OSPOlogy Follow-up: Growing An Open Source Culture Inside Sony

[anajsana]

Discuss with the community topics related to the upcoming OSPOlogy meeting:

📅 July, 26th ➡️ Growing An Open Source Culture Inside Sony

• Join Zoom Link

In this open space, people can:

• Ask questions prior to the meeting starts
• Share notes from the conversation
• Make proposals for new initiatives that can help the OSPO Ecosystem
• Add useful links and resources related to the topic
• Connect with mentors involved in OSPOs and/or Open Source Management

📝 OSPOlogy Meeting Slides ➡️ link
🚀 Sony Presentation ➡ slides.pdf
️

[anajsana]

New question via Q&A:

1. How Sony handleS OSS compliance for embedded Linux sw projects? (is it using meta-doubleopen)?
2. What tools are used mainly for OSS compliance?
3. How it handles OSS coming from suppliers?
   Thanks

[KazumiASato]

1. If the product is using an in-house distribution, it is being compliant there. On top of that, compliance is carried out for each product.
   Thank you for your information about meta-doubleopen.
2. Sony has various business units, so it varies. Each business unit uses commercial tools or OSS tools (such as fossology).
3. Conducts supplier training, etc. I have been asked to submit a list of OSS and OSS licenses. We also use the results of Openchain activities such as white papers.

[anajsana]

New question from Q&A:

It was mentioned that changes were made to Sony’s Open Source Policy to accelerate contributions, can you elaborate more about these changes?

[KazumiASato]

We changed decision criteria for approver level to make it easier for engineers to understand. As a result, if it is only a bug fix, we can feedback with the approval of the local manager level.

[anajsana]

New question:

An embedded Linux system has a lot of open source (kernel, boot loader, filesystem) which consumes a lot of space even in source form. If you have a lot of products, with a lot of different builds, that is many different versions of the distro, all slightly different. How do you handle delivery of the source for compliance?

[KazumiASato]

On the source code publishing site, the source code actually used by the product is published for each product and version.
So we need lots of space for these source code.
Products and versions created from the same source code are published together for saving space.

[anajsana]

New question via Q&A:

Is there a database for Open Source in Sony where projects could look for components which are already approved or disapproved?

Are there any learnings from running a scan on Docker based projects?

[KazumiASato]

There is no Sony-wide database. Basically, we conduct audits for each product. This is because your conclusions will change depending on your configuration and usage. We have information about what's included in our internal distribution, and the products that use it use that information. Those not included in the distribution are audited separately. We have a well-known know-how for some frequently used OSS as a knowledge base. Regarding Docker, the current situation is that it is difficult to check all the contents of the container images that are stacked.