Open Source Initiative https://opensource.org The steward of the Open Source Definition, setting the foundation for the Open Source Software ecosystem. Thu, 28 Aug 2025 18:23:41 +0000 en-US hourly 1 https://i0.wp.com/opensource.org/wp-content/uploads/2023/01/cropped-cropped-OSI_Horizontal_Logo_0-e1674081292667.png?fit=32%2C32&ssl=1 Open Source Initiative https://opensource.org 32 32 210318891 Deep Dive: Data Governance brings world-class experts together https://opensource.org/blog/deep-dive-data-governance-brings-world-class-experts-together https://opensource.org/blog/deep-dive-data-governance-brings-world-class-experts-together#respond Thu, 28 Aug 2025 14:30:50 +0000 https://opensource.org/?p=148644 The schedule for the Deep Dive: Data Governance virtual conference is now live. Taking place October 1–3, 2025 this premier three-day event will bring together industry leaders and world-class experts to explore the latest advancements in Data Governance and Open Source AI.

From a strong pool of 50 proposals, we’ve curated 12 standout sessions across three key themes:

  • Stewards of the data commons
  • Frameworks for data governance
  • Building and preserving public datasets

Explore the preliminary schedule below or access it via our mobile website:

Time (EDT, UTC -4)SessionSpeaker
October 1stStewards of the data commons
12:00 PMOpening KeynoteStefano Maffulli
12:15 PMA data pathway to building public AIAlek Tarkowski
1:00 PMGovernments as data providers for AINeil Majithia
1:45 PMCopycats and the Commons: Governing Open Data for Trustworthy AINatalia-Rozalia
1:45 PMSovereign by Design: A Blueprint for Federated, Consent-Based AI SystemsSal Kimmich
2:30 PMWrap-Up + Live Q&ANick Vidal
October 2ndFrameworks for data governance
12:00 PMKeynoteKasia Odrozek
12:15 PMNew licensing initiatives for AI training dataRamya Chandrasekhar
1:00:00 PMHow Data Provenance Powers Trustworthy AILisa Bobbitt
1:45 PMThe CLeAR Documentation Framework for AI TransparencyKasia Chmielinski
1:45 PMBias Transparency in Human-AI Systems: Open Data Governance Frameworks for AIEDChaeyeon Lim
2:30 PMWrap-Up + Live Q&ANick Vidal
October 3rdBuilding and preserving public datasets
12:00 PMKeynoteStefan Baack
12:15 PMBuilding Public Data for LLMsStella Biderman
1:00 PMA new paradigm for publishing library collections: Institutional Books 1.0, a 242B token datasetGreg Leppert
1:45 PMBeyond Extraction: Building Community-Centered Speech DataJessica Rose
1:45 PMSaving What’s Ours: The Data Rescue Project and the Fight for Public DataLynda Kellam
2:30 PMLive Q&A + Closing RemarksStefano Maffulli

The Deep Dive: Data Governance conference builds on the momentum of past events organized by the OSI, including the Deep Dive: AI webinars held in 2023, the Data in Open Source AI workshop held in 2024, and the early-2025 white paper “Data Governance in Open Source AI: enabling responsible and systematic access.”

Data governance and Open Source AI are evolving rapidly, and this event is your opportunity to stay at the forefront. OSI’s Deep Dive brings together leading experts to share practical insights, emerging trends, and proven strategies that organizations of all sizes can apply. Registration is free and we invite you to join us.

We would like to thank the authors who have submitted their proposals and the Program Committee: Alek Tarkowski (Open Future), Anna Tumadóttir (Creative Commons), Carlo Piana (Open Source Initiative), Julie Hunter (Linagora), Masayuki Hatta (Surugadai University), Maximilian Gahntz (Mozilla Foundation), Nick Vidal (Open Source Initiative), Ramya Chandrasekhar (CNRS – Centre national de la recherche scientifique), Stefano Maffulli (Open Source Initiative), Shane Coughlan (OpenChain), and Malcolm Bain (Across Legal).

