The tools of governance- Program Office andCollaboration between companies
Hiroyuki Fukuchi
Norio Kobota
Open Source Promotion sec.
Technology Alliance dept.
Corporate Technology Strategy div.
Sony Corporation
1 ▇▇▇ The OpenChain project Japan work group / CC0-1.0

CONFIDENTIAL

Part I
Program Office in Sony2 ▇▇▇ The OpenChain project Japan work group / CC0-1.0

CONFIDENTIAL

About me•Network / Security Software Engineer• WebSocket, HTTP/2, SIP(Session Initiation Protocol), etc.
• contributed to NodeJS(libuv), lighttpd(webserver), msgpack• You can find me athttps://github.com/lighttpd/lighttpd1.4/blob/master/src/mod_wst
unnel.c etc.

•Within Sony• OpenSourcing RPC framework(https://github.com/linear-rpc)• Fostering NMOS (https://github.com/sony/nmos-cpp etc.)
used by Sony IP Live Production System etc.
https://pro.sony/en_LU/technology/ip-live
Norio.Kobota@sony.com

The Cathedral and Bazaar ?
By whom are you supported your use of OSS in your company?

4 ▇▇▇ Copyright 2018 Sony Corporation

Cathedral

5 ▇▇▇ Copyright 2018 Sony Corporation

BazaarIn-house Open Source Software Community

6 ▇▇▇ Copyright 2018 Sony Corporation

In-house Bazaar
External
OSS Community

Divisional Leader

Professional Advisory(Legal/IPD/PR/QCD)Divisional Leader

Business Unit

Business Unit

Coordinatorofthe Bazar

Business Unit

Divisional Leader

External
OSS Community

7 ▇▇▇ Copyright 2018 Sony Corporation

Loose guidelines

Business Unit

Mutual help of the bazaar
participants
Each Business Units to takethe all responsibilities to
use OSSOSS Compliance –-Organization--

CompanySony

Presenter

Satoru Ueda

Organization

Date

8

April 17th, 2018

Dedicated organization / Virtual or community type / by each employee / Alone(comment:

Number of person in
chargeOver 100 / 99-21 / 10-20 / few / one / zero(comment:

Points of activities

Internal community for OSS license.
Legal, IP department, Public Relation and QA are involved in the activity. Almost all business units participate incommunity. Abroad development sites are covered by community.
Some business units have sub-community inside their units.

IssuesFree writing

Skill up of each member: Analogy of medical care model(skillful home doctors and university hospital)
Supply chain issues.
Please refer to the next page

Translated by Fukuchi@Sony

Sony’s OSS organization
As of April 2018
Sony originalExternal OSS
Community

External OSS
Community

Business Unit

Support from
corporate software
strategy committee(OSS Strategy Board)

Professional
Advisory(Legal/IPD/PR/QCD)OSS Licensecommittee

Coordinator

Divisional Leader
Divisional
OSS committee

Business Unit

Divisional Leader
Business Unit

Divisional Leader

Business Unit••

Divisional Leader

Divisional
OSS
committee

External OSS
Community

Internal OSS Bazaar

Business Unit

About 100 members of
OSS License Committee
OSS strategy board as
the community leader(with a few experts)••

Tim Bird, Frank Rowand andfew members (about 10)

No dedicatedorganization for OSS
Translated by Fukuchi@Sony

9 ▇▇▇ Copyright 2018 Sony Corporation

OSS Compliance - Education / Awareness

10

Company

Sony

Wiki

OK / NG

Presenter

Hiroyuki Fukuchi

Date2018/6/5

Item• OSS training (9hours, 4times/year)+ customized course for each development site(Worldwide) About 700 people• OSS community training (Studying OSS community, OSS contribution HowTo)• Freshman training• E-learning (including non-engineer) About 2,000 people

Issue• Fostering next-gen. leaders• Education to non-engineers, suppliers, subcontracting companies• Open sourcing

Sample

•
•
•
•
•
•
•
•
•

Trainer lectures on OSS with belief and enthusiasm“Our company encourages employees to use OSS actively”“Many engineers want to build a good world through developing OSS”
It is important to understand the background of each OSS license, and intention of developers
It is important to understand the time of distributing OSS
There are quizzes of use cases where non engineers are involved in OSS distribution. These quizzes make nonengineers aware of their responsibility
Episodes related with a community experienced by the trainer give good impression to trainees
By categorizing with few patterns, Sony’s examples of Open Sourcing are explained.
Maintainers undertake trainers, who explain real activities in a community

