Morgan Stanley

Discussed highlights and takeaways from OSSF. Members expressed interest in seeing session materials.

Discussed readiness priorities for attendees' firms. Participants raised the desire for a model proxy/firewall whitelisting rules for Github. Decision to take conversation to mailing list to find best participants from firms for "sub-group." How to capture & retain external code internally. One firm requires open source contributors to include scripts with their proposed contribution that handle that and are reviewed before approval; if the scripts are not present, the contribution process fails.

Jamie said GitHub is working with Morgan Stanley to collect their requirements for proxy authentication to Github via the command line.

Aaron updated the group on the Foundation project to produce a database of license compliance information for common licenses. A first draft is expected in January and can likely be circulated to the group in February. This information is primarily aimed at the individuals who will implement compliance for products containing OSS. It will not include recommendations of which license to approve, but can be used as a starting point for members to perform that review internally.

Aaron asked what topics participants would like the Foundation to focus on in upcoming meetings. The responses were:

• Open Source Readiness survey & scorecard

• In-depth presentation on open source license types and consideration

• Compliance tooling

• Github CLI proxy authentication

• The contribution process presented by Goldman Sachs at the Open Source Strategy Format