]]>
https://opensource.org/blog/deep-dive-data-governance-brings-world-class-experts-together/feed 0 148644
New resource on AI & Open Source for U.S. policymakers https://opensource.org/blog/new-resource-on-ai-open-source-for-u-s-policymakers https://opensource.org/blog/new-resource-on-ai-open-source-for-u-s-policymakers#respond Thu, 21 Aug 2025 21:34:50 +0000 https://opensource.org/?p=148274 The Open Source Initiative has put together a new resource to educate policymakers (state and federal) in the United States about Open Source software as they consider various AI policies. The document is meant to provide policymakers with background information about what it means for software to be “Open Source” and its role in technology. It also outlines the potential impacts of AI policies on Open Source software and recommends that policies avoid requirements that make Open Source developers responsible for downstream uses of their code or force them to revoke an Open Source license.

Thank you to Pam Chestek for her helpful contributions to earlier drafts.

]]>
https://opensource.org/blog/new-resource-on-ai-open-source-for-u-s-policymakers/feed 0 148274
Feature freeze: a pause with purpose https://opensource.org/blog/feature-freeze-a-pause-with-purpose https://opensource.org/blog/feature-freeze-a-pause-with-purpose#comments Wed, 13 Aug 2025 18:51:54 +0000 https://opensource.org/?p=143583 Members Newsletter – August 2025

Dear Open Source Initiative supporters,

As the days stretch long and the lure of beaches and barbecues calls, I’ve got a summer-themed hot take for our community:

Our collective obsession with “perpetual bug fixing” and “ever-expanding features” is the digital equivalent of trying to pack five different beach activities into a single, sweltering afternoon. It’s unsustainable, exhausting, and often leads to burnout – not just for maintainers, but for the projects themselves.

This summer, let’s challenge ourselves to embrace a radical concept: strategic project stasis for the sake of long-term health. Imagine a summer vacation for your codebase. Not abandonment, but a deliberate period of low maintenance and a reduction in scope, rather than a constant push for “more.”

Are we so afraid of a project being “finished enough” that we sacrifice its stability and our own well-being on the altar of endless iterations? This summer, let’s advocate for the beauty of a well-maintained, stable codebase, even if it means fewer shiny new features for a while. Sometimes, the most refreshing thing we can do for Open Source is to let it simply be, and perhaps even enjoy the quiet hum of a project that just… works.

Wishing you a truly restful and recharging summer!

Stefano Maffulli

Executive Director, OSI 

I hold weekly office hours on Fridays with OSI members: book time if you want to chat about OSI’s activities, if you want to volunteer or have suggestions.

News from the OSI

White House releases AI Action Plan, includes Open Source

The OSI explains the areas of the “AI Action Plan” that may impact the Open Source community, in particular a specific section titled: “Encourage Open Source and Open Weight-AI,” and highlights recommendations to watch as the administration moves forward with implementation.

Case study: enhancing SBOMs with cdsbom at the Linux Foundation

A Linux Foundation case study on using cdsbom to enhance SPDX SBOMs with license data from ClearlyDefined for better compliance and transparency.

OSI in the news

Open Source Is Too Important To Dilute

Article from The New Stack

The Open Source Initiative (OSI), a nonprofit that sets the foundation for the open source software ecosystem, did the hard work to define open source decades ago. It identified 10 criteria that include free redistribution, integrity of the author’s source code and no discrimination against persons and groups, among others. These criteria are the guarantees that allow companies to use OSS without calling their legal department every time a developer installs a package.

Other highlights

Other news

News from OSI affiliates and partners

Survey

DPGA Global Open Source Policies & Practices Survey

The OSI and the DPGA, in coordination with 24 partners, has launched the Global Open-Source Policies & Practices Survey to map the current use of open-source-first approaches across governments and public-interest institutions.

Events

Upcoming events

Thanks to our sponsors

New sponsors and renewals

Interested in sponsoring, or partnering with, the OSI? Please see our Sponsorship Prospectus and our Annual Report. Please contact the OSI to find out more about how your company can promote open source development, communities and software.

Support OSI by becoming a full member

Let’s build a world where knowledge is freely shared, ideas are nurtured, and innovation knows no bounds! Join as a full member!

