Context: Why, How and Who

OpenChain Project - The Linux Foundation
Available under the CC Attribution-NoDerivatives 4.0 International license.

How do I trust my open source supply chain?

The OpenChain Project defines the key requirements
for a quality open source compliance program.

Training

Inbound

PolicyProcess

OutboundCompanies have the flexibility to decide the content ofeach specific process, policies and training.

OpenChain is run by users companies for usercompanies.

7

Our Latest Platinum MemberPublicly Announced Conformant Programs

9

Our New Responsive Self-Certification App

Self-Certify or “health check” for free and in private:https://certification.openchainproject.org

45% of organizations access the web app for
conformance, 45% access it for health checks.

Audited Certification is an Option

OpenChain is Community First

Meetings in Japan70

Sub Group活動開始
60
50
40
30

20
100
2017/Dec/272018/Feb/222018/Apr/192018/Jun/132018/Aug/312018/Oct/312018/Nov/202018/Dec/52019/Feb/282019/Apr/xx
Num. of attendees

Num. of entities

線形 (Num. of attendees)

線形 (Num. of entities)

Japanese Mailing List
Japan WG ML registration
PersonEntity1201089710090807560484034

40

42

37

2220
14

18
1380
2018/2/6 2018/3/6

2018/4/6 2018/5/6

2018/6/6 2018/7/6

2018/8/6

2018/9/6 2018/10/6 2018/11/6 2018/12/6 2019/1/6

2019/2/6

OpenChain: raising all the boats for the benefit of all.

This is how we address software in the supply chain.

Using OpenChain For Practical“Open Source Software Supply Chain Management (OSSSCM)”

Masato ENDO
Project Manager
IP Strategic GroupIntellectual Property Div.
Toyota Motor Corporation
2019.13th.Mar / Open Source Leadership Summit(c)TOYOTA MOTOR CORPORATION CC BY-SA 4.020

Introduction
BackgroundIndustrial &Management
Systems
Engineering

Communication
Engineering &Informatics

Industrial &Business
Management
Administration
Systems
EngineeringIntellectual
Business
Property Rights
Administration

Responsibilities
IP Strategy

OSS GovernanceCommunity
Works

http://linkedin.com/in/masato-endo-279026159
2019.13th.Mar / Open Source Leadership Summit(c)TOYOTA MOTOR CORPORATION CC BY-SA 4.0

21

The History of SCM
‘70s
TPS

‘80s
QR

‘90s
SCM

‘00s
G11n

‘10s
SCRM

Industry
Automotive

ApparelComputerALLALL

Keywords
JIT

Informatization

BTO(Build To Order)
TOC

CPFR
(Collaborative

BCP(Just In Time)(Theory Of Constraints) Planning,
Forecasting and(Business ContinuityPlanning)

Replenishment )2019.13th.Mar / Open Source Leadership Summit(c)TOYOTA MOTOR CORPORATION CC BY-SA 4.022

The concept of SCM
WHY?

For improving customer’s experience
For maximize effectiveness
HOW?

Realizing Total Optimization
Breaking down the intra- and inter-organizational barriers
WHAT?

Collaboration with supply chain partners
Managing bottlenecks
2019.13th.Mar / Open Source Leadership Summit(c)TOYOTA MOTOR CORPORATION CC BY-SA 4.023

The Concept of OSSSCM
WHY?

Respecting the intention of community engineersMaximizing effectiveness
HOW?

Realizing Total Optimization
Removing intra / inter-organization barriers
WHAT?

Collaboration between supply chain partners and community
Managing bottlenecks
2019.13th.Mar / Open Source Leadership Summit(c)TOYOTA MOTOR CORPORATION CC BY-SA 4.0

24

Collaboration
2. Standardization of methods
for smart collaboration
Community

supplier

Maker

Retailer

Customer

Executive
Planning
R&D
Legal/IP
Sales
Procurement
CSPR

1. Developing an OSS governance structure
to promote collaboration
2019.13th.Mar / Open Source Leadership Summit(c)TOYOTA MOTOR CORPORATION CC BY-SA 4.025

Governance of Each Organization
w/Community

In TOYOTA SC

Building out self-certification, Audited
Certification and formal standardization

Building an official group to manage
OSS risks and community contributions
Companywide GroupOSS
Developer

Platinum Members:
Adobe/Arm/CISCO/COMCAST/GitHub/
HARMAN/HITACHI/QUALCOMM/SIEMENS
Sony/TOSHIBA/TOYOTA/Western Digital
Recently announced:
Bosch/Facebook/Google/Microsoft/Uber2019.13th.Mar / Open Source Leadership Summit

Security
Specialist

IP
Specialist

R&D
Developing
OSS Culture(c)TOYOTA MOTOR CORPORATION CC BY-SA 4.0

Handling
OSS Risks26Standardization of Methods
w/Community

In TOYOTA SC● OpenChain JP WG

Discussing Information Sharing
Guidelines via OpenChain to address
licensing information challenges
Tier1Suppliers
SUB Working Groups-Planning SWG-FAQ SWG-Leaflet to Supplier SWG-Education material for roles SWG-License information exchange SWG-Tooling SWG-Promotion SWG

