Hi there 👋

🏢 I’m currently at EPAM Systems leading its Open Source Program Office (OSPO) and helping organizations manage open source in a strategic and efficient manner that meets their business needs.

🤝 I’m looking to collaborate on open source supply chain (security) and managing open source in organizations. Open to speaking opportunities.

💬 Ask me anything open source, dealing with toddlers or about my two cats 😺

📫 How to reach me:

• LinkedIn: tsteenbe
• Twitter: @tsteenbe
• ORT Slack channel: Thomas Steenbergen
• TODO Slack channel: Thomas Steenbergen

🏳️‍🌈 Pronouns: he/him

Projects I'm busy with...

OSS Review Toolkit

OSS Review Toolkit (ORT) provides tooling to safely use, integrate, modify and redistribute third party software including FOSS.

You can use it to:

• Generate CycloneDX or SPDX SBOMs for your software project
• Automate your FOSS policy using Policy as Code to do licensing, security vulnerabilities and engineering standards checks for your software project and its dependencies
• Correct found invalid or missing package metadata (licensing, source location, etc.)
• Overwrite scanner license findings in the sources of your software project and its dependencies
• Mark files, directories or or package manager scopes as not included in your software project or dependency released artifacts - use it to make clear that license findings in build scripts, documentation or tests in a package sources do not apply to the release (binary) artifact
• Create a source code archive for your software project, including its dependencies to comply with certain licenses or have your own copy as nothing on the internet is forever

I'm one of the project's maintainers and a frequent speaker at conferences as the project's spokesperson.

SPDX

Software Package Data Exchange (SPDX) is an open standard for Software Bill of Materials (SBOM). SPDX allows the expression of components, licenses, copyrights, security references and other metadata relating to software. I'm currently the lead for Defects team working to exchange quality, vulnerability, and software supportability information in SPDX.

TODO Group

TODO is an open group of organizations that collaborate on practices, tools, and other ways to run successful and effective open source projects and programs. I'm a co-founder of the European chapter of TODO Group, creator/organizer of the OSPOlogy.live and currently a TODO steering committee member.

OpenChain

OpenChain Project is an open standard for open source license compliance. It allows organizations of all sizes and sectors to adopt the key requirements of a quality open source compliance program. I'm a co-founder and regular contributor to the OpenChain Reference Tooling Work Group.

OpenSSF

OpenSSF is committed to collaboration and working both upstream and with existing communities to advance open source security for all. I am contributor to the SBOM Everywhere SIG.

Bitkom

Bitkom is Germany’s digital association. I am contributor to the Bitkom Open Source Work Group.