]]>
https://opensource.org/blog/feature-freeze-a-pause-with-purpose/feed 4 143583
White House releases AI Action Plan, includes Open Source https://opensource.org/blog/white-house-releases-ai-action-plan-includes-open-source https://opensource.org/blog/white-house-releases-ai-action-plan-includes-open-source#respond Tue, 12 Aug 2025 12:22:11 +0000 https://opensource.org/?p=143469 On July 23rd, the Trump Administration released an “AI Action Plan” with a stated goal of “winning the AI race.” It will serve as a blueprint for policy actions the administration will take to accelerate AI in the United States. While the plan covers a lot of topics unrelated to Open Source, it includes a specific section titled: “Encourage Open Source and Open Weight-AI.” It also recommends federal agencies work with academia and the broader research community to increase AI development, adoption, and evaluation. In this blog post, we explain the areas of the Plan that may impact the Open Source community and highlight recommendations to watch as the administration moves forward with implementation.

Plan Section: Encourage Open Source and Open Weight-AI

This section recommends stakeholder convenings to drive adoption of Open Source and open weight models by small and medium-sized businesses. The effort will be run by the National Telecommunications and Information Administration (NTIA) which ran the public comment period on open weight models under the Biden Administration. 

It also recommends expanding access to compute power and other resources (software, data, etc.) for academics and startups through the National AI Research Resource (NAIRR), currently a pilot project at the National Science Foundation with bipartisan congressional support. OSI has publicly supported the NAIRR through our joint public comments with the Open Forum for AI

Cross-section recommendations where Open Source/foundations could play a role or be implicated

Beyond the specific section on Open Source and Open Weight-AI, the Plan makes several other comments and recommendations the Open Source community should be aware of. Specifically, the Plan:

  • Notes that the computing stack for AI data centers and infrastructure should be built on American products and free from “foreign adversary information and communications technology and services (ICTS)—including software and relevant hardware.”
  • Recommends the development of full-stack AI export packages through partnerships between industry consortia and the Department of Commerce. 
  • Recommends the use of regulatory AI sandboxes where AI tools can be deployed and evaluated and the results shared openly. 
  • Recommends the development of AI standards for domain-specific use cases (agriculture, energy, health, etc.). 
  • Makes a number of recommendations to advance how AI models are measured and evaluated, including publishing guidance for federal agencies to conduct evaluations. 
  • Recommends federal agencies work with AI developers to enable the private sector to protect models from security risks.
  • Recommends the sharing of AI-security threats and vulnerabilities across government and industry through existing and new channels.
  • Recommends the development of guidance for the private sector on mitigating AI-specific threats and vulnerabilities. 

Some of the recommendations above will be implemented by the National Institute of Standards and Technology (NIST). OSI will track public comment opportunities and stakeholder engagement efforts and share them with the Open Source community. 

The Plan also includes a number of recommendations related to AI skill development and literacy. It remains to be seen how these recommendations will be implemented with a smaller U.S. Department of Education.

]]>
https://opensource.org/blog/white-house-releases-ai-action-plan-includes-open-source/feed 0 143469
Case study: enhancing SBOMs with cdsbom at the Linux Foundation https://opensource.org/blog/case-study-enhancing-sboms-with-cdsbom-at-the-linux-foundation https://opensource.org/blog/case-study-enhancing-sboms-with-cdsbom-at-the-linux-foundation#respond Tue, 05 Aug 2025 13:43:47 +0000 https://opensource.org/?p=142786 Authors: Jeff Mendoza and Gary O’Neall

Open Source licensing is a cornerstone of modern software development, enabling organizations to accelerate innovation by reusing existing components. However, accurately capturing licensing details in SBOMs (Software Bill of Materials) at scale is often challenging. Incomplete or inconsistent license data can lead to compliance risks, particularly when dealing with obligations such as attribution or source code distribution.

ClearlyDefined, a project of the Open Source Initiative (OSI), helps address this issue by enabling organizations to easily enrich SBOMs with comprehensive software licensing data. Organizations are also able to contribute back with any missing or wrongly identified licensing data, helping to crowdsource a database that is accurate for the benefit of all.

In this article, we’ll present cdsbom, a tool to enhance SBOMs with ClearlyDefined’s licensing metadata. We’ll also showcase Linux Foundation’s use of ClearlyDefined and cdsbom. This integration helps Linux Foundation projects to gain deeper insights into their software supply chains, enabling more effective risk management and compliance tracking.