OSS Supply Chain Issue
SoftwareSupplier
OSS Information

SoftwareSupplier

SoftwareSupplier

OSS Information

SoftwareSupplier

OSS Information

OSS (not using)Information

SoftwareSupplier

SoftwareSupplier

OSS Information

OSS Information

SoftwareSupplier

OSS Information

SoftwareSupplier

OSS Information

SoftwareSupplier

OSS Information

SoftwareSupplier

SoftwareSupplier
SoftwareSupplier

SoftwareSupplier

Inappropriate use of OSS

Final product vendor

Can not comply OSS license requirement as the distributor of OSS

11 ▇▇▇ Copyright 2017, 2018 Sony Corporation

CONFIDENTIAL

Part II
Collaboration between companies
Japan work group12 ▇▇▇ The OpenChain project Japan work group / CC0-1.0

CONFIDENTIAL

About me
Hiroyuki Fukuchi
Open Source Promotion Sec.
Technology Alliance Dept.
Corporate Technology Strategy Div.
In charge of OSS compliance in SonyA Member of OpenChain and Japan WG
Japanese translation volunteer
Works of Japanese Translation:
OpenChain Specification/Curriculum
SPDX specification 2.1
Handbook of Open Source Compliance
Blog written by Greg Kroah-Hartman

13 ▇▇▇ The OpenChain project Japan work group / CC0-1.0

Japan work group
All member meeting

Sub Group activity

・Education
・Making FAQ・Leaflet to upper stream suppliers
・License info. exchange・Tooling
Wiki https://wiki.linuxfoundation.org/openchain/openchain-japanese-working-group

・Meeting info.
・Sub group activity
・Case studies
・Japanese translation
Specification/Curriculum/onboarding

GitHub https://github.com/OpenChain-Project/Onboarding-JWG
https://github.com/OpenChain-Project/Japan-WG-General
ML openchain-japan-wg@lists.linuxfoundation.org
Slack openchain-japanwg.slack.com

14 ▇▇▇ The OpenChain project Japan work group / CC0-1.0

CONFIDENTIAL

All member meeting of Japan WG

Venue: Tokyo
2018/Dec: Tuv Sud Japan

Venue: Tokyo
2017/Dec: Sony

Venue: Tokyo
2018/Jun: Sony

Venue: Tokyo
2018/Feb: Hitachi

Venue: Nagoya
2018/Jun: Toyota

Venue: Tokyo
2019/Feb: Mitsubishi Electric

Venue: Kobe
2018/Nov: DensoTen

Venue: Kawasaki
2018/Aug: Fujitsu

Venue: Kobe
2019/Apr: DensoTen
Venue: Osaka
2018/Nov: Panasonic

15 ▇▇▇ The OpenChain project Japan work group / CC0-1.0

Venue: Kawasaki
2018/Oct: Toshiba

CONFIDENTIAL

Scenes at meetings

16 ▇▇▇ The OpenChain project Japan work group / CC0-1.0

CONFIDENTIAL

ML Subscribers
Japan WG ML registration
PersonEntity

120
108
100

80

75

60

34

40
22
20
14
8

37

PersonEntity

97
90

40

42

48

18

13

0
2018/2/6

2018/3/6

2018/4/6

2018/5/6

2018/6/6

2018/7/6

2018/8/6

17 ▇▇▇ The OpenChain project Japan work group / CC0-1.0

2018/9/6

2018/10/6

2018/11/6

2018/12/6

2019/1/6

2019/2/6

CONFIDENTIAL

Meeting Attendees
70

第5回

60

第6回

50

第8回
第7回

第4回
40

30

第1回

第2回

第3回

Ad hoc20

1002017/Dec/27

2018/Feb/22

2018/Apr/19

2018/Jun/13

2018/Aug/31

2018/Oct/31

of attendees
18 ▇▇▇ The OpenChain project Japan work group Num.
/ CC0-1.0

2018/Nov/20

Num. of entities

2018/Dec/5

2019/Feb/28

2019/Apr/xx

CONFIDENTIAL

Lightning talk (sharing case study)
Short presentation (3 minutes within 1 page) byattendees“No document, only aural presentation” is acceptable
Condition of anonymity is acceptable
Documents are disclosed in Wiki

Wiki https://wiki.linuxfoundation.org/openchain/openchain-japanese-working-group19 ▇▇▇ The OpenChain project Japan work group / CC0-1.0

