So, my name is Boris Baldassari, I work for the Eclipse Foundation as an open source consultant
and I'd like to introduce the OSPO Alliance and the work we are doing on the Good Governance
Initiative.
So, to start with, what is an OSPO?
So, OSPO stands for Open Source Program Office and it's a team within an organization that
takes care of everything open source within the organization.
So, it's supposed to be a single point of contact for any question people may have about
open source licensing and so on.
The OSPO is supposed to foster the awareness of open source within the organization, define
and implement a strategy regarding open source for the organization, inbound, outbound and
much more than that.
So, the idea is to make sure that the organization makes a good use of the open source, they
consume, produce and so on.
It also includes things about the ecosystem, the open source ecosystem and the participation
into the ecosystem, the open source ecosystem by the organization.
It should be noted that it has many impacts on many domains, so it's from the legal, to
the technical, to the security dependencies, development practices and so on.
And it's a strong recent trend, so many organizations nowadays are in the process of setting up
an OSPO.
When I talk about organizations, I talk about any type of organization, so these could be
corporations, SMEs, administrations, universities, NGOs and so on.
The point with these organizations is that quite often they don't know anything about
open source, it's not in their culture, so they just don't know where to start.
That's where the OSPO Alliance comes into the picture.
So, the OSPO Alliance was launched in 2021 by a group of four European non-profit organizations
and the idea is to promote an approach to excellence in open source software management.
We wanted it to be really easy to access, low barrier, there is no fee, there is no commitment.
The only thing we ask is a letter of support, a statement of support from the organization
to the principles of open source and the OSPO Alliance.
All our activity is open, public and fully accessible, no need to register to get access
to what we, to our outcomes.
We are entirely governed by open source principles, so you can just come, join us, collaborate
and if you are an active contributor, then you will become a maintainer and so on.
And once again, it's for all types and sizes of organizations.
Our mission is two-fold, so firstly, help the organizations make sure that they better
use the open source software and ecosystem and properly take care of open source and
also make them good citizens of the open source ecosystem, so not only consuming and producing
but also participating and financing and being there and openly asserting their use of open
source, so things like that.
To achieve these goals, we have set up different sub-task forces.
The first and the most visible one is the Good Governance Initiative Handbook, which
is a blueprint to help organizations define and build their OSPO.
We also provide a safe place to exchange information so people can ask any type of question when
they are trying to replace some proprietary software by an open source alternative that
they can ask for what others did.
We have mailing lists, meetings, regular meetings.
We participate to events and we also have a monthly session which is called the OSPO
Unworn Sessions, where some of our members present how they did with their OSPO and share
their good practices, their mistakes too.
We also have a task force for evangelism and dissemination of our initiative.
The Good Governance Handbook, as I said, is a blueprint to help organizations define,
so build a roadmap and actually build their OSPO and make it a success.
After that, we propose 25 activities, which are good practices that you want to implement
when you build your OSPO and when you want to grow the open source awareness within your
organization.
These 25 activities are organized into five goals, which are levels of maturity.
The first one will be identify the open source you use and identify the skills that you have.
Start changing your contracts with your employees so they can actually contribute, set up or
educate the legal team, educate the executives, contribute back, contribute upstream, assert
publicly your use of open source, and so on.
We also provide the methods to implement these 25 activities, so we recommend an agile-like
process where you will pick a few activities, complete them, select a few other activities,
and so on until you have completed the scope.
We had quite some success, so the first edition of our Handbook was in 2021.
Last year we did an update the 1.1 version, and we also have translations, so German and
French are already available, and a few others are on their way, so Portuguese, Spanish, Italian,
and whatever your language is, please join us.
We use weblates, and we, of course, welcome contributors.
Talking about the activities, they have really a wide range and scope, so it's from, as
I said, identifying the open source you use, doing software composition analysis, dependency
management, vulnerability management, it's also about implementing the good practices
that we use in open source, so setting up peer reviews and things like that, training
the people, HR, so the contract, allowing people to contribute, funding the ecosystem,
the project that you use, and the foundation and the organization that make the open source
ecosystem up to executive education and potentially making open source strategic asset for your
organization.
Each activity has the same structure, so we have a description that states what this
activity is about, opportunity assessment, why would you implement this activity, what
it will bring to you, progress assessment, so you know where you are and that enables
to track your progress and know when you can, you can say that it's a complete activity
and you can switch to the next.
Recommendations, so feedback from the field, experienced people saying, well, you might
have a look at this that will help, and also some tools and recommendations and resources
that you might find useful.
As I said, the good governance initiative is for any type of organizations, so there
are activities that will not fit within your organization.
The first thing that you will do actually when you will implement the handbook is look
at all the activities and select the one that you want or reject the one that do not
apply to your context, that's okay, and from there the activities are kind of generic,
so what you want to do from there is for each activity create a scorecard which will be
the local adaptation of the activity to your own organization, so that will imply stating
the teams, the internal teams that you may reach out to, the competencies, skills that
you may need, the processes, tools, and resources that you can use and that you will have to
deal with, and also identify some specific tasks that are relevant to your context,
and that this task will help you track your progress on the scorecard.
We provide the scorecards in two versions, one is the PDF that you can simply print and
fill in with a paper and pen, good old style, and also a digital one.
So last year when we did the 1.1 version of the handbook, we introduced a new feature
which is a deployable GGI program.
So basically it's a GitLab project that you clone in your own GitLab or in any GitLab
and from there there will be a bunch of scripts that will be executed, creates 25 activities
as GitLab issues, so create a board so you can visualize them, you can click on an issue
and see the description, opportunity assessment, and so on.
From there you can edit the description to fill in your own scorecard, and once you have
that, so you have all your issues, you can visualize them in the board, you have defined
your scorecard, so you can just start working on them.
So you select a few of them, you work on them, you complete them, you select a few other
ones and so on.
And each and every time, so it's a nightly script actually, but my GGI will create a
GitLab page, a static website that will reflect where you are, what are your current activities,
your past activities, and will even provide a simple dashboard.
So the list of activities when you have implemented the my GGI looks like that, and the simple
dashboard that you get and static website looks like that, so you have the full description
of the activities that you are working on and also the scorecards.
So it really tracks your own adaptation and implementation of the GGI program.
So that's all, once again we are an open source initiative, so you can access all our resources
for free, not even need to register whatsoever, you go to our website, Ospo-Alliance.org,
from there you can download the Good Governance Handbook, there is an HTML version.
You get access to all the translations that are available, and there is also a section
about contributing.
You can just simply join our calls, we have weekly calls and just connect, everything
is there.
So we are European based because our contributors are European, so it's really based on the
European values and way of doing things and so on, but we are open to absolutely everyone.
So just come, join us, you can help on the translations, on the updates of the handbook,
on the dissemination, and if you want to follow us, it's here.
And that's it.
Thank you.
Thank you very much.