---
title: Open Source Tools to Build Open Source Compliance
description: "Open Source Tools to Build Open Source Compliance\n\nJoin us Wednesday, June 19th at 10am EDT via WebEx for two guest presentations for the FINOS Open Source Readiness (OSR) Working Group.\n\nAs financial services firms get serious about open source collaboration, one of their first priorities is getting a handle on the open source software they're already using. Open source may be free-of-cost but it's not free of obligation: using it responsibly means compliance with open source licenses and keeping current with updates to ensure the products using it remain secure."
image: https://www.finos.org/hubfs/osr440-2.png
---
[](https://finos.org)
- [Projects](https://www.finos.org/projects)
- [Artificial Intelligence (AI)](https://ai.finos.org/)
- [Common Domain Model (CDM)](https://www.finos.org/common-domain-model)
- [FDC3](https://www.finos.org/fdc3)
- [Fluxnova](https://fluxnova.finos.org)
- [FINOS Common Cloud Controls](https://www.finos.org/common-cloud-controls-project)
- [High Performance Computing (HPC)](https://hpc.finos.org)
- [OSERA](https://osera.finos.org/)
- [Open Source Readiness Initiative](https://www.finos.org/open-source-readiness)
- [OS-Climate](https://www.finos.org/os-climate)
- [Try our Projects](https://www.finos.org/project-sandbox)
- [All Projects Landscape](https://landscape.finos.org/)
- [Community](https://www.finos.org/engage-with-our-community)
- [FINOS Community Calendar](https://www.finos.org/calendar)
- [Community Quickstart](https://www.finos.org/get-involved)
- [FINOS Community Site](https://community.finos.org/)
- [Contribute](https://community.finos.org/docs/governance/Software-Projects/contribution)
- [Unable to Contribute?](https://www.finos.org/open-source-readiness)
- [Join our Slack channel](https://finos-lf.slack.com/messages/finos-community/)
- [Recognize a contributor](https://github.com/finos/community/issues/new?assignees=mcleo-d&labels=community-recognition&template=Community-Recognition.md&title=FINOS+Community+Recognition)
- [Ambassador Program](https://www.finos.org/ambassador-program)
- [Membership](https://www.finos.org/membership-benefits)
- [Members](https://www.finos.org/members)
- [Inquire](https://www.finos.org/membership-benefits#become-a-member)
- [Join](https://joinnow.platform.linuxfoundation.org/?project=finos)
- [Member ROI Summary & Calculator](https://www.finos.org/roi-report-calculator)
- [Dependency Consumption Analysis](https://www.finos.org/dependency-consumption-analysis)
- Resources
- [2025 Mission & Vision](https://www.finos.org/2024-in-review-2025-vision)
- [Research & Case Studies](https://www.finos.org/research-case-studies)
- [Training](https://training.linuxfoundation.org/finos/)
- [Open Source Maturity Model](https://osr.finos.org/docs/bok/OSMM/Introduction)
- [Contributions Live Dashboard](https://metrics.finos.org)
- [Our Github Organization](https://github.com/finos/)
- [Our Developer Toolchain](https://odp.finos.org/)
- [FINOS Store](https://store-finos.myshopify.com/)
- News & Events
- [This Week At FINOS](https://www.finos.org/this-week-at-finos)
- [Community Blog](https://www.finos.org/blog)
- [Newsletter](https://www.finos.org/newsletter)
- [Podcast: Open Source in Finance](https://www.finos.org/open-source-in-finance-podcast)
- [Press Releases](https://www.finos.org/press)
- [FINOS Events](https://www.finos.org/hosted-events)
- [Community Events](https://www.finos.org/featured-events)
- [Community Spotlight](https://www.finos.org/community-spotlight)
- [Stay Informed](https://www.finos.org/sign-up)
- [About](https://www.finos.org/about-us)
- [Stay Informed](https://www.finos.org/sign-up)
- [FAQs](https://www.finos.org/faq)
- [Contact Us](https://www.finos.org/contact-us)
- [Governing Board](https://www.finos.org/governing-board)
- [Technical Oversight Committee](https://www.finos.org/technical-oversight-committee)
- [Team](https://www.finos.org/team)
- [Governance](https://www.finos.org/governance)
- [Code of Conduct](https://www.finos.org/code-of-conduct)
- [OSFF + Videos](https://events.linuxfoundation.org/open-source-finance-forum)
- [OSFF 2026](https://events.linuxfoundation.org/open-source-finance-forum/)
- [OSFF NY Workshops](https://www.finos.org/osff-ny-2026-workshops)
- [OSFF Toronto 2026 Videos](https://www.finos.org/osff-toronto-2026-videos)
- [OSFF New York 2025 Videos](https://www.finos.org/osff-nyc-2025-videos)
- [OSFF London 2026 Videos](https://www.finos.org/osff-london-2026-videos)
- [apidays Paris 2025 Videos](https://www.finos.org/apidays)
- [Projects](https://www.finos.org/projects)
