👋
Hi there - LinkedIn: tsteenbe
- Twitter: @tsteenbe
- ORT Slack channel: Thomas Steenbergen
- TODO Slack channel: Thomas Steenbergen
Projects I'm busy with...
OSS Review Toolkit
OSS Review Toolkit (ORT) provides tooling to safely use, integrate, modify and redistribute third party software including FOSS.
You can use it to:
- Generate CycloneDX or SPDX SBOMs for your software project
- Automate your FOSS policy using Policy as Code to do licensing, security vulnerabilities and engineering standards checks for your software project and its dependencies
- Correct found invalid or missing package metadata (licensing, source location, etc.)
- Overwrite scanner license findings in the sources of your software project and its dependencies
- Mark files, directories or or package manager scopes as not included in your software project or dependency released artifacts - use it to make clear that license findings in build scripts, documentation or tests in a package sources do not apply to the release (binary) artifact
- Create a source code archive for your software project, including its dependencies to comply with certain licenses or have your own copy as nothing on the internet is forever
I'm one of the project's maintainers and a frequent speaker at conferences as the project's spokesperson.
SPDX
Software Package Data Exchange (SPDX) is an open standard for Software Bill of Materials (SBOM). SPDX allows the expression of components, licenses, copyrights, security references and other metadata relating to software. I'm currently the lead for Defects team working to exchange quality, vulnerability, and software supportability information in SPDX.
TODO Group
TODO is an open group of organizations that collaborate on practices, tools, and other ways to run successful and effective open source projects and programs. I'm a co-founder of the European chapter of TODO Group, creator/organizer of the OSPOlogy.live and currently a TODO steering committee member.
OpenChain
OpenChain Project is an open standard for open source license compliance. It allows organizations of all sizes and sectors to adopt the key requirements of a quality open source compliance program. I'm a co-founder and regular contributor to the OpenChain Reference Tooling Work Group.
OpenSSF
OpenSSF is committed to collaboration and working both upstream and with existing communities to advance open source security for all. I am contributor to the SBOM Everywhere SIG.
Bitkom
Bitkom is Germany’s digital association. I am contributor to the Bitkom Open Source Work Group.