Open Source Summit Europe + ELC Europe 2017

We have introduced the open source project SW360, a component management hub that allows organizations to manage Open Source, commercial as well as custom software components throughout the entire life cycle. Using SW360 as a one-stop shop for component information, organizations can track the components used in projects or products to:

*manage compliance information, such as SPDX documents
*assess security vulnerabilities
*manage Bill of Materials

As an Open Source project (https://www.github.com/sw360), it is highly customizable, lets organizations keep their confidential product development data on premises, and prevents them from becoming dependent on a single vendor.

Using SW360 via UI is great for project managers, legal counsels and quality management. However, in today’s fast paced and agile software development projects software developers and project managers cannot spend weeks in an extensive compliance management phase shortly prior the project deadline. They need compliance and security information straight away directly within their continuous build pipeline.

In this talk I will show you opportunities on how SW360 can be integrated into a continuous integration pipeline and fully leverage its potential as being the central source of component information in an organization.