Information Sharing
Guidelines

https://wiki.linuxfoundation.org/openchain/openchain-japanese-working-grouphttps://github.com/OpenChain-Project/Onboarding-JWG

2019.13th.Mar / Open Source Leadership Summit

TOYOTA(c)TOYOTA MOTOR CORPORATION CC BY-SA 4.027

Standardization of Data Exchange
w/Community

DENSO TEN/Fujitsu/
HITACHI/Panasonic/
Pioneer/RENESAS/● JAPAN WORK GROUP RICOH/Sony/TOSHIBA
Info Sharing Sub-WG /TOYOTASPDX Lite (ex. Package Info.) would be a efficient way to manage supply
chains where some suppliers cannot use the full SPDX specification.
2019.13th.Mar / Open Source Leadership Summit(c)TOYOTA MOTOR CORPORATION CC BY-SA 4.0

Managing Bottlenecks
1. Decreasing Patent Risks 2. Decreasing License Risks
Infrastructures of OSS
Community

supplier

Maker

Retailer

Customer

Executive
Planning
R&D
Legal/IP
Sales
Procurement
CSPR

3.Promote Internal and External Understanding OSS Compliance2019.13th.Mar / Open Source Leadership Summit(c)TOYOTA MOTOR CORPORATION CC BY-SA 4.0

29

Decrease Patent Risks
w/Community

In TOYOTA SC

The expansion OIN Community
resulted in a continuous reduction ofOSS patent risks.

44%

55%

68%

TOYOTA promoted its inclusion in the
OIN Patent Non-Aggression Community.
As a result, AGL technology has become
part of this community.

Linux System Definition
OIN Board Members

2016

2017

2018

Roughly Estimation of OIN CoverageApproved

Google/IBM/NEC/PHILIPS/Red Hat/Sony/SUSE/TOYOTANew Major Licensees OIN : HITACHI/KDDI/Microsoft

2019.13th.Mar / Open Source Leadership Summit(c)TOYOTA MOTOR CORPORATION CC BY-SA 4.030

Decrease License Risks
w/Community

In TOYOTA SCGPL Cooperation Commitment (GPLCC)
introduces a cure opportunity for GPLv2
and LGPLv2.
This community is expanding rapidly.
Nov.2017

Red Hat/Facebook/Google/IBM

Mar.2018

CA Technologies/Cisco/Hewlett Packard Enterprise/
Microsoft/SAP/SUSE

Jul.2018

Amazon/Arm/Canonical/GitLab/Intel/Liferay/Linaro/
MariaDB/NEC/Pivotal/Royal Philips/SAS/TOYOTA/
VMwareNov.2018

Adobe/Alibaba/Amadeus/Ant Financial/Atlassian,Atos/AT&T/Bandwidth/Etsy/GitHub/Hitachi/ NVIDIA/Oath/Renesas/Tencent/Twitter2019.13th.Mar / Open Source Leadership Summit

TOYOTA became the first automotive
company to join GPLCC.
https://www.toyota.co.jp/jpn/sustainability/governance/compliance/Toy
ota_GPL_Commitment.pdf

The eight board members of OIN
announced that they had unanimously
adopted GPLCC.
https://www.openinventionnetwork.com/pressrelease_details/?id=88

TOYOTA is introducing GPLCC atcommunity events such as the AGL All
Members Meeting.

(c)TOYOTA MOTOR CORPORATION CC BY-SA 4.031

Promote Understanding
w/Community

In TOYOTA SCThe OpenChain Japan WG is identifying
bottlenecks caused by lack ofunderstanding around compliance andbuilding Sub-Groups for eachbottleneck.
Executive
Planning
R&D
Legal/IP
Sales
Procurement
CSPR

TOYOTA introduced an OSS license
manual on the employees intra-net andis sharing information with subsidiaries
all over the world.

Education materialfor roles Sub-G
FAQ Sub-G
Leaflet to SupplierSub-G2019.13th.Mar / Open Source Leadership Summit

Outside professionals are delivering
lectures for our engineers to further
develop internal OSS culture.

(c)TOYOTA MOTOR CORPORATION CC BY-SA 4.032

Level of Understanding
Level1
NOT understand
Importance ofOSS Compliance

Level2
NOT understandwhat to do

Level3
NOT understandhow to do

Level4
Not Understandhow to getcertification●To join events(for Engineers/
Legal people/
IP people)●Workshop●Consultation●Case Materials(Wiki/
Handbook/Academicpaper)●Trainingsupport●Selfcertification
support●PR(TraditionalMedia/
Tech Media/SNS)●Third-party
certification

Comprehensive support is being developed
We have to reach people who doesn't recognize OSS compliance2019.13th.Mar / Open Source Leadership Summit(c)TOYOTA MOTOR CORPORATION CC BY-SA 4.033

Engage with OpenChain – Start Your OSSSCM
Join the community:
https://www.openchainproject.org/community

Self-certify an organization:
https://certification.openchainproject.org