Installing cdsbom

cdsbom is a tool developed by Jeff Mendoza that helps enrich SBOMs with detailed licensing metadata, making it easier to understand and manage Open Source components in your projects. The installation is pretty straightforward:

Installing:

go install github.com/jeffmendoza/cdsbom@latest

Make sure $GOBIN is in your path.

  • $GOBIN defaults to $GOPATH/bin
  • $GOPATH defaults to $HOME/go on Unix and %USERPROFILE%\go on Windows

Using:

cdsbom -out enhanced-sbom.json input-sbom.json

This will read input-sbom.json and query ClearlyDefined for License information. The License fields in the SBOM will be replaced to use the license data returned from ClearlyDefined. A new sbom will be written to enhanced-sbom.json with the updated fields in the same format as the input sbom.

Supported formats are the same as Protobom. This project is possible due to Protobom for SBOM parsing, and GUAC sw-id-core to convert PURL to ClearlyDefined Coordinates. 

Case Study: Linux Foundation

The Linux Foundation provides key projects SPDX SBOMs and license analysis based on scanning source files and source project metadata (“Source” SBOMs).  A tool chain consisting of Open Source tools generates the final SBOM files orchestrated by the scaffold tool.

We recently added cdsbom into the tool chain to enrich the license metadata.  The integration was very straightforward due to the support of standard SBOM formats – especially SPDX which is used by scaffold.  The result is much higher quality license information.

After working through a few minor issues, cdsbom is now in regular use at the Linux Foundation, which hosts over 1,200 projects. While we don’t scan them all, we audit several hundred projects to ensure proper license compliance. This means when someone uses our code, they can trust it follows the stated Open Source license.

Going forward, we’re looking into improving the cdsbom performance through caching the license data as some of the SBOMs can be quite large and there are typically multiple requests for license data for the same project dependencies.

Final considerations

Accurate and reliable licensing information is essential for ensuring compliance and mitigating legal risks in Open Source software adoption. By enriching SBOMs using ClearlyDefined, organizations gain a more complete and precise view of the licenses governing their dependencies, reducing the likelihood of unintended license violations. This not only strengthens compliance efforts but also fosters greater confidence in using Open Source at scale.

ClearlyDefined creates a shared resource that benefits the entire ecosystem. Users who make use of  ClearlyDefined’s data can also contribute back by identifying and correcting gaps in licensing information. This collaborative approach helps build a more accurate and up-to-date crowdsourced database, ensuring that the broader Open Source community—including maintainers, enterprises, and compliance teams—has access to high-quality software license data.

Resources

To learn more about cdsbom, ClearlyDefined, and SBOMs at the Linux Foundation, please check these video recordings:

Authors

Jeff Mendoza: interested in dependency scanning and management for supply chain security and legal compliance. – Member of the Technical Steering Committee for ClearlyDefined, an OSI project – Maintainer of GUAC, an OpenSSF Incubating project – Member of the Steering Committee for Scorecard, an OpenSSF Incubating project – Maintainer of Allstar, part of Scorecard, an OpenSSF Incubating project – Software Engineer at Kusari.

Gary O’Neall: a contributor to the Software Package Data Exchange® (SPDX™) – an open standard for communicating software bill of material information, including components, licenses, copyrights, and security references. Gary has contributed several open source tools. Gary O’Neall is responsible for product development and technology for Source Auditor Inc., a software and service company helping software companies manage the technical and legal risks of open-source software.

We would also like to thank Alyssa Wright (Bloomberg), Chaim Haas (Bloomberg), and Jeff Shapiro (Linux Foundation) for their contributions.

]]>
https://opensource.org/blog/case-study-enhancing-sboms-with-cdsbom-at-the-linux-foundation/feed 0 142786
Extending the OSI’s reach, together https://opensource.org/blog/extending-the-osis-reach-together Wed, 09 Jul 2025 15:37:24 +0000 https://opensource.org/?p=139638 Members Newsletter – July 2025

In June, OSI staff and board members took our “we’ve got your back” commitment on the road—connecting directly with the global Open Source community to listen, inform, and advocate. From New York to Paris, we saw firsthand the growing momentum behind our shared mission—and the work still ahead.

