ESTABLISHING AN

 

 

program OFFICE

Lee Calcote

March 2019

calcotestudios.com/talks

open source

<<<<<<< HEAD
=======
>>>>>>> gh-pages

SOURCe

<<<<<<< HEAD
=======
>>>>>>> gh-pages

OPEN

<<<<<<< HEAD =======

and

>>>>>>> gh-pages

“There isn’t a one size fits all model. I can’t stand up in front of a crowd and say, ’this is how you should do it,‘”

– Jeff McAffer, director of Open Source Programs Office at Microsoft.

@lcalcote

And neither am I... this is how you "might" do it.

Creating an ospo

Lee Calcote

linkedin.com/in/leecalcote

@lcalcote

gingergeek.com

lee@calcotestudios.com

clouds, containers, functions, applications,  and their management

calcotestudios.com/talks

github.com/leecalcote

<<<<<<< HEAD ======= >>>>>>> gh-pages

Now Available

at

l ayer5.io

Why create an open source program office ?

The Philadelphia Open Source Conference aims to connect open source developers, leaders, technologists, and community leaders to collaborate on the latest in open source innovation . It’s an environment for cross-collaboration between developers, operators, architects, leaders and others who are driving the technology forward . 

That's great.
But, why?

Prominence of Open source

@lcalcote

all major areas of software innovation are happening in open source

software

Open Source

cloud

world

™

Top Benefits

  1. Awareness

  2. <<<<<<< HEAD

    Influence

    =======

    Development velocity

    >>>>>>> gh-pages

  3. Compliance

    4. <<<<<<< HEAD

  4. Development velocity

 

=======

  • Influence

    • >>>>>>> gh-pages

    @lcalcote

    Those without an OSPO want to attract talent. Those with an existing OSPO already have talent.

    open source program office strategy

    @lcalcote

    a well-rounded open source strategy incorporates these 5 C's

    ...include not only consuming open source software and complying with licensing, but also participating in community , giving and receiving contributions as well as actively assuaging the competitive nature of popular projects.

    Calcote's 5 C's

    {

    }

    to open source strategy...

    @lcalcote

    path to mastering open source

    From bottom to top

    @lcalcote

    Continual ingesting of software from multiple sources

    Today's software products average 60% to 80% open source in their code.

    COnsumption

    WHY DO COMPANIES USE OPEN SOURCE SOFTWARE?

    There are many compelling reasons for using Open Source:

    @lcalcote

    All of these reasons add up to a competitive advantage for organizations for using OSS.

      <<<<<<< HEAD
    • =======
    • >>>>>>> gh-pages

      Faster - speed up the delivery of software solutions.
       

      • <<<<<<< HEAD
    • =======
    • >>>>>>> gh-pages

      Shared cost - less expensive than commercial software and in-house development.
       

      • <<<<<<< HEAD
    • =======
    • >>>>>>> gh-pages

      Flexibility - with source code in-hand, you can make needed modifications and licensing flexibility can allow changes to the code and deployment strategies without impediment.
       

      • <<<<<<< HEAD

    • Innovation - often the leading edge of development comes from Open Source communities. =======

    • Innovation - often the leading edge of development comes from open source communities. >>>>>>> gh-pages
       

      • <<<<<<< HEAD
    • =======
    • >>>>>>> gh-pages

      Influence - within a project; across related projects.
       

      • <<<<<<< HEAD
    • =======
    • >>>>>>> gh-pages

      Talent - both attraction and retention.

    Solid Compliance tooling and process is key to reducing risk:

    @lcalcote

    Why should I comply with licenses?

    CompliancE

    Source: https://www.linuxfoundation.org/blog/2016/12/open-source-compliance-in-the-enterprise-benefits-and-risks/

    • Legal injunction that prevents shipping product.
       
    • Customer service headaches.
       
    • Loss of Intellectual Property.
       
    • Engineering rework.
       
    • Punitive damages.
       
    • Embarrassment.

    Compliance Goals

    1. <<<<<<< HEAD

      Shipped products and delivered services have secure and approved open source components and licenses.

    2. Ensure license requirements are upheld.

      1. Notices and attribution within and outside of code.

      =======

      Shipped products and delivered services have secure components and approved open source licenses.

    3. Ensure license requirements are upheld.

      >>>>>>> gh-pages

    4. Vulnerabilities are tracked and remediations incorporated.

    5. <<<<<<< HEAD

      Redistribution of source code as appropriate.

