|
68 | 68 | <h1 class="title">A Contribution to the OpenChain Project</h1>
|
69 | 69 | <p class="author">Ibrahim Haddad, Ph.D.</p>
|
70 | 70 | </header>
|
| 71 | +<hr> |
| 72 | +<nav id="TOC"> |
| 73 | +<h1 class="toc-title">Contents</h1> |
| 74 | +<ul> |
| 75 | +<li><a href="#introduction">Introduction</a></li> |
| 76 | +<li><a href="#evaluation-categories">Evaluation Categories</a> |
| 77 | +<ul> |
| 78 | +<li><a href="#discovery-of-open-source-software">1. Discovery of Open Source Software</a></li> |
| 79 | +<li><a href="#review-and-approval-of-the-use-of-open-source-software">2. Review and Approval of the Use of Open Source Software</a></li> |
| 80 | +<li><a href="#obligation-satisfaction">3. Obligation Satisfaction</a></li> |
| 81 | +<li><a href="#community-contributions">4. Community Contributions</a></li> |
| 82 | +<li><a href="#policy">5. Policy</a></li> |
| 83 | +<li><a href="#compliance-staffing">6. Compliance Staffing</a></li> |
| 84 | +<li><a href="#adaptation-of-business-processes">7. Adaptation of Business Processes</a></li> |
| 85 | +<li><a href="#training">8. Training</a></li> |
| 86 | +<li><a href="#compliance-process-management">9. Compliance Process Management</a></li> |
| 87 | +<li><a href="#open-source-software-inventory">10. Open Source Software Inventory</a></li> |
| 88 | +<li><a href="#automation-and-tool-support">11. Automation and Tool Support</a></li> |
| 89 | +<li><a href="#verification">12. Verification</a></li> |
| 90 | +<li><a href="#process-adherence-audits">13. Process Adherence Audits</a></li> |
| 91 | +</ul></li> |
| 92 | +<li><a href="#preparing-for-an-audit---acquisition-target">Preparing for an Audit - Acquisition Target</a> |
| 93 | +<ul> |
| 94 | +<li><a href="#know-whats-in-your-code">Know what’s in your code</a> |
| 95 | +<ul> |
| 96 | +<li><a href="#policy-and-process">Policy and process</a></li> |
| 97 | +<li><a href="#staff">Staff</a></li> |
| 98 | +<li><a href="#training-1">Training</a></li> |
| 99 | +<li><a href="#tooling">Tooling</a></li> |
| 100 | +</ul></li> |
| 101 | +<li><a href="#be-in-compliance">Be in compliance</a></li> |
| 102 | +<li><a href="#use-latest-releases-for-security-purposes">Use latest releases for security purposes</a></li> |
| 103 | +<li><a href="#measure-up-your-compliance-efforts">Measure up your compliance efforts</a></li> |
| 104 | +</ul></li> |
| 105 | +<li><a href="#preparing-for-an-audit---acquiring-company">Preparing for an Audit - Acquiring Company</a> |
| 106 | +<ul> |
| 107 | +<li><a href="#choose-the-right-audit-method">Choose the right audit method</a> |
| 108 | +<ul> |
| 109 | +<li><a href="#traditional-audit-model">Traditional Audit Model</a></li> |
| 110 | +<li><a href="#blind-audit-model">Blind Audit Model</a></li> |
| 111 | +<li><a href="#diy-audit">DIY Audit</a></li> |
| 112 | +</ul></li> |
| 113 | +<li><a href="#know-what-you-care-about">Know what you care about</a></li> |
| 114 | +<li><a href="#ask-the-right-questions-and-use-this-checklist">Ask the right questions (and use this checklist)</a></li> |
| 115 | +<li><a href="#identify-items-to-be-resolved-before-executing-the-transaction">Identify items to be resolved before executing the transaction</a></li> |
| 116 | +<li><a href="#create-a-compliance-improvement-plan-for-post-acquisition">Create a compliance improvement plan for post-acquisition</a></li> |
| 117 | +</ul></li> |
| 118 | +<li><a href="#recommended-compliance-related-development-practices">Recommended compliance-related development practices</a> |
| 119 | +<ul> |
| 120 | +<li><a href="#recommended-practices">Recommended practices</a></li> |
| 121 | +<li><a href="#avoid-common-mistakes">Avoid common mistakes</a></li> |
| 122 | +</ul></li> |
| 123 | +<li><a href="#conclusion">Conclusion</a></li> |
| 124 | +<li><a href="#appendix-a---evaluation-worksheets">Appendix A - Evaluation Worksheets</a></li> |
| 125 | +<li><a href="#resources">Resources</a> |
| 126 | +<ul> |
| 127 | +<li><a href="#open-source-compliance-in-the-enterprise-2nd-edition">Open Source Compliance in the Enterprise (2nd Edition)</a></li> |
| 128 | +<li><a href="#open-source-audits-in-merger-and-acquisition-transactions">Open Source Audits in Merger and Acquisition Transactions</a></li> |
| 129 | +<li><a href="#practical-gpl-compliance">Practical GPL Compliance</a></li> |
| 130 | +<li><a href="#openchain-curriculum">OpenChain Curriculum</a></li> |
| 131 | +<li><a href="#compliance-basics-for-developers">Compliance Basics for Developers</a></li> |
| 132 | +<li><a href="#software-package-data-exchange-spdx">Software Package Data Exchange (SPDX)</a></li> |
| 133 | +<li><a href="#commercial-providers-of-software-composition-analysis-solutions">Commercial Providers* of Software Composition Analysis Solutions</a></li> |
| 134 | +<li><a href="#open-source-compliance-tools">Open Source Compliance Tools*</a></li> |
| 135 | +<li><a href="#open-source-in-ma-transactions">Open Source in M&A Transactions</a></li> |
| 136 | +</ul></li> |
| 137 | +<li><a href="#feedback-and-future-revisions">Feedback and Future Revisions</a></li> |
| 138 | +<li><a href="#acknowledgments">Acknowledgments</a></li> |
| 139 | +<li><a href="#about-the-author">About the Author</a></li> |
| 140 | +</ul> |
| 141 | +</nav> |
| 142 | +<hr> |
71 | 143 | <p><strong>A Contribution to the OpenChain Project</strong></p>
|
72 | 144 | <p>Ibrahim Haddad, Ph.D.</p>
|
73 | 145 | <h1 id="introduction">Introduction</h1>
|
|
0 commit comments