Establishing an
Open Source
Program Office

LEE CALCOTE

Layer5, Founder​

TIM TYLER

MetLife, Principal Engineer

“There isn’t a one size fits all model. I can’t stand up in front of a crowd and say, ’this is how you should do it,‘”

– Jeff McAffer, director of Open Source Programs Office at Microsoft.

And neither am I. This is how you "might" do it.

Creating an ospo

@lcalcote

@timotyler

Why create an

open source

program office ?

Prominence of Open source

all major areas of software innovation are happening in open source

world

@lcalcote

@timotyler

Top Benefits

1. Awareness

2. Development velocity

3. Compliance

4. Influence

@lcalcote

@timotyler

open source

program office strategy

{

}

to open source strategy...

@lcalcote

@timotyler

path to mastering open source

From bottom to top

@lcalcote

@timotyler

Continual ingesting of software from multiple sources

@lcalcote

@timotyler

COnsumption

WHY DO COMPANIES USE OPEN SOURCE SOFTWARE?

There are many compelling reasons for using Open Source:

• Faster - speed up the delivery of software solutions.
   

• Shared cost - less expensive than commercial software and in-house development.
   

• Flexibility - with source code in-hand, you can make needed modifications and licensing flexibility can allow changes to the code and deployment strategies without impediment.
   

• Innovation - often the leading edge of development comes from open source communities.
   

• Influence - within a project; across related projects.
   

• Talent - both attraction and retention.

@lcalcote

@timotyler

Solid Compliance tooling and process is key to reducing risk:

Why should I comply with licenses?

CompliancE

• Legal injunction that prevents shipping product.
   
• Customer service headaches.
   
• Loss of Intellectual Property.
   
• Engineering rework.
   
• Punitive damages.
   
• Embarrassment.

@lcalcote

@timotyler

Compliance Goals

1. Ensure license requirements are upheld.

2. Shipped products and delivered services have secure components and approved open source licenses.

3. Vulnerabilities are tracked and remediations incorporated.

4. Attribution within code.

5. Redistribution of code.

2 C's deep. Quit here?

@lcalcote

@timotyler

Inner Sourcing

Inner sourcing before or after open sourcing?

Is this step necessary for your organization?

• Establish open source-like culture within org.
• More efficient development; standardize tools.
• Overcome organizational boundaries.
• Promote reuse and avoid not-invented here complex.
• More flexible utilization of developers.

Leverage the benefits of open source development methodologies internally

@lcalcote

@timotyler

How do I give and receive?

Contribution

Inbound and Outbound

Need to:

• Delineate what is and isn't IP.

• Consider a license agreement.

  • Contribution License Agreement (CLA)

  • Developer Certificate of Origin (DCO)

• Provide contribution guidelines.

• Define project governance.

@lcalcote

@timotyler

Community

 

• Formulate and communicate - your end-user and developer community support strategies and guidelines.
   

• Anyone in your company who wants to start or participate in an existing project should understand what a well-run community looks like.

Support, governance, velocity are all measures used to decide whether to use open source software.

PURPOSEFUL ENGAGEMENT KEY TO GAINING MOMENTUM

@lcalcote

@timotyler

 

COMPETE?

• Race 

• Deeper 

• Broader

Complement?

• Integrations

• Ingestion

• Interoperability

Displace or integrate?

Competition

ASSUAGE COMPETITIVE NATURE?

@lcalcote

@timotyler

role of an OSPO

The role of an OSPO

@lcalcote

@timotyler

Cross-functional responsibilities

• Open Source Executive Committee

  • Review and approve proposals to release IP / proprietary source code under OSS license.

  • Review and approve proposals to use non-approved license types.

• Open Source Program Office (Review Board)

  • Drive all activities surrounding the 5'Cs.

  • Provide guidance on open source questions coming from company staff and engineers.

  • Develop community involvement policy, process, procedures, and guidelines.

  • Coordinate source code scans, audits and distribution of source code packages.

  • Contribute to compliance and OS training.

  • Contribute to creation of new tools to facilitate automation, discovery of OS in dev environment.

  • Host and maintain the company’s open source websites.

• Engineering Operations

  • Review requests for the use, modification, and distribution of open source.