      =======

      Attribution within code.

    6. Redistribution of code.

      >>>>>>> gh-pages

    Process Goals

    1. Outline, agree to and educate on OSS review process.

    2. Acknowledge on-prem and SaaS has different needs.

      1. Hold each to same rigor and process, augmenting tooling as needed.

    3. Empower engineering teams to self-service as much as possible.

    4. Account for multi-source development model.

      1. Enable and streamline continuous execution.

    @lcalcote

    2 C's deep. Quit here?

    Inner Sourcing

    Inner sourcing before or after open sourcing?

    @lcalcote

    Is this step necessary for your organization?

    • Establish open source-like culture within org.
    • More efficient development; standardize tools.
      • <<<<<<< HEAD
    • Overcoming organizational unit boundaries.
      • =======
    • Overcome organizational boundaries.
      • >>>>>>> gh-pages
    • Promote reuse and avoid not-invented here complex.
    • More flexible utilization of developers.

      Leverage the benefits of open source development methodologies internally

      @lcalcote

      How do I give and receive?

      Contribution

      Inbound and Outbound

      <<<<<<< HEAD
      =======
      >>>>>>> gh-pages

      Need to:

      • <<<<<<< HEAD Qualify loss of IP. ======= Delineate what is and isn't IP. >>>>>>> gh-pages

      • <<<<<<< HEAD Have a Contribution License Agreement (CLA) ======= Consider a license agreement. >>>>>>> gh-pages

        • <<<<<<< HEAD As an individual or an organization? ======= Contribution License Agreement (CLA)

        • Developer Certificate of Origin

          (DCO) >>>>>>> gh-pages

      • Provide contribution guidelines.

      • Define project governance.

      Community

      <<<<<<< HEAD

      Purposeful engagement key to Gaining momentum

      • Formulate—and communicate—your end-user and developer community support strategies and guidelines. =======

         

        • Formulate and communicate - your end-user and developer community support strategies and guidelines. >>>>>>> gh-pages
           

        • Anyone in your company who wants to start or participate in an existing project should understand what a well-run community looks like.

        @lcalcote

        <<<<<<< HEAD
        =======
        >>>>>>> gh-pages

        Support, governance, velocity are all measures used to decide whether to use open source software.

        <<<<<<< HEAD =======

        PURPOSEFUL ENGAGEMENT KEY TO GAINING MOMENTUM

        >>>>>>> gh-pages

       

      COMPETE

        • Race 

        • Deeper 

        • Broader

        Complement

          • Integrations

          • Ingestion

          • Support, Interoperability

          @lcalcote

          Displace or complement?

          Competition

          <<<<<<< HEAD

          ASSUAGE COMPETITIVE NATURE? COMPETE OUTRIGHT?

          =======

          ASSUAGE COMPETITIVE NATURE?

          >>>>>>> gh-pages

          The role of an OSPO

          the center of the universe for a company’s open source operations and structure

          The role of an OSPO

          Much to encompass

          Business alignment

           

           

          • Without the <<<<<<< HEAD right legal counsel , an open source program office can end up placing undue risk on company management. They can also stifle innovation, so strike the right balance. ======= right legal counsel , an open source program office can end up placing undue risk on company management. Legal can also stifle innovation, so strike the right balance. >>>>>>> gh-pages
             

          • <<<<<<< HEAD Align with product strategy .  If your open source program office is not helping your product strategy, then it's probably a wasted effort. ======= Align with product management .  If your open source program office is not helping your product strategy, then it's not reaching its full potential. >>>>>>> gh-pages

          Where to land one

          Engineering

          Legal

          Program Management

          <<<<<<< HEAD =======

          (Operations)

          >>>>>>> gh-pages

          Corp Dev

          Talent Acquisition

          Marketing

          IT

          Documentation

          Procurement

          @lcalcote

          How centric to your business is OSS?

          Cross-functional responsibilities

          • Open Source Executive Committee

            • Review and approve proposals to release IP / proprietary source code under OSS license.

            • Review and approve proposals to use non-approved license types.

          • Open Source Program Office (Review Board)

            • Drive all activities surrounding the 5'Cs.

            • Provide guidance on open source questions coming from company staff and engineers.

            • Develop community involvement policy, process, procedures, and guidelines.

            • Coordinate source code scans, audits and distribution of source code packages.

            • Contribute to compliance and OS training.