CONFIDENTIAL

Overview of OpenChain Specification
Specification =Policy, Organization andProcess
6.1, 6.2
Conformance

FOSS Policy
1.
Education2

Why do we need
3.2
Management
policy and process?
ProgramDevelopment

BoM
Process

Software

BoM

FOSS

FOSS version
License

2.2

FOSS
Responsibility

3.1

1.3
Review
Process

Review
ReportReportCopyright

Obligation

20 ▇▇▇ The OpenChain project Japan work group / CC0-1.0

1.1
2.1

Contribution
Policy5.1

How can we implement
policy and process?
FOSS
Liaison4.
Release 1
Process

ReleasePackagedisclosure

5.2
Contribution
Process

Customers receives
software andlicense meta information
Source code disclosure,if needed
CONFIDENTIALOSS Compliance –-Organization-Company

Panasonic

Presenter

Shinsuke Kato

Date

21

April 17th, 2018

Organization

Dedicated organization / Virtual or community type / by each employee / Alone(comment: No dedicated organization. Cross-function virtual group handles OSS license. Member isformally assigned by Business Unit.

Number of
person inchargeOver 100 / 99-21 / 10-20 / few / one / zero(comment: Now the group concentrates on OSS license, and is starting to handle the technologicalaspect of OSS.

Points ofactivities

Legal and IP department are involved in the activity. Not only OSS but also software are treated.
The group gives advices and final decision is made by Business Unit. The group collects bestpractices inside Panasonic and share them.

IssuesHow to involve abroad subsidiary companies. Organizational changes give impacts on OSS activity, it
may cause difficulty to maintain activity if a key person cannot continue to participate.
Budget.

Free
writing

Panasonic
Company A・ Engineer (AAA)・ Legal (BBB)
・ IP (CCC)

CC-BY-ND-4.0

Company B
・ Engineer (DDD)・ Legal (EEE)・ IP (FFF)

・・・・・

Company C・ Engineer(OOO)
・ Legal (PPP)・ IP (QQQ)

HQ(office)・ Engineer (XXX)・ Legal (YYY)
・ IP (ZZZ)

Translated by Fukuchi@Sony

OSS Compliance –-Organization-Company

HitachiPresenter

Yuji Nomura

Date

22

April 18th, 2018

Organization

Dedicated organization / Virtual or community type / by each employee / Alone(comment: OSS solution center promotes OSS appropriate usage inside Hitachi group and receives
internal inquiries.

Number of
person inchargeOver 100 / 99-21 / 10-20 / few / one / zero(comment: OSS compliance team belongs to OSS solution center.

Points ofactivities

OSS compliance team makes internal interpretation of OSS license with legal department.
Interpretation gives easy explanation(Usage, Obligation, Restriction) to engineers.

IssuesIncrease of OSS usage exceeds over internal interpretation.
Interpretation requires personal skills, so that it is difficult to increase OSS compliance team.

Free
writing

Activity of interpretation began in 2013.
Each business unit individually made its rules, process and infrastructure for OSS
OSS solution center was established in 2015.
The core member of OSS compliance moved from advanced unit.
OSS solution center is sharing the advanced activity(best practices) inside Hitachi group.
Hitachi would like to contribute its OSS process and best practices to OpenChain.

CC-BY-ND-4.0

Translated by Fukuchi@Sony

OSS Compliance –-Organization-Company

Fujitsu group

PresenterYuki Machida

Date

23

April 18th, 2018

Organization

Dedicated organization / Virtual or community type / by each employee / Alone(comment:

Number of
person inchargeOver 100 / 99-21 / 10-20 / few / one / zero(comment:

activities

Now we are trying registration of huge number of FOSS internal distribution(700 packages x 10
generations), so that automation of registration is needed.
Fujitsu group changed OSS license tool from Blackduck “Code Center” to FlexNet “Code Insight” inApril 2018.
We are trying some methods using SPDX, rpm, source code analysis tool etc., but it does now work
well to take matching between input and “Code Insight” database.
The method using SPDX is the most working, but even many packages cannot be registered.
e2fsprogs is registered as “Ext2 Filesystems Utilities”
lack of FOSS data base informationlack of web page information in SPDX
version information is not clearly written
We contributed patches to modify the web page URL in SPDX to Yocto project.

