Nextcloud Validates License Compliance Through OpenChain

Nextcloud is 100% open source, providing protection from the risks caused by mixing proprietary and open source licensed code. Risks for businesses are increasing with the rise of copyright trolls in especially Germany. Black Duck reports in their Open Source Security and Risk Analysis that nearly all of over 1000 applications scanned contained open source components, noting that: „67% applications with open source had vulnerabilities, and legal risks were even more widespread.“ Nextcloud takes these issues extremely seriously, running a successful Security Bug Bounty Program to protect their customers and has now taken the step to be the first enterprise file sync and share solution to verify full license compliance through OpenChain.

OpenChain Conformance

The OpenChain Project, hosted by The Linux Foundation®, identifies key recommended processes for effective open source management. The project builds trust in open source by making open source license compliance simpler and more consistent. In order to achieve this goal, they provide a set of tools:

• OpenChain Specification defines a core set of requirements every quality compliance program must satisfy.
• OpenChain Curriculum that provides the educational foundation for open source processes and solutions, whilst meeting a key requirement of the OpenChain Specification.
• OpenChain Conformance allows organizations to display their adherence to these requirements. The result is that open source license compliance becomes more predictable, understandable and efficient for participants of the software supply chain.

Nextcloud joins the likes of LG, Qualcomm, and Siemens in certifying its supply chain using OpenChain.

OpenChain Conformance is designed for companies of all sizes that deal with open source software. Nextcloud is a high profile, high growth startup that adheres to the same overarching compliance processes as multinationals. It is a clear example of why OpenChain Conformance is the correct approach to establishing an industry standard for open source compliance in the supply chain.

says Shane Coughlan, OpenChain Program Manager.

Nextcloud is 100% open source, avoiding the legal risks of mixing proprietary and incompatible open source licenses and providing the full benefit of open, transparent development. Compliance with open source licenses is an important matter for us and we’re glad to participate in the OpenChain program, using their approach to help verify compliance, giving customers increased peace of mind with regards to license compliance.

said Frank Karlitschek, managing director at Nextcloud GmbH.

See also the OpenChain announcement of Nextcloud joining. You can learn more about OpenChain on their website or in these two articles by LWN.