information of and be prepared for bug
or vulnerability of the OSS.

5. Upstream your amendments to the OSS developer or community
I will submit my bug
fixings to the OSS
developer.

If you fix OSS bugs, vulnerabilities, or documentation errors, it is recommended toprovide those amendments to the OSS developer or community, because youramendment will be useful for other people using the OSS.
If you do not provide your fixings with the OSS developer or community,corresponding bugs or vulnerabilities remain unfixed and you will have to make same
fixings when you use upgrade version of the OSS in the future. In other words, providing
your amendments to the OSS developer or community will help you as well as them andyou will have improved efficiency for your future development.

6. Check OSS management system of your company
In order to comply with OSS licenses and to deal with OSS bugs and vulnerabilities, it isimportant to establish policy for managing OSS across your company.
Check that your company has an appropriate policy for managing OSS by following criteria:

This is perfect!

A) Does your company check all licenses of OSS that you company ?
 If not, it is recommended to use OSS license investigation tool.
B) At the timing of adopting OSS, does you company confirm OSS license compliance?
 If not, it is recommended to place or clarify person to consult with when you do notunderstand OSS license contents.
C) Does your company confirm there is no unrecognized OSS in your developed software or software partsprocured from other companies?
 For software or products from other companies, it is recommended to agree OSS checking ways for thesoftware or product in advance with the companies.
D) Does your company confirm that OSS license information is provided to customers?
 If not, it is recommended to check OSS license information by person or organization in your company otherthan the developers.
E) Does your company manage OSS usage for individual product?
 If not, it is recommended to have centralized OSS usage management across the company. That accelerates
your company’s response for OSS-related issues.
F) Does your company keep collecting bugs and vulnerabilities information of OSS you use?
 If not, it is recommended to identify person or organization responsible for collecting those information.
G) Does your company have internal rules for posting information to the OSS development community?
 If not, it is recommended to set internal rule that allows submitting OSS modification to the original OSS
developer or community.
H) Does your company internally clarify first contact information or coping way for OSS-related issues such as
license violations or vulnerabilities?
 If not, it is recommended to examine appropriate person or organization, internally or externally.
Please share these OSS management policies with relevant parties.
OpenChain Japan Work Grouphttps://wiki.linuxfoundation.org/openchain/openchain-japanese-working-group* This document can be used under the conditions of CC0-1.0 (public domain).