            • Contribute to creation of new tools to facilitate automation, discovery of OS in dev environment.

            • Host and maintain the company’s open source websites.

          • Engineering Operations

            • Review requests for the use, modification, and distribution of open source.

            • Handle compliance inquiries.

            • Maintain records of compliance for any given open source software component are up to date.

            • Review end-user documentation to ensure that appropriate copyright, attribution, and license notices are given to consumers.

            • Perform audits all software included in a product, which involves the following tasks:

              • Run a source code scanning tool over the software base and analyze results.

              • Address all flagged licensing conflicts flagged by the scanning tool.

              • Oversee the closure of all issues identified by scanning tools.

              • Create a final audit report and ensure that all identified issues have been closed.

          • Legal

            • Provide guidance on licensing.

            • Contribute to and approve training.

            • Review and approve list of obligations to fulfill.

            • Review and approve open source notices.

          • Engineering & Product Teams

            • Follow compliance policies and processes.

            • Integrate compliance practices in dev process.

            • Conduct design, architecture, and code reviews.

            • Prepare software packages for distribution.

          • IT & Supply Chain

            • Mandate third party software providers to disclose open source in licensed or purchased software components.

            • Assist w/ingress of third party software (commercial and open source software).

            • Support and maintenance for tools infrastructure used by the compliance program.

            • Create and/or acquire new tools based on OSPO requests.

          • Documentation & Localization

            • Include open source license information and notices in the product documentation.

            • Translate basic information in target languages about open source information related to the product or software stack.

          • Corporate Development

            • Request open source compliance be completed before a merger or acquisition.

            • Request open source compliance be completed when receiving source code from outsourced development centers or third-party software vendors.

          • Human Resources
            • Build, retain, and attract talent

          Continual COmpliance process

          @lcalcote

          Two points of ingest

          the "74%" of an OSPO's role

          Request approval before using.

          Initial and on-going scans of existing code bases.

          Top 3 ways success is measured

          @lcalcote

          Measuring and monitoring success.

          OSPO dashboard

          @lcalcote

          For your code and third-party code

          Security

          • Identified security vulnerabilities
          • Static vulnerability analysis

          Compliance

          • Flagged license compliance
          • Status of scans

          Contribution

          • Missing contribution guides
          • Unsigned CLAs
          • Outstanding contribution requests
          • Community
            • Events
            • Repo stats: stars, PRs, commits, issues

          Checklist

          Establishing AN ospo

          @lcalcote

          Hire a believer; a champion

          Open source pragmatists are everywhere, but your innovative, forward-thinking, ambitious open source advocate is an extremely valuable rarity.

           

          Hire them to run your open source programs if you want to make a difference.

          Open source programs tend to start informally as a working group or a few key open source developers and then evolve into formal programs over time...

           

          ...typically within a company’s software engineering or development department (about 41% of programs).

          Top challenges

          @lcalcote

          Open Source Programs Survey

          1. Strategy planning

          2. Defining policies

          3. Executive support

          <<<<<<< HEAD

          Challenge #3

          =======

          Challenge #3

          >>>>>>> gh-pages

          @lcalcote

          Open source software is  more than free software

          Most tech company executives are far-removed from open source communities.

           

          Most don't understand many of the motivations for participants, nor do they understand the nuanced differences in licensing models, various types of productization and business models, or how proprietary and open source software can be used in conjunction to create a better product line.

          <<<<<<< HEAD

          keep the faith

          =======

          keep the faith

          >>>>>>> gh-pages

          @lcalcote

          <<<<<<< HEAD

          The benefits of an open source program are widely known, with 70% of those without a program believing it would have a positive impact in their company, despite any barriers to creating it.

          List of licenses

          CLA vs DCO


          Strategy regarding business models 

          =======

            70% of those without a program believe -

          creating an OSPO would have a positive impact in their company, despite any barriers to creating it.

          Teething is painful

          >>>>>>> gh-pages

          Resources

          Supporting Groups:

          TODO Group

          The Linux Foundation

          @lcalcote

          many thanks to these open stewards

          OSPO Case Studies:

           

          Lee Calcote

          Thank you. Questions?

          clouds, containers, functions,

          applications and their management

          linkedin.com/in/leecalcote

          @lcalcote

          gingergeek.com

          calcotestudios.com/talks

          github.com/leecalcote

          <<<<<<< HEAD lee@calcotestudios.com ======= lee@layer5.io >>>>>>> gh-pages