solving the supply chain puzzle with spdx, openchain & hyperledger · 2017-12-14 · most...
TRANSCRIPT
![Page 1: Solving the Supply Chain Puzzle with SPDX, OpenChain & Hyperledger · 2017-12-14 · Most modern day devices are constructed from 80%+ open source Device Runtime is governed > 100](https://reader035.vdocuments.us/reader035/viewer/2022062917/5ed2e389c9c4660b6a68999c/html5/thumbnails/1.jpg)
© 2015 Wind River. All Rights Reserved.
Solving the Supply Chain Puzzle with SPDX, OpenChain & Hyperledger
Mark Gisi
Sameer Ahmed
Open Source Leadership Summit
February 2017
![Page 2: Solving the Supply Chain Puzzle with SPDX, OpenChain & Hyperledger · 2017-12-14 · Most modern day devices are constructed from 80%+ open source Device Runtime is governed > 100](https://reader035.vdocuments.us/reader035/viewer/2022062917/5ed2e389c9c4660b6a68999c/html5/thumbnails/2.jpg)
in using Open Source
Esta
blis
h T
rust
acro
ss th
e
Supply
Chain
![Page 3: Solving the Supply Chain Puzzle with SPDX, OpenChain & Hyperledger · 2017-12-14 · Most modern day devices are constructed from 80%+ open source Device Runtime is governed > 100](https://reader035.vdocuments.us/reader035/viewer/2022062917/5ed2e389c9c4660b6a68999c/html5/thumbnails/3.jpg)
![Page 4: Solving the Supply Chain Puzzle with SPDX, OpenChain & Hyperledger · 2017-12-14 · Most modern day devices are constructed from 80%+ open source Device Runtime is governed > 100](https://reader035.vdocuments.us/reader035/viewer/2022062917/5ed2e389c9c4660b6a68999c/html5/thumbnails/4.jpg)
The Challenge
![Page 5: Solving the Supply Chain Puzzle with SPDX, OpenChain & Hyperledger · 2017-12-14 · Most modern day devices are constructed from 80%+ open source Device Runtime is governed > 100](https://reader035.vdocuments.us/reader035/viewer/2022062917/5ed2e389c9c4660b6a68999c/html5/thumbnails/5.jpg)
5 © 2015 Wind River. All Rights Reserved.
Most modern day devices are constructed from 80%+ open source
Device Runtime is governed > 100 licenses
Every shipping device requires open source compliance artifacts:
i. Legal Notices document
ii. Obligatory Source Code
iii. Licensing data (SPDX)
iv. Cryptography info
v. Security Vulnerabilities
:
IoT/Embedded Device Requirement
>80%
Open Source
Value Add
![Page 6: Solving the Supply Chain Puzzle with SPDX, OpenChain & Hyperledger · 2017-12-14 · Most modern day devices are constructed from 80%+ open source Device Runtime is governed > 100](https://reader035.vdocuments.us/reader035/viewer/2022062917/5ed2e389c9c4660b6a68999c/html5/thumbnails/6.jpg)
6 © 2015 Wind River. All Rights Reserved.
Software Supply Chain
Product Distributor Notices
![Page 7: Solving the Supply Chain Puzzle with SPDX, OpenChain & Hyperledger · 2017-12-14 · Most modern day devices are constructed from 80%+ open source Device Runtime is governed > 100](https://reader035.vdocuments.us/reader035/viewer/2022062917/5ed2e389c9c4660b6a68999c/html5/thumbnails/7.jpg)
7 © 2015 Wind River. All Rights Reserved.
Software Supply Chain
Product Distributor Notices
![Page 8: Solving the Supply Chain Puzzle with SPDX, OpenChain & Hyperledger · 2017-12-14 · Most modern day devices are constructed from 80%+ open source Device Runtime is governed > 100](https://reader035.vdocuments.us/reader035/viewer/2022062917/5ed2e389c9c4660b6a68999c/html5/thumbnails/8.jpg)
8 © 2015 Wind River. All Rights Reserved.
IoT/Embedded Device Requirement
![Page 9: Solving the Supply Chain Puzzle with SPDX, OpenChain & Hyperledger · 2017-12-14 · Most modern day devices are constructed from 80%+ open source Device Runtime is governed > 100](https://reader035.vdocuments.us/reader035/viewer/2022062917/5ed2e389c9c4660b6a68999c/html5/thumbnails/9.jpg)
![Page 10: Solving the Supply Chain Puzzle with SPDX, OpenChain & Hyperledger · 2017-12-14 · Most modern day devices are constructed from 80%+ open source Device Runtime is governed > 100](https://reader035.vdocuments.us/reader035/viewer/2022062917/5ed2e389c9c4660b6a68999c/html5/thumbnails/10.jpg)
10 © 2015 Wind River. All Rights Reserved.