- [Artificial Intelligence (AI)](https://ai.finos.org/)
- [Common Domain Model (CDM)](https://www.finos.org/common-domain-model)
- [FDC3](https://www.finos.org/fdc3)
- [Fluxnova](https://fluxnova.finos.org)
- [FINOS Common Cloud Controls](https://www.finos.org/common-cloud-controls-project)
- [High Performance Computing (HPC)](https://hpc.finos.org)
- [OSERA](https://osera.finos.org/)
- [Open Source Readiness Initiative](https://www.finos.org/open-source-readiness)
- [OS-Climate](https://www.finos.org/os-climate)
- [Try our Projects](https://www.finos.org/project-sandbox)
- [All Projects Landscape](https://landscape.finos.org/)
- [Community](https://www.finos.org/engage-with-our-community)
- [FINOS Community Calendar](https://www.finos.org/calendar)
- [Community Quickstart](https://www.finos.org/get-involved)
- [FINOS Community Site](https://community.finos.org/)
- [Contribute](https://community.finos.org/docs/governance/Software-Projects/contribution)
- [Unable to Contribute?](https://www.finos.org/open-source-readiness)
- [Join our Slack channel](https://finos-lf.slack.com/messages/finos-community/)
- [Recognize a contributor](https://github.com/finos/community/issues/new?assignees=mcleo-d&labels=community-recognition&template=Community-Recognition.md&title=FINOS+Community+Recognition)
- [Ambassador Program](https://www.finos.org/ambassador-program)
- [Membership](https://www.finos.org/membership-benefits)
- [Members](https://www.finos.org/members)
- [Inquire](https://www.finos.org/membership-benefits#become-a-member)
- [Join](https://joinnow.platform.linuxfoundation.org/?project=finos)
- [Member ROI Summary & Calculator](https://www.finos.org/roi-report-calculator)
- [Dependency Consumption Analysis](https://www.finos.org/dependency-consumption-analysis)
- Resources
- [2025 Mission & Vision](https://www.finos.org/2024-in-review-2025-vision)
- [Research & Case Studies](https://www.finos.org/research-case-studies)
- [Training](https://training.linuxfoundation.org/finos/)
- [Open Source Maturity Model](https://osr.finos.org/docs/bok/OSMM/Introduction)
- [Contributions Live Dashboard](https://metrics.finos.org)
- [Our Github Organization](https://github.com/finos/)
- [Our Developer Toolchain](https://odp.finos.org/)
- [FINOS Store](https://store-finos.myshopify.com/)
- News & Events
- [This Week At FINOS](https://www.finos.org/this-week-at-finos)
- [Community Blog](https://www.finos.org/blog)
- [Newsletter](https://www.finos.org/newsletter)
- [Podcast: Open Source in Finance](https://www.finos.org/open-source-in-finance-podcast)
- [Press Releases](https://www.finos.org/press)
- [FINOS Events](https://www.finos.org/hosted-events)
- [Community Events](https://www.finos.org/featured-events)
- [Community Spotlight](https://www.finos.org/community-spotlight)
- [Stay Informed](https://www.finos.org/sign-up)
- [About](https://www.finos.org/about-us)
- [Stay Informed](https://www.finos.org/sign-up)
- [FAQs](https://www.finos.org/faq)
- [Contact Us](https://www.finos.org/contact-us)
- [Governing Board](https://www.finos.org/governing-board)
- [Technical Oversight Committee](https://www.finos.org/technical-oversight-committee)
- [Team](https://www.finos.org/team)
- [Governance](https://www.finos.org/governance)
- [Code of Conduct](https://www.finos.org/code-of-conduct)
- [OSFF + Videos](https://events.linuxfoundation.org/open-source-finance-forum)
- [OSFF 2026](https://events.linuxfoundation.org/open-source-finance-forum/)
- [OSFF NY Workshops](https://www.finos.org/osff-ny-2026-workshops)
- [OSFF Toronto 2026 Videos](https://www.finos.org/osff-toronto-2026-videos)
- [OSFF New York 2025 Videos](https://www.finos.org/osff-nyc-2025-videos)
- [OSFF London 2026 Videos](https://www.finos.org/osff-london-2026-videos)
- [apidays Paris 2025 Videos](https://www.finos.org/apidays)
# Community Blog
# Open Source Tools to Build Open Source Compliance
June 17, 2019
[Aaron Williamson](https://www.finos.org/blog/author/aaron-williamson)
[**Join us Wednesday, June 19th at 10am EDT via WebEx for two guest presentations for the FINOS Open Source Readiness (OSR) Working Group.**](https://finosfoundation.atlassian.net/wiki/spaces/OSR/pages/154435612/Open%2BSource%2BReadiness%2BWorking%2BGroup#OpenSourceReadinessWorkingGroup-Meetings)
As financial services firms get serious about open source collaboration, one of their first priorities is getting a handle on the open source software they're already using. Open source may be free-of-cost but it's not free of obligation: using it responsibly means compliance with open source licenses and keeping current with updates to ensure the products using it remain secure.