CC-BY-ND-4.0

Translated by Fukuchi@Sony

OSS Compliance –-Organization-Company

ToyotaPresenter

Hiroki Takemi

Date

24

April 17th, 2018

Organization

Dedicated organization / Virtual or community type / by each employee / Alone(comment:

Number of
person inchargeOver 100 / 99-21 / 10-20 / few / one / zero(comment: as a member who works for OSS compliance in IP division)

Points ofactivities

IP department leads activity. The committee for OSS was established.
Usage of OSS is increasing, so that we are promoting “OSS literacy” in Toyota.

IssuesActivity and committee is voluntary.
We are trying to establish internal OSS organization over company.
Supply Chain.

Freewriting

CC-BY-ND-4.0

Translated by Fukuchi@Sony

OSS Compliance –-Organization-Company

Anonymous

Presenter

Anonymous

Date

2018/04/18

Organization

Dedicated organization / Virtual or community type / by each employee / Alone(reference:

Number of
person inchargeOver 100 / 99-21 / 10-20 / few / one / zero(reference:

Points ofactivities•••

Make the definition of the [management of the OSS use] on the Quality Management System. By
using the definition of the OSS management and compliance, we make a governance.
For the software of our company, to use Protex and to report the concreate correspondence
should be. The dedicated organization maintains the all cases.
All employee (except a clerk) should take a web-test about the OSS compliance and in-houserules once a year. (The rate is 95%)

Issues•Free
writing* We would like to make the Open Source Program Office. But, we are not promoting theestablishment. it’s difficult. (what is the first activity, who is the first target to join, and so on.)CC0-1.025

We don’t make a system like as an Open Source Program Office which includes the IP, Legal,
Corporate Planning members. The organization is very local. (Each Business Division can decide
to use OSS or not.)Translated by Kato@PanasonicWhy is Japan WG so active?
Japan WG is driven in a community way.
People who understand both OSS and real problems
Place where OpenChain provides Neutrality and Confidence
Leadership gathers people

26 ▇▇▇ The OpenChain project Japan work group / CC0-1.0

CONFIDENTIAL

Thank you!

27 ▇▇▇ The OpenChain project Japan work group / CC0-1.0

CONFIDENTIAL

Resources• OpenChain project:• Website: https://www.openchainproject.org/• Wiki: https://wiki.linuxfoundation.org/openchain/start• GitHub: https://github.com/OpenChain-Project• ML: openchain@lists.linuxfoundation.org• Translations: https://www.openchainproject.org/translations• OpenChain Japan WG:• Wiki: https://wiki.linuxfoundation.org/openchain/openchain-japanese-working-group• ML: openchain-japan-wg@lists.linuxfoundation.org• GitHub: https://github.com/OpenChain-Project/Onboarding-JWG•
https://github.com/OpenChain-Project/Japan-WG-General• Slack: openchain-japanwg.slack.com• SPDX:• Website: https://spdx.org/• SPDX 2.1 Unofficial Japanese translation• GitHub: https://github.com/hfukuchi/SPDX_specification/tree/master/chapters

28 ▇▇▇ The OpenChain project Japan work group / CC0-1.0

Appendix

29 ▇▇▇ The OpenChain project Japan work group / CC0-1.0

CONFIDENTIAL

Tips for the lightning talkLeadership and good atmosphere

We do NOT judge “Good” and “Bad”.

In order to collect important points, format is pre-defined.
We disclose the documents on Wiki.

We share each practice as a reference.
Practices give you good hints.

30 ▇▇▇ The OpenChain project Japan work group / CC0-1.0

CONFIDENTIAL

Overview of OpenChain Specification
Specification =Policy, Organization andProcess
6.1, 6.2
Conformance

FOSS Policy
1.2
Education

3.2
Management
ProgramDevelopment

BoM
Process

Software

BoM

FOSS

FOSS version
License

2.2

FOSS
Responsibility

3.1

1.3
Review
Process

Review
ReportReportCopyright

Obligation

31 ▇▇▇ The OpenChain project Japan work group / CC0-1.0

1.1
2.1

FOSS
LiaisonReleaseProcess

4.1

ReleasePackagedisclosureContribution
Policy5.1

5.2
Contribution
Process

Customers receives
software andlicense meta information
Source code disclosure,if needed
CONFIDENTIALOSS Compliance –-Organization-Company

Sony

Presenter

Satoru Ueda

Date

32

April 17th, 2018

Organization

Dedicated organization / Virtual or community type / by each employee / Alone(comment:

Number of
person inchargeOver 100 / 99-21 / 10-20 / few / one / zero(comment:

Points ofactivities

Internal community for OSS license.
Legal, IP department, Public Relation and QA are involved in the activity. Almost all business units
participate in community. Abroad development sites are covered by community.
Some business units have sub-community inside their units.