At UN Open Source Week, we joined global leaders to discuss how Open Source AI can serve the public good. In partnership with the Digital Public Goods Alliance, we led a small workshop to discuss how AI systems can adhere to open standards that prioritize equity, access, and good data stewardship. We also met with UN leadership to advance flexible and inclusive approaches to AI governance that respect privacy and local contexts. Finally, Open Forum for AI presented the importance of openness as a design principle for infrastructure, including the development of AI.

At VivaTech, I participated in a lively panel on European AI sovereignty, arguing that real progress depends on genuine openness—licenses without loopholes, data mining that respects the wills of the creators, and infrastructure rooted in collaboration, not control. Europe has a historic opportunity to lead with values, and Open Source is the lever.

And at OW2con, OSI director of standards and policy Simon Phipps, in collaboration with Patrick Masson, Apereo’s executive director, presented the Open Source AI Definition (OSAID) to a packed room, sparking productive debate, especially around the role of training data in academic and education-focused AI systems. This kind of community feedback is precisely what we need as we refine the OSAID in the future.

These conversations are more than symbolic—they shape the policy, standards, and partnerships that protect and grow the Open Source ecosystem. We’re grateful to each of you who continues to show up, speak up, and build alongside us.

Let’s keep going, together.

Stefano Maffulli

Executive Director, OSI 

I hold weekly office hours on Fridays with OSI members: book time if you want to chat about OSI’s activities, if you want to volunteer or have suggestions.

News from the OSI

Building digital public goods: Reflections from UN Open Source Week 2025

The UN’s Open Source Week in NYC brought people together from around the world to discuss the promise of Open Source and how it can be leveraged to build sustainable digital public goods and infrastructure. The week included side events focused on openness and AI and two full days at the UN dedicated to Open Source Program Offices (OSPOs) and Digital Public Infrastructure.

Other highlights

OSI in the news

Forging A Responsible, Secure Way Forward For Open-Source AI

Article from Forbes

Before diving into what an open approach to AI looks like in practice, we must first understand what “open-source AI” really means. Defining it is a complex and evolving effort involving plenty of debate, but creating a standard is helpful for providing clear guidelines, promoting transparency and trust, and accelerating innovation and collaboration. One formal definition that has emerged comes from the Open Source Initiative (OSI): the Open Source AI Definition (OSAID), which is a work in progress that we endorse.

Other highlights

Other news

News from OSI affiliates and partners

Articles from Opensource.net

Survey

DPGA Global Open Source Policies & Practices Survey

The OSI and the DPGA, in coordination with 24 partners, has launched the Global Open-Source Policies & Practices Survey to map the current use of open-source-first approaches across governments and public-interest institutions.

Events

Upcoming events

Thanks to our sponsors

New sponsors and renewals

Featured: Bloomberg’s insights shared at the Open Source Summit NA 2025: The Power of “AND”: At Bloomberg, Open Source and Corporate Philanthropy Work Hand-in-Hand.

Interested in sponsoring, or partnering with, the OSI? Please see our Sponsorship Prospectus and our Annual Report. Please contact the OSI to find out more about how your company can promote open source development, communities and software.

Support OSI by becoming a full member

Let’s build a world where knowledge is freely shared, ideas are nurtured, and innovation knows no bounds! Join as a full member!

]]>
139638
Building digital public goods: Reflections from UN Open Source Week 2025 https://opensource.org/blog/building-digital-public-goods-reflections-from-un-open-source-week-2025 https://opensource.org/blog/building-digital-public-goods-reflections-from-un-open-source-week-2025#respond Tue, 08 Jul 2025 14:29:41 +0000 https://opensource.org/?p=139573 The UN’s Open Source Week in New York City brought people together from around the world to discuss the promise of Open Source and how it can be leveraged to build sustainable digital public goods and infrastructure. Stefano Maffulli, Executive Director of the OSI, was joined by board directors Tracy Hinds, Ruth Suehle, and Sayeed Choudhury, as well as staff members Katie Steen-James (senior U.S. policy manager), Ariel Jolo (program manager), and recently joined U.S. policy intern Gabriel Toscano. The week included side events focused on openness and AI and two full days at the UN dedicated to Open Source Program Offices (OSPOs) and Digital Public Infrastructure. 