A successful open source compliance process requires tools and procedures to track open source components in use, monitor updates, and build compliance information into software releases. Because these tasks each require significant human involvement, every company has a different compliance workflow.
There are a number of vendors that provide tools and automation to manage open source compliance, including FINOS Member [WhiteSource](https://www.whitesourcesoftware.com/) (technology currently in use in our [FINOS Open Developer Platform](https://www.finos.org/open-developer-platform))[,](https://www.whitesourcesoftware.com/)[Black Duck](https://www.blackducksoftware.com/), [Flexera](https://www.flexerasoftware.com/protect/business-solutions/open-source-license-compliance.html), [FOSSA](https://fossa.com/)and [nexB.](https://www.nexb.com/)But some companies prefer to keep some or all of their compliance workflow in-house, whether to integrate better with bespoke software development lifecycle tooling, because of budget constraints, or for other reasons.
Over the next couple of months, the [FINOS Open Source Readiness Working Group](https://www.finos.org/osr) will be exploring the open source tools available to help companies build and manage their own open source compliance workflows.
On **Wednesday, June 19th at 10am EDT**, **[join us](https://finosfoundation.atlassian.net/wiki/spaces/OSR/pages/154435612/Open%2BSource%2BReadiness%2BWorking%2BGroup#OpenSourceReadinessWorkingGroup-Meetings)** for two guest presentations on this topic[:](https://finosfoundation.atlassian.net/wiki/spaces/OSR/pages/154435612/Open%2BSource%2BReadiness%2BWorking%2BGroup#OpenSourceReadinessWorkingGroup-Meetings)
**[Kate Stewart](https://www.linkedin.com/in/katestewartaustin)**of the [Linux Foundation](http://linuxfoundation.org/) will discuss LF's [Automated Compliance Tools (ACT) Project](https://www.linuxfoundation.org/press-release/2018/12/the-linux-foundation-to-launch-new-tooling-project-to-improve-open-source-compliance/) to consolidate investment in, and increase interoperability and usability of, open source compliance tooling to help organizations manage compliance obligations. ACT supports the development of several tools, including: [QMSTR](https://qmstr.org/), a toolchain that focuses on producing compliance documentation for software builds; [Tern](https://github.com/vmware/tern), an open source project for inspecting container images for open source compliance; [FOSSology](https://www.fossology.org/), a toolkit for running license, copyright, and export control scans; and [SPDX Tools](https://spdx.org/tools), a collection of software tools for managing SPDX-formatted compliance information.
**Gary O'Neall** of [Source Auditor](https://sourceauditor.com/) will present the Linux Foundation's [SPDX Project](https://spdx.org/), which provides a standard format for communicating the components, licenses and copyrights associated with a software package. Gary is the maintainer of the [SPDX Tools](https://spdx.org/tools) project and will discuss how to use those tools to produce an open source bill of materials for a product.
Join us Wednesday at 10am EDT to learn more! Conference info for the Open Source Readiness working group is available**[here.](https://finosfoundation.atlassian.net/wiki/spaces/OSR/pages/154435612/Open%2BSource%2BReadiness%2BWorking%2BGroup#OpenSourceReadinessWorkingGroup-Meetings)**You can add the event to your calendar by importing the [FINOS Program calendar](https://calendar.google.com/calendar/embed?src=finos.org_fac8mo1rfc6ehscg0d80fi8jig%40group.calendar.google.com&ctz=America%2FNew_York).
### Share this:
- [Tweet](https://twitter.com/share)
[← This Week at FINOS: Week of June 17, 2019](https://www.finos.org/blog/this-week-at-finos-week-of-june-17-2019)
[Working with an open source project (aka “Can I modify the code of an open source project?”) →](https://www.finos.org/blog/working-with-an-open-source-project-aka-can-i-modify-the-code-of-an-open-source-project)
[](https://www.finos.org/)
[](https://twitter.com/finosfoundation) [](https://finos.github.io) [](https://www.linkedin.com/company/finosfoundation) [](https://www.slideshare.net/finosfoundation) [](https://www.youtube.com/channel/UCfJAdRALzJ7J7snubrb_Y-Q)
[Contact Us](https://www.finos.org/contact-us)
[info@finos.org](mailto:info@finos.org)
+1 (650) 665-9773
[Privacy |](https://www.finos.org/privacy-policy)[Terms of Service |](https://www.finos.org/terms-of-service)[Community Code of Conduct |](https://www.finos.org/code-of-conduct)[Email Preferences](https://www.finos.org/hs/manage-preferences/unsubscribe-simple)