IssuesSkill up of each member: Analogy of medical care model(skillful home doctors and university
hospital)
Supply chain issues.

Freewriting

Please refer to the next page

CC-BY-ND-4.0

Translated by Fukuchi@Sony

OSS Compliance –-Organization-Company

Hitachi Solution

PresenterAyumu Watanabe

Date

33

April 18th, 2018

Organization

Dedicated organization / Virtual or community type / by each employee / Alone(comment: In fact, it is not dedicated to OSS compliance, but “Right Conservation” of IP department
has functionality of OSS compliance.

Number of
person inchargeOver 100 / 99-21 / 10-20 / few / one / zero(comment:

Points ofactivities

There is the process to check OSS information in rule “Other company’s Right Conservation”.
OSS usage requires to receive approval from the organization.

Issues

The approval process is complex for engineers to follow.

Freewriting

The approval process:Business unit submits a request of OSS(OSS list, license list, use case) to the committee.
The committee(Legal, IP, Procurement) decides to approve or disapprove.
Business unit receives the result of decision. If approval, it starts to take OSS.

CC-BY-ND-4.0

Translated by Fukuchi@Sony

OSS Compliance –-Organization-Company

Anonymous

Presenter

Anonymous

Date

2018/04/18

Organization

Dedicated organization / Virtual or community type / by each employee / Alone(reference: start to make an organization.

Number of
person inchargeOver 100 / 99-21 / 10-20 / few / one / zero(reference: as a candidate working for the OSS compliance.

Points ofactivities

The persons in charge have a good and high awareness.
The final decision is made by Business Unit.

IssuesThere are varies of the knowledge and system from each organization.
Need to maintain the organization and activity.
Difficult to manage each project because of the used software will be a lot (over 10,000)

Free
writing

Study about making a mechanism to manage the information of the OSS compliance and security.
- doing by OSS, need to maintain continuously, need to re-use, these are neccssary.
The materials of OpenChain is helpful for me.

CC0-1.0

34

Translated by Kato@PanasonicOSS Compliance –-Organization-Company

Anonymous

Presenter

Anonymous

Date

2018/04/18

Organization

Dedicated organization / Virtual or community type / by each employee / Alone(reference: actually only one person.

Number of
person inchargeOver 100 / 99-21 / 10-20 / few / one / zero(reference: actually only one person.

Points ofactivities

The consciousness is low. I’m struggling alone.

IssuesHow to promote OSS compliance to managements and over company

Freewriting

I would like to improve the awareness of the OSS compliance in the industry.
* increase members working for the OSS license and compliance* need the education of the OSS license and compliance- Translation : when proposing on the ML, after that, start to translate.
- Join in the event : when proposing at the 1st JWG meeting, after that, Hitachi did.
- propose : join in the OSC KYOTO- propose : make MOOCS materials about the education curriculum

CC0-1.035

Translated by Kato@PanasonicOSS Compliance –-Organization-Company

Anonymous

Presenter

Anonymous

Date

36

2018/04/19

Organization

Dedicated organization / Virtual or community type / by each employee / Alone(reference:

Number of
person inchargeOver 100 / 99-21 / 10-20 / few / one / zero(reference: The persons who worked for the OSS and OSS compliance in the past submit and prepare theirknowledge of the OSS licenses. We promoted by holding the in-house work shop or so.)Points ofactivities• Not to use the OSS is the basic policy. (make a rule in the each case)• The knowledge is documented. Anyone can access and read. (But, unknown whether it is utilized or not)• There is a original tools to check the incorporation of the OSS.

Issues

•
•
•
•
•

Free
writingCC0-1.0

The OSS compliance is depend on the person or the developer. (not organize as a in-house rule).
It’s depend on the case or the project. When not working for the OSS compliance support, theconsciousness will be low.)
Can not take measures for the OSS compliance as a organization
The utilization of the documents or tools is not progressing.
Rather than in the past, the consciousness of the developers is low because of the less of the awareactivities.

[want to know]• The trend and the recent situation of the recent OSS compliance• The security measures for the embedded software. (E.G. the security patch is applied or not.)[Comment]• We want the developers to have a good awareness of the OSS compliance by introducing the activitiesof the OpenChain. And we expect the continuous activities.
Translated by Kato@Panasonic