Our Own "Jungle" of the Commercial Software Supply Chain

### Overview In this talk, Justin Ratcliff, lead of the Open Source Program Office (OSPO) at Fidelity Investments, explores the risks and governance challenges inherent in the commercial software supply chain. Using Upton Sinclair's *The Jungle* as a guiding metaphor, Ratcliff compares the current software landscape—where proprietary products and cloud services heavily integrate open-source software—to the uninspected food industry before regulatory standards. By demonstrating how a single dependency like React Native can pull in nearly 600 transitive packages across over 1,000 links, he argues that organizations can no longer blindly trust software without verifying its underlying ingredients.

### Key Topics - **Software Supply Chain Complexity:** Modern applications depend on massive webs of direct and transitive dependencies, making manual policing impossible and obscuring the software's true contents. - **Commercial and Upstream Trust:** Proprietary vendors and SaaS endpoints rely extensively on open-source code; trusting a commercial brand without asking about their software bill of materials (SBOM) creates blind spots. - **Software Bill of Materials (SBOM):** Adopting machine-readable SBOM formats (such as SPDX and CycloneDX) generated by automated tools to evaluate both declared and observed licenses and track vulnerabilities. - **Evaluating Component Health ("Quality Ingredients"):** Assessing open-source project vitality and community health through metrics like pull requests, issue resolution times, and maintenance activity. - **Organizational Governance and Preferences:** Creating structured metadata and internal guidance to help developers select supported technologies without stifling innovation or causing shadow IT. - **Investing Upstream:** Contributing financial sponsorship, code fixes, and documentation back to open-source projects to strengthen the shared ecosystem and protect internal systems.

### Technical Details - **SBOM Formats & Tools:** Ratcliff highlights standardized, machine-readable specifications including the Linux Foundation's SPDX and the lightweight CycloneDX. He references open-source analysis tools such as FOSSology, nexB ScanCode, OWASP Dependency-Check, and OWASP Dependency-Track, alongside built-in dependency graphing features in platforms like GitHub and GitLab. - **License Discrepancies:** Software composition analysis must reconcile differences between declared licenses (e.g., an Apache license statement) and observed transitive dependencies (e.g., embedded GPL code), which can introduce compliance issues. - **Community Health Metrics:** Tools and frameworks from the CHAOSS project (such as Augur) help organizations quantitatively measure repository vibrancy and project health rather than relying on subjective reputation. - **Industry Standards:** Ratcliff points to the OpenChain Project (a Linux Foundation initiative establishing an ISO standard) as a key framework for legal compliance and governance consistency.

### Takeaways - **Incorporate Supply Chain in Procurement:** Organizations must ask commercial suppliers and vendors for SBOMs and open-source governance disclosures, signaling market demand for transparency. - **Educate and Empower Developers:** Integrate basic open-source licensing and lifecycle education into developer workflows, balancing standard frameworks with flexibility to avoid shadow IT. - **Automate Dependency Tracking:** Employ automated composition analysis tools across pipelines to handle deep dependency trees, monitor for CVEs, and prevent technical debt from unmaintained code. - **Contribute Upstream:** Investing budget (via events, GitHub Sponsors, or Tidelift) and engineering time (submitting pull requests, filing bug fixes, writing documentation) cascades benefits across vendors, open-source communities, and enterprise security.