Welcome to Automotive-Open-Source-Governance-Monthly Discussions!

[Masato-oss]

👋 Welcome to Automotive Open Source Governance Monthly!

This space is dedicated to proposing and discussing agenda items for the Automotive Open Source Governance Monthly meetings.

To foster discussions on Automotive industry governance—including Compliance, SBOM, OSPO, and Security—we welcome your topic entries.

⚖️ Antitrust Policy Notice

This community and its meetings are conducted under the auspices of The Linux Foundation (LF).
Participants agree to comply with the LF Antitrust Policy.

Important: Strictly prohibited are discussions regarding pricing, production volumes, exclusion of specific vendors, market division, or any other sensitive information that may lead to restrictive competition.

🗓 How to Submit an Agenda Item

If you have a topic you would like to raise for the next meeting, please comment below or start a new discussion with the following details:

1. Topic Title: (e.g., Challenges and Best Practices in Establishing an OSPO)
2. Proposer: (Your Name / Organization)
3. Overview: (Key discussion points or specific feedback you are seeking from the community)

[toscalix]

Topic Title

Intrinsic identifiers, a core element of the future of software for automotive

Proposer

Agustín Benito Bethencourt (toscalix)
Freelance and Independent Consultant
Software Heritage Ambassador
http://www.toscalix.com/contact

Overview

Intrinsinc identifiers has proven in several use cases as a killer ground measure to catalogue software at scale, to achieve true provenance or to audit software, among other applications in academia or the digital archiving sector.

They can become a foundational tool to face outstanding challenges in automotive with a much better perspective of success than today. The scalability challenge that compliance teams face in automotive with the adoption of standardized SBOM formats (declarative, machine readable SBOMs) is just one of them. Provenance in the context of open source, reproducibility, software auditing in the context of certification or liability cases or security compliance are among the most obvious ones.

The publication of SWHID as ISO standard back in 2025 put this intrinsic identifier in the front line as a persistent software identifier.

The presentation will touch:

• Brief introduction to intrinsic identifiers
• Brief introduction to Software Hash ID (SWHID), the ISO standard intrinsic identifier
• Why is it relevant for automotive
  • Usage within automotive context
  • Automotive use cases
    • Provenance applied to supply chains
    • SBOM scalability
    • Other use cases
• Success stories
  • Software Heritage software archive's catalogue
  • Other success stories

This presentation, designed for 30 minutes, would have a follow up where I will demo the above use cases and some other interesting examples, using open source tooling.

References:

• Specification and governance: http://www.swhid.org
• Overview, history and references: https://en.wikipedia.org/wiki/SoftWare_Hash_IDentifier
• Standard ISO: https://www.iso.org/standard/89985.html
• Article: https://www.softwareheritage.org/software-hash-identifier-swhid/

[Masato-oss]

@toscalix
Thank you for submitting such a fantastic topic!
Since the "Automotive SBOM" discussion is expected to take the full hour in February, would it be alright to schedule your topic for March 26th?

[toscalix]

Hello, I will be happy to speak whenever there is a free slot. March 26th sounds great. Thank you Agustín Benito Bethencourt http://www.toscalix.com

…

On Mon, Feb 16, 2026 at 2:02 PM Masato ENDO ***@***.***> wrote: @toscalix <https://github.com/toscalix> Thank you for submitting such a fantastic topic! Since the "Automotive SBOM" discussion is expected to take the full hour in February, would it be alright to schedule your topic for March 26th? — Reply to this email directly, view it on GitHub <#1 (reply in thread)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAU336LD7DMLJJSSOBDE7U34MHEYZAVCNFSM6AAAAACU3WLULGVHI2DSMVQWIX3LMV43URDJONRXK43TNFXW4Q3PNVWWK3TUHMYTKOBSGQ2DKNI> . You are receiving this because you were mentioned.Message ID: <OpenChain-Project/Automotive-Open-Source-Governance-Monthly/repo-discussions/1/comments/15824455 @github.com>

[Masato-oss]

@toscalix
OK! I'll add to your topic in March!