Automotive Linux Summit Fall

FOSS and especially Linux is present at virtually all stages of the Automotive supply chain and companies invest considerable efforts into determining and fulfilling the license obligations required for making deliveries license compliant. To make this process efficient, they usually take for granted the license compliance information provided by suppliers without verifying its completeness or correctness. But the believe in this widespread, good-faith approach was recently destroyed by a German court of law. As a consequence, established processes have to change. This presentation shows how SPDX, combined with standardized FOSS Management activities can create a network of trusted suppliers where compliance information is jointly managed, making it reliable and seamlessly travel with the code. This approach can greatly reduce the FOSS Management effort for all network participants.