Linux Foundation’s solution to standardize licensing information exchange within the software supply chain
Format for recording and sharing licensing and copyright information of a software package
![Page 11: Solving the Supply Chain Puzzle with SPDX, OpenChain & Hyperledger · 2017-12-14 · Most modern day devices are constructed from 80%+ open source Device Runtime is governed > 100](https://reader035.vdocuments.us/reader035/viewer/2022062917/5ed2e389c9c4660b6a68999c/html5/thumbnails/11.jpg)
11 © 2015 Wind River. All Rights Reserved.
Software Supply Chain
Open Source Projects
Device Distributor
![Page 12: Solving the Supply Chain Puzzle with SPDX, OpenChain & Hyperledger · 2017-12-14 · Most modern day devices are constructed from 80%+ open source Device Runtime is governed > 100](https://reader035.vdocuments.us/reader035/viewer/2022062917/5ed2e389c9c4660b6a68999c/html5/thumbnails/12.jpg)
12 © 2015 Wind River. All Rights Reserved.
Wind River Delivers SPDX data for Linux
SPDX
2012 - Wind River Linux 5 2013 - Wind River Linux 6 2014 - Wind River Linux 7 2015 - Wind River Linux 8 2016 - Wind River Linux 9
![Page 13: Solving the Supply Chain Puzzle with SPDX, OpenChain & Hyperledger · 2017-12-14 · Most modern day devices are constructed from 80%+ open source Device Runtime is governed > 100](https://reader035.vdocuments.us/reader035/viewer/2022062917/5ed2e389c9c4660b6a68999c/html5/thumbnails/13.jpg)
13 © 2015 Wind River. All Rights Reserved.
BusyBox
![Page 14: Solving the Supply Chain Puzzle with SPDX, OpenChain & Hyperledger · 2017-12-14 · Most modern day devices are constructed from 80%+ open source Device Runtime is governed > 100](https://reader035.vdocuments.us/reader035/viewer/2022062917/5ed2e389c9c4660b6a68999c/html5/thumbnails/14.jpg)
14 © 2015 Wind River. All Rights Reserved.
SPDX Version
Document Name
Document Identifier
Name Space
Creator
Created : :
Document Package File Other Licenses Relations Annotations
![Page 15: Solving the Supply Chain Puzzle with SPDX, OpenChain & Hyperledger · 2017-12-14 · Most modern day devices are constructed from 80%+ open source Device Runtime is governed > 100](https://reader035.vdocuments.us/reader035/viewer/2022062917/5ed2e389c9c4660b6a68999c/html5/thumbnails/15.jpg)
15 © 2015 Wind River. All Rights Reserved.
Package Name
Download Location
Concluded License
All Licenses From Files
Declared License : :
Document Package File Other Licenses Relations Annotations
![Page 16: Solving the Supply Chain Puzzle with SPDX, OpenChain & Hyperledger · 2017-12-14 · Most modern day devices are constructed from 80%+ open source Device Runtime is governed > 100](https://reader035.vdocuments.us/reader035/viewer/2022062917/5ed2e389c9c4660b6a68999c/html5/thumbnails/16.jpg)
16 © 2015 Wind River. All Rights Reserved.
File Name
File Identifier
File Checksum
Concluded License
License Info in File
Copyright Text
:
:
Document Package File Other Licenses Relations Annotations
![Page 17: Solving the Supply Chain Puzzle with SPDX, OpenChain & Hyperledger · 2017-12-14 · Most modern day devices are constructed from 80%+ open source Device Runtime is governed > 100](https://reader035.vdocuments.us/reader035/viewer/2022062917/5ed2e389c9c4660b6a68999c/html5/thumbnails/17.jpg)
17 © 2015 Wind River. All Rights Reserved.
