Automating Open-Source License Compliance
summary
X-Road uses tens of direct and hundreds of transitive open‑source dependencies across Java, JavaScript and Python; compliance was a yearly manual check taking 3–4 months. Automation uses Open Source Review Toolkit integrated into CI with weekly scans and an organization policy, catching technical issues and license violations that require legal+technical review. Migration to a hosted service (double open) shrinks heavy scans from 18 hours to about 10 minutes and stops infrastructure maintenance, though some manual curation and source‑bundle fulfillment remain.
AI-written summary · about
chapters (10)
- 0:00Introduction to talk
- 1:08Background on NIIS and X-Road
- 6:13Previous compliance process issues
- 8:22Need for open source policy
- 9:52Introducing ORT tool
- 11:41Automated compliance workflow
- 14:12Experiences using ORT
- 19:13ORT as a service
- 22:48Summary of benefits
- 26:08Q&A session
related talks
33mORT Automate compliance using Open Source & InnerSource
30mORT: Automate your open source policy using Open Source & Inner Source
37mStreamlining Open-Source License Compliance With the Continuous Clearing Tool
42mBenefits of Automated Open-Source Intake Management
28mGoverning Open Source in the Enterprise: OSPO Strategies for Innovation and Compliance
25mOpen Source Compliance
13mBuild license management into your pipelines
15mShifting Open Source Compliance Activities Left