Open Source Artifacts

This section of the OSBOK describes common artifacts either consumed or produced when managing open source software within the enterprise. Artifacts may be machine- or process- generated (such as an SBOM) or the result of human effort (such as an Open Source Strategy).

The Artifacts

Software Bill of Materials (SBOM)

An SBOM, or Software Bill of Materials, is a list of all the components, libraries, and dependencies used in a software project, along with their associated version numbers and license information. There are two different SBOM formats:

OSPO (Role)Developer (Role)

Software Licenses

This article provides some basic framing around the purpose of licenses within open source:

Developer (Role)OSPO (Role)Legal (Role)

CLAs And DCOs

This article explains the concept of the Contributor License Agreement (CLA) and Developer Certificate of Origin (DCO) and the practical implications of these for organisations consuming and contributing to open source.

Developer (Role)OSPO (Role)Legal (Role)Legal Risk