Identifier
License Text
License Name
License Comment : :
Document Package File Other Licenses Relations Annotations
![Page 20: Solving the Supply Chain Puzzle with SPDX, OpenChain & Hyperledger · 2017-12-14 · Most modern day devices are constructed from 80%+ open source Device Runtime is governed > 100](https://reader035.vdocuments.us/reader035/viewer/2022062917/5ed2e389c9c4660b6a68999c/html5/thumbnails/20.jpg)
![Page 21: Solving the Supply Chain Puzzle with SPDX, OpenChain & Hyperledger · 2017-12-14 · Most modern day devices are constructed from 80%+ open source Device Runtime is governed > 100](https://reader035.vdocuments.us/reader035/viewer/2022062917/5ed2e389c9c4660b6a68999c/html5/thumbnails/21.jpg)
OpenChain is to open source license compliance what ISO 9001 is to software quality
Open Source Compliance Management End-to-End
![Page 22: Solving the Supply Chain Puzzle with SPDX, OpenChain & Hyperledger · 2017-12-14 · Most modern day devices are constructed from 80%+ open source Device Runtime is governed > 100](https://reader035.vdocuments.us/reader035/viewer/2022062917/5ed2e389c9c4660b6a68999c/html5/thumbnails/22.jpg)
SPDX Notices
Source
Policy Training Roles & Responsibilities
Identify, Review,
Clear, Track
Open Source
OpenChain Six Pillars
Preparation of Compliance
Artifacts
Community Engagement
![Page 23: Solving the Supply Chain Puzzle with SPDX, OpenChain & Hyperledger · 2017-12-14 · Most modern day devices are constructed from 80%+ open source Device Runtime is governed > 100](https://reader035.vdocuments.us/reader035/viewer/2022062917/5ed2e389c9c4660b6a68999c/html5/thumbnails/23.jpg)
![Page 24: Solving the Supply Chain Puzzle with SPDX, OpenChain & Hyperledger · 2017-12-14 · Most modern day devices are constructed from 80%+ open source Device Runtime is governed > 100](https://reader035.vdocuments.us/reader035/viewer/2022062917/5ed2e389c9c4660b6a68999c/html5/thumbnails/24.jpg)
24 © 2015 Wind River. All Rights Reserved.
A Linux Foundation open source initiative
Infrastructural support for blockchain-based distributed ledgers
Plumbing analogous to Linux but for distributed ledgers
Early Stage (one year old)
A narrow focus – support for a supply chain ledgers
![Page 25: Solving the Supply Chain Puzzle with SPDX, OpenChain & Hyperledger · 2017-12-14 · Most modern day devices are constructed from 80%+ open source Device Runtime is governed > 100](https://reader035.vdocuments.us/reader035/viewer/2022062917/5ed2e389c9c4660b6a68999c/html5/thumbnails/25.jpg)
What is a Ledger?
![Page 26: Solving the Supply Chain Puzzle with SPDX, OpenChain & Hyperledger · 2017-12-14 · Most modern day devices are constructed from 80%+ open source Device Runtime is governed > 100](https://reader035.vdocuments.us/reader035/viewer/2022062917/5ed2e389c9c4660b6a68999c/html5/thumbnails/26.jpg)
Financial Assest Ledgers
![Page 27: Solving the Supply Chain Puzzle with SPDX, OpenChain & Hyperledger · 2017-12-14 · Most modern day devices are constructed from 80%+ open source Device Runtime is governed > 100](https://reader035.vdocuments.us/reader035/viewer/2022062917/5ed2e389c9c4660b6a68999c/html5/thumbnails/27.jpg)
Stock Asset Ledgers
![Page 28: Solving the Supply Chain Puzzle with SPDX, OpenChain & Hyperledger · 2017-12-14 · Most modern day devices are constructed from 80%+ open source Device Runtime is governed > 100](https://reader035.vdocuments.us/reader035/viewer/2022062917/5ed2e389c9c4660b6a68999c/html5/thumbnails/28.jpg)
Vehicle Asset Ledgers
![Page 29: Solving the Supply Chain Puzzle with SPDX, OpenChain & Hyperledger · 2017-12-14 · Most modern day devices are constructed from 80%+ open source Device Runtime is governed > 100](https://reader035.vdocuments.us/reader035/viewer/2022062917/5ed2e389c9c4660b6a68999c/html5/thumbnails/29.jpg)
Hours Worked Ledgers
![Page 30: Solving the Supply Chain Puzzle with SPDX, OpenChain & Hyperledger · 2017-12-14 · Most modern day devices are constructed from 80%+ open source Device Runtime is governed > 100](https://reader035.vdocuments.us/reader035/viewer/2022062917/5ed2e389c9c4660b6a68999c/html5/thumbnails/30.jpg)
![Page 31: Solving the Supply Chain Puzzle with SPDX, OpenChain & Hyperledger · 2017-12-14 · Most modern day devices are constructed from 80%+ open source Device Runtime is governed > 100](https://reader035.vdocuments.us/reader035/viewer/2022062917/5ed2e389c9c4660b6a68999c/html5/thumbnails/31.jpg)
31 © 2015 Wind River. All Rights Reserved.