Articulated throughout the week among UN participants was the idea that our “North Star” should be actively engaging the public in the development of digital public goods and infrastructure to ensure we are meeting the needs of citizens. Put simply, technology should make lives better, with public well-being at the heart of adoption. Guilherme Canela, Director of UNESCO’s Division for Digital Inclusion and Policies and Digital Transformation, put an even finer point on this idea during a session on AI and Open Source: “Maybe the real innovation is doing these things with no one left behind.” 

On Monday, Suehle helped organize the UN Tech Over Hackathon on behalf of the Apache Software Foundation. With the theme “Ahead of the Storm: Open Geospatial Analytics for Children-Centric Climate Emergency Response,” the three challenges had participants working to accelerate progress on the UN Sustainable Development Goals (SDGs) through Open Source innovation.

On Tuesday, the OSI joined our partners at the Digital Public Goods Alliance (DPGA) for a side event on “Advancing Open Source AI for the Public Good.” DPG Standard Lead Amreen Taneja discussed how AI systems can meet the criteria to be part of the Digital Public Goods Registry and officially opened a call for AI submissions. Maffulli explained the co-creation process for the Open Source AI Definition (OSAID) and outlined the components of version 1.0 of the definition. Participants then gathered in small groups to discuss policy solutions to incentivize the creation and use of open AI systems. The session emphasized the need for standards and definitions to organize the governance of and use of AI. 

On Wednesday, Choudhury participated in a panel titled “How They Did It: A Look Behind Newly Launched OSPOs,” where he shared the OSPO origin story at Carnegie Mellon. He offered a compelling insight: if you ask a university researcher, “Do you care about Open Source software?” they might say no. But if you ask, “Do you care about research, education, and social impact?”, they’ll say yes, of course. Making the connection that Open Source software directly fosters the university’s core mission of research, education, and social impact proved to be a key argument in demonstrating the value of Open Source to academic institutions.

OSI also had the pleasure of meeting with the Under-Secretary-General and Special Envoy for Digital and Emerging Technologies at the UN, Amandeep Singh Gill, to share what we learned from developing the Open Source AI Definition (OSAID). He leads the UN Office for Digital and Emerging Technologies (ODET) and is responsible for implementing the Global Digital Compact, including the section on AI governance. In our meeting, we discussed the existing gaps for AI training data governance strategies that are flexible enough to apply in local contexts and respectful of indigenous knowledge, privacy, and copyright, among other considerations. Several challenges discussed included training data: the absence of or inadequate technological standards and global legal frameworks to handle data governance. Both the OSI and the UN are exploring the concept of data commons to tackle these challenges.

On Friday morning, Choudhury spoke about the Open Forum for AI (OFAI), including its connection with OSI and the OSAID. The presentation covered the importance of openness as a design principle for infrastructure, including the development of AI. In particular, OFAI has convened universities and non-profit organizations, which help raise the voice and impact of academia and civil society organizations.

On Friday, OSI participated in the AI Alliance meeting, where Roberto Di Cosmo, CEO of the Software Heritage Foundation, presented the challenges of building a training dataset based on code. He mentioned how difficult it is to track ownership of source code copyrights, correctly recognize licenses and attributions, and manage opt-out and take-down requests. 

This year’s UN Open Source Week marked the third time participants convened to talk about the power of Open Source. Echoing throughout the sessions was a sense that people understand the benefits of “open.” However,​​ challenges still exist in the implementation of Open Source policies and projects, especially when collaboration is required with individuals who may not understand the benefits of Open Source. This is where the UN’s power to convene experts from around the world is so important. Through the UN, people from Kenya to Spain shared challenges and successes in implementing Open Source projects as Digital Public Goods.

From left to right: Gabriel Toscano, Katie Steen-James, Stefano Maffulli, Amandeep Singh Gill, and Moritz Fromageot.
]]>
https://opensource.org/blog/building-digital-public-goods-reflections-from-un-open-source-week-2025/feed 0 139573
Keeping Europe safe and advancing Open Source: OSI provides feedback to the EU Cybersecurity Act https://opensource.org/blog/keeping-europe-safe-and-advancing-open-source-osi-provides-feedback-to-the-eu-cybersecurity-act https://opensource.org/blog/keeping-europe-safe-and-advancing-open-source-osi-provides-feedback-to-the-eu-cybersecurity-act#respond Thu, 03 Jul 2025 12:49:25 +0000 https://opensource.org/?p=138058 Just over 20 years ago, the EU (European Union) founded ENISA, (the EU agency for Cybersecurity). Over the years, ENISA’s role has grown significantly, and at this time the EU seeks to revise ENISA’s mandate by updating the Cybersecurity Act. The Open Source Initiative (OSI) has provided feedback on what changes can be made to keep Europe safer and advance Open Source.

