ORT Automate compliance using Open Source & InnerSource
summary
OSS Review Toolkit (ORT) automates license, copyright and vulnerability checks by scanning a repo, fetching source, running multiple scanners, and combining results into a traceable evaluator that enforces Policy as Code rules. It produces notice files and SBOMs (CycloneDX/SPDX), offers a GitHub Action and a single-file HTML report for CI, supports InnerSource fixes with how-to recipes, and scales OSPO work — deployments cut review time dramatically after a few months and integrate with existing scanners and legal workflows.
AI-written summary · about
chapters (16)
- 0:00Introduction to ORT
- 1:47Challenges in open source compliance
- 3:55Building open source tools
- 6:43ORT architecture overview
- 8:07Policy as code engine
- 11:43ORT demo and outputs
- 13:11InnerSource workflow integration
- 16:43Policy rules examples
- 19:11Developer and legal collaboration
- 20:57ORT Community Days
- 21:18Q&A on license compliance
- 23:01Extending ORT to other policies
- 24:26Handling missing license info
- 26:13License information sourcing
- 27:56Q&A on containers and compliance
- 31:24Future of compliance in containers
related talks
30mORT: Automate your open source policy using Open Source & Inner Source
28mGenerating a SPDX SBOM for Your Code in CI Using ORT
35mOSCAR - Automate software analysis, compliance and security
32mAutomating Open-Source License Compliance
42mBenefits of Automated Open-Source Intake Management
15mOpen Source License Compliance and Ory Open Source
28mGoverning Open Source in the Enterprise: OSPO Strategies for Innovation and Compliance
44mSecurity Research with Open Source Software: Vol. Omega