If your software runs on open source (and it almost certainly does), someone is eventually going to ask you to prove you manage it well. Maybe it’s a customer’s procurement team, or a contracting officer reviewing your ATO package.

In that conversation, they’re looking for a documented program and records that back it up.

That’s what the OpenChain standards are for. The OpenChain Project, hosted by the Linux Foundation, maintains two of them:

  • ISO/IEC 5230, the international standard for open source license compliance programs
  • ISO/IEC 18974, the industry standard for open source security assurance programs

So we’re glad to share some news: Anchore is now an official OpenChain Partner in the Vendor category. We’ve joined a global network of organizations that help teams adopt these standards.

Why this fits what we already build

Both standards come back to a question we’ve been working on for years: what’s actually in your software?

OpenChain expects you to know which open source components you ship, evaluate the risks and license obligations attached to them, and keep records you can verify later. That’s the day-to-day work our tools were built for.

Syft generates SBOMs. Grype scans them for vulnerabilities. Together, the two open source projects have passed 50 million downloads. Anchore Enterprise builds on both with SBOM management, vulnerability management, policy enforcement, and compliance validation across CI/CD pipelines and production environments.

The record-keeping piece is the one we care about most. Auditors ask about components months after you ship them, so an SBOM has to stick around. We treat the SBOM as a persistent record you can go back to and query, which is the kind of evidence an OpenChain-aligned program needs.

(Small bonus: Syft already outputs SPDX, which is also a Linux Foundation project. The pieces fit together nicely.)

Open source is the foundation of modern software, and customers increasingly need to show, not just claim, that they manage it responsibly. Joining the OpenChain Partner Program lets us support organizations working toward those standards with SBOM and vulnerability management tooling they can use every day.”

Alex Rybak, Sr. Director, Product Management at Anchore.

What it means for federal teams

Federal teams carry a heavier version of the same question. SBOMs and adherence to recognized standards increasingly shape how software gets assessed and procured, and program managers have to answer for both.

The OpenChain standards give those teams a common benchmark that sits alongside the tooling we already provide. Anchore is also referenced in two U.S. Department of War (DoW) guides: the Container Image Creation and Deployment Guide and the Container Hardening Process Guide.

Where to start

If you’re building or tightening an OpenChain-aligned program, the first step is an inventory. Generate an SBOM for one of your images with Syft:

syft <your-image> -o spdx-json > sbom.spdx.json

Then run Grype against it to see what you’re carrying:

grype sbom:./sbom.spdx.json

Want to manage that across every pipeline and environment you run? Take a look at Anchore Enterprise.