The revision of ENISA’s mandate is timely: as the world–and the Open Source community–face geopolitical uncertainty and increasingly frequent cyber attacks, in particular state-backed attacks, fostering stronger cybersecurity has never been more important. 

ENISA’s work has historically involved providing vulnerability reporting, product certification (in particular for the cloud), documentation, resources, and advice for European governments, citizens and businesses. It also has a coordinating role in cross-border cybersecurity incidents.

Providing vital cybersecurity resources

In its feedback, the OSI commended ENISA on the resources it provides, in particular to businesses and citizens. We support the decision to publish all their work, including advice and reports under Open Content licenses, and particularly commend their IRTOOLS repository which lists hundreds of useful Open Source cybersecurity tools for citizens and businesses to deploy.

We are only ever as secure as the most vulnerable part of the stack, which is why it is so vital that we democratize access to cybersecurity, and help everyone, from individual citizens to small businesses, benefit from cybersecurity advice and solutions. We believe that Open Source is the greatest driver of this democratization, and we recommend that the EU ensure ENISA can continue and expand this vital activity. 

Vulnerability reporting challenges

The OSI also commended ENISA for developing its European vulnerability reporting system. In times of geopolitical uncertainty, we accept that relying on a single organization to provide vulnerability reporting and classification globally is a risk, especially when that organization depends on funding from a single government.

However, OSI highlighted some concerns over the lack of alignment with the existing MITRE CVE system. It is vital now that vulnerability databases collaborate and work together, not in spite of geopolitical uncertainty, but because of it. Hence, we called on ENISA to work on aligning its database with the existing MITRE CVE database, and to collaborate closely with them in developing a federated vulnerability reporting solution. We believe this is the best way to ensure the resilience of such a vital piece of digital infrastructure. 

Funding to secure key Open Source solutions

Finally, in line with our support of the EU Sovereign Tech Fund proposal, and to ensure that highly-used Open Source projects remain sustainable and secure, we called on the EU to give ENISA funding to support security audits, pentesting, and bug bounties for Open Source projects and components that are heavily used by European public authorities and companies.

The OSI will continue its efforts in Europe and around the world to support sustainability of Open Source projects globally. Like what we do? You can support our work by becoming a member.

]]>
https://opensource.org/blog/keeping-europe-safe-and-advancing-open-source-osi-provides-feedback-to-the-eu-cybersecurity-act/feed 0 138058
LinuxFr.org joins the OSI: strengthening the francophone community https://opensource.org/blog/linuxfr-org-joins-the-osi-strengthening-the-francophone-community https://opensource.org/blog/linuxfr-org-joins-the-osi-strengthening-the-francophone-community#comments Wed, 02 Jul 2025 13:43:02 +0000 https://opensource.org/?p=137981 Lire l’annonce en français sur LinuxFr.org

OSI keeps growing: LinuxFr.org, the largest French-speaking community of Linux users, has officially joined the Open Source Initiative (OSI) as an Affiliate organization. This marks an important step in deepening our engagement with francophone Open Source communities and highlighting the grassroots efforts that have long supported open collaboration around the world.

What Is LinuxFr.org?

Founded in 1998, the same year as the Open Source Initiative, LinuxFr.org is one of the most influential Francophone websites dedicated to Open Source software. LinuxFr.org is entirely community-driven and serves as a central hub for publishing news, opinion pieces, software releases, event announcements, and thoughtful commentary related to the Linux and Open Source communities.

In the course of its existence, over 50,000 users at LinuxFr.org have contributed to 120,000 articles (98% under the CC BY-SA license) and to nearly 2 million comments. The website receives 25 million visits per year.

LinuxFr.org has played and continues to play a crucial role in making Open Source accessible and relevant to French-speaking communities. It helped shape early Open Source discourse in France. At a time when global collaboration is more important than ever, platforms like LinuxFr.org help bridge cultural and linguistic gaps in the Open Source ecosystem.