  • Handle compliance inquiries.

  • Maintain records of compliance for any given open source software component are up to date.

  • Review end-user documentation to ensure that appropriate copyright, attribution, and license notices are given to consumers.

  • Perform audits all software included in a product, which involves the following tasks:

    • Run a source code scanning tool over the software base and analyze results.

    • Address all flagged licensing conflicts flagged by the scanning tool.

    • Oversee the closure of all issues identified by scanning tools.

    • Create a final audit report and ensure that all identified issues have been closed.

• Legal

  • Provide guidance on licensing.

  • Contribute to and approve training.

  • Review and approve list of obligations to fulfill.

  • Review and approve open source notices.

• Engineering & Product Teams

  • Follow compliance policies and processes.

  • Integrate compliance practices in dev process.

  • Conduct design, architecture, and code reviews.

  • Prepare software packages for distribution.

• IT & Supply Chain

  • Mandate third party software providers to disclose open source in licensed or purchased software components.

  • Assist w/ingress of third party software (commercial and open source software).

  • Support and maintenance for tools infrastructure used by the compliance program.

  • Create and/or acquire new tools based on OSPO requests.

• Documentation & Localization

  • Include open source license information and notices in the product documentation.

  • Translate basic information in target languages about open source information related to the product or software stack.

• Corporate Development

  • Request open source compliance be completed before a merger or acquisition.

  • Request open source compliance be completed when receiving source code from outsourced development centers or third-party software vendors.

• Human Resources
  • Build, retain, and attract talent

Business alignment

 

 

• Without the right legal counsel , an open source program office can end up placing undue risk on company management. Legal can also stifle innovation, so strike the right balance.
   

• Align with product management .  If your open source program office is not helping your product strategy, then it's not reaching its full potential.

Continual COmpliance process

74% of an OSPO's role

@lcalcote

@timotyler

Top ways success is measured

Measuring and monitoring success.

@lcalcote

@timotyler

OSPO dashboard

For your code and third-party code

Security

• Identified security vulnerabilities
• Static vulnerability analysis

Compliance

• Flagged license compliance
• Status of scans

Contribution

• Missing contribution guides
• Unsigned CLAs
• Outstanding contribution requests
• Community
  • Events
  • Repo stats: stars, PRs, commits, issues

Checklist

@lcalcote

@timotyler

Establishing AN ospo

Hire a believer; a champion

Open source pragmatists are everywhere, but your innovative, forward-thinking, ambitious open source advocate is an extremely valuable rarity.

 

Hire them to run your open source programs if you want to make a difference.

@lcalcote

@timotyler

Top challenges

Open Source Programs Survey

1. Strategy planning

2. Defining policies

3. Executive support

@lcalcote

@timotyler

Challenge #3

Open source software is  more than free software

 

Most don't understand many of the motivations for participants, nor do they understand the nuanced differences in licensing models, various types of productization and business models, or how proprietary and open source software can be used in conjunction to create a better product line.

Most tech company executives are far-removed from open source communities.

@lcalcote

@timotyler

keep the faith

  70% of those without a program believe -

creating an OSPO would have a positive impact in their company, despite any barriers to creating it.

Teething is painful

@lcalcote

@timotyler

Resources

Supporting Groups:

• TODO Group
• The Linux Foundation
• InnerSource Commons

@lcalcote

many thanks to these open stewards

OSPO Case Studies:

• Autodesk
• Capital One
• Comcast
• Dropbox
• Facebook
• Google
• Microsoft
• Oath
• RedHat
• Salesforce

 

@timotyler

Lee Calcote

Thank you. Questions?

clouds, containers, functions,

applications and their management

linkedin.com/in/ttyler

@lcalcote

calcotestudios.com/talks

Tim tyler

Husband, Proud Dad, Technologist, SCUBA Diver, Foodie, Corgi human, #DockerCaptain

@ timotyler

linkedin.com/in/leecalcote

Checkout the Open Source Summit!

• Security
• Kubernetes
• Compose and Docker App
• Service Mesh
• BuildKit
• containerd
• CNAB
• SwarmKit
• Serverless

layer5.io/books

l ayer5.io /books