BlockChain Ledger Benefits
Disintermediation - exchange w/o need of third party
High quality data - complete, consistent, timely, accurate, & widely available
Transparency and immutability - publicly viewable, transactions are immutable
Durability, reliability, and longevity – no central point of failure, long lived
Highly Secure
![Page 32: Solving the Supply Chain Puzzle with SPDX, OpenChain & Hyperledger · 2017-12-14 · Most modern day devices are constructed from 80%+ open source Device Runtime is governed > 100](https://reader035.vdocuments.us/reader035/viewer/2022062917/5ed2e389c9c4660b6a68999c/html5/thumbnails/32.jpg)
![Page 33: Solving the Supply Chain Puzzle with SPDX, OpenChain & Hyperledger · 2017-12-14 · Most modern day devices are constructed from 80%+ open source Device Runtime is governed > 100](https://reader035.vdocuments.us/reader035/viewer/2022062917/5ed2e389c9c4660b6a68999c/html5/thumbnails/33.jpg)
33 © 2015 Wind River. All Rights Reserved.
HyperLedger
. . .
![Page 34: Solving the Supply Chain Puzzle with SPDX, OpenChain & Hyperledger · 2017-12-14 · Most modern day devices are constructed from 80%+ open source Device Runtime is governed > 100](https://reader035.vdocuments.us/reader035/viewer/2022062917/5ed2e389c9c4660b6a68999c/html5/thumbnails/34.jpg)
34 © 2015 Wind River. All Rights Reserved.
Env-Drv-23
Src
Env-Lx-52
Src
spdx
Src
spdx
Env-Router-5217
Env-Drv-23
Drv-23
Env-Lx-52
Lx-52 Router-5217
Env-Router-5217
Compliance Ledger
![Page 35: Solving the Supply Chain Puzzle with SPDX, OpenChain & Hyperledger · 2017-12-14 · Most modern day devices are constructed from 80%+ open source Device Runtime is governed > 100](https://reader035.vdocuments.us/reader035/viewer/2022062917/5ed2e389c9c4660b6a68999c/html5/thumbnails/35.jpg)
35 © 2015 Wind River. All Rights Reserved.
spdx
Env-Drv-23
Src
Env-Lx-52
Src
spdx
Src
spdx
Env-Router-5217 Envelope ID Artifacts Org Action
Env-Drv-23 Intel-ID Src create
Env-Drv-23
Env-Lx-52 WR-ID create Src
spdx
Env-Router-5217 Env-Lx-52
Src
spdx
ITech-ID create
Envelope Ledger
add Env-Drv-23
spdx
WR-ID
![Page 36: Solving the Supply Chain Puzzle with SPDX, OpenChain & Hyperledger · 2017-12-14 · Most modern day devices are constructed from 80%+ open source Device Runtime is governed > 100](https://reader035.vdocuments.us/reader035/viewer/2022062917/5ed2e389c9c4660b6a68999c/html5/thumbnails/36.jpg)
36 © 2015 Wind River. All Rights Reserved.
Dist ID
Org Action
Compliance Ledger
Software ID Envelope ID QR Code
release Intel-ID Env-Drv-23 X-Driver 2.1 +
Dist-ID
release Env-Lx-52 WR-ID WR Lx 9 +
ITech-ID Router 5217 Env-Router-5217 release +
Compliance Ledger
![Page 37: Solving the Supply Chain Puzzle with SPDX, OpenChain & Hyperledger · 2017-12-14 · Most modern day devices are constructed from 80%+ open source Device Runtime is governed > 100](https://reader035.vdocuments.us/reader035/viewer/2022062917/5ed2e389c9c4660b6a68999c/html5/thumbnails/37.jpg)
37 © 2015 Wind River. All Rights Reserved.
Product Distributor
IniTech 5217 Router
spdx
Env-Drv-23
Src
Env-Lx-52
Src
spdx
Src
spdx
Env-Router-5217
![Page 38: Solving the Supply Chain Puzzle with SPDX, OpenChain & Hyperledger · 2017-12-14 · Most modern day devices are constructed from 80%+ open source Device Runtime is governed > 100](https://reader035.vdocuments.us/reader035/viewer/2022062917/5ed2e389c9c4660b6a68999c/html5/thumbnails/38.jpg)
using Open Source
acro
ss th
e
Supply
Chain
Esta
blis
h T
rust
![Page 39: Solving the Supply Chain Puzzle with SPDX, OpenChain & Hyperledger · 2017-12-14 · Most modern day devices are constructed from 80%+ open source Device Runtime is governed > 100](https://reader035.vdocuments.us/reader035/viewer/2022062917/5ed2e389c9c4660b6a68999c/html5/thumbnails/39.jpg)