A shared commitment to Openness

“After countless birthday celebrations alongside the Open Source Initiative, LinuxFr.org is proud to now join forces as an Affiliate organization. In a time when Open Source is facing challenges everyday, this partnership is essential to highlight shared values. Only by bringing our communities closer together can we safeguard and advance the freedoms we both champion.” – Florent Zara, board member at LinuxFr

We welcome LinuxFr.org as an OSI Affiliate and look forward to collaborating with them to support our shared commitment to Open Source. Their participation strengthens our international network and underscores the importance of nurturing Open Source cultures in all languages and regions.

Join OSI as an Affiliate organization.

LinuxFr and the Open Source Initiative celebrating their shared 25th Anniversary in 2023.
]]>
https://opensource.org/blog/linuxfr-org-joins-the-osi-strengthening-the-francophone-community/feed 2 137981
Introducing the new API for OSI Approved Licenses® https://opensource.org/blog/introducing-the-new-api-for-osi-approved-licenses https://opensource.org/blog/introducing-the-new-api-for-osi-approved-licenses#comments Thu, 19 Jun 2025 13:21:03 +0000 https://opensource.org/?p=137134 The Open Source Initiative (OSI) is excited to announce the availability of a new API service providing access to the canonical list of OSI Approved Licenses®. This launch is part of our broader effort to modernize how we manage and share Open Source license data, making it easier for the community to identify and verify licenses that comply with the Open Source Definition.

The new API

The list of OSI Approved Licenses® is a critical reference point for developers, legal teams, companies, and communities around the world. The OSI Approved Licenses® database is a comprehensive, structured, and up-to-date database of approved licenses and their metadata. This new API service builds directly on that work.

The new API is served directly from our website and reflects the official source of truth for OSI license data. This service is fully public and free to use. You can now access the full list of OSI Approved Licenses® from:

https://opensource.org/api/license

You can fetch detailed metadata on individual licenses, including:

  • License name and version
  • SPDX identifier
  • Approval and submission dates
  • License steward and submitter
  • Withdrawal or retirement status
  • Links to board meeting minutes and evidence of approval

For example, you can access data from the GNU General Public License version 3 at:

https://opensource.org/api/license/gpl-3-0

{
  "id": "gpl-3-0",
  "name": "GNU General Public License version 3",
  "version": "3.0",
  "submission_date": "20070629",
  "submission_url": "http://lists.opensource.org/pipermail/license-discuss_lists.opensource.org/2007-June/012888.html",
  "submitter_name": "GNU GENERAL PUBLIC LICENSE",
  "approval_date": "20070905",
  "license_steward_version": "",
  "license_steward_url": "https://www.gnu.org/licenses/gpl-3.0.en.html",
  "board_minutes": "https://opensource.org/meeting-minutes/minutes20070905/",
  "stewards": [
    "free-software-foundation"
  ],
  "keywords": [
    "popular-strong-community"
  ],
  "_links": {
    "self": {
      "href": "https://opensource.org/api/license/gpl-3-0"
    },
    "html": {
      "href": "https://opensource.org/license/gpl-3-0"
    },
    "collection": {
      "href": "https://opensource.org/api/licenses"
    }
  }
}

It’s also possible to search licenses by name:

https://opensource.org/api/license?name=gpl

Deprecation of legacy service

The new API is not backward compatible with the legacy API service. Users will need to migrate to the new endpoint. If you’re currently using api.opensource.org, please note that the old service is outdated and will be deprecated in the coming months. We recommend beginning your migration now to ensure uninterrupted access.

Feedback welcome

We’re still refining the API and exploring ways to expand its capabilities. If you have a use case, suggestion, or need help transitioning to the new service, please get in touch. We’re especially interested in hearing from developers, legal teams, and tooling providers who rely on accurate license data. We look forward to seeing what the community builds on top of this new API.

We would like to thank Automattic for sponsoring this work and our former intern Giulia Dellanoce for creating a systematic and well-ordered database of all the licenses that have been submitted to OSI for approval since the time of the organization’s founding.

]]>
https://opensource.org/blog/introducing-the-new-api-for-osi-approved-licenses/feed 3 137134