WeAreDevelopers Logo WeAreDevelopers
Sign in
For You LIVE
World Congress 2026 Europe • Jul 9, 2026 • Session details

My Lawyer Merged My PR: Automating OSS Compliance at Scale

Uwe Korn

What if open-source compliance was just another automated CI/CD check? Learn how to eliminate administrative friction by bringing legal counsel directly into GitHub to merge your pull requests.

Pause
Mute Enter Fullscreen
#1 about 3 min

Why automated compliance matters for developers

Automating open source compliance removes friction and fulfills strict certification requirements for software engineering teams.

#2 about 3 min

Understanding the legal limitations of open source dependencies

Open source licenses govern software distribution rights and impose disclosure duties that can directly conflict with proprietary business constraints.

#3 about 2 min

Navigating license compatibility and software distribution rights

Mixing different software dependencies requires ensuring layered licenses remain legally mutually compatible to avoid conflicting restrictions.

#4 about 2 min

Categories of open source and proprietary vendor licenses

Software licenses generally fall into public domain, permissive, copyleft, and proprietary categories with highly varying operational requirements.

#5 about 2 min

Anatomy of the BSD three-clause permissive license

The short BSD license demonstrates how foundational permissive terms dictate safe redistribution, manual copyright retention, and explicit liability disclaimers.

#6 about 3 min

Encoding complex requirements using the SPDX identifier standard

The SPDX standard provides an industry machine-readable syntax for documenting complex, dual-licensed, and proprietary dependency metadata logic.

#7 about 2 min

Failing continuous integration builds on non-compliant package licenses

Treating unapproved dependency metadata as standard continuous integration test failures immediately blocks risky check-ins and forces early engineering engagement.

#8 about 3 min

Verifying dependency metadata accuracy through controlled package installations

Relying securely on explicit lock files out-performs general container scanning for extracting verifiably accurate package license identifiers.

#9 about 2 min

Maintaining a centralized license allow list across repositories

A globally enforced license schema efficiently prevents duplicate engineering triaging and seamlessly scales unified legal standards to hundreds of repositories.

#10 about 4 min

Rolling out automated license enforcement and fixing upstream metadata

Deploying the centralized checks effectively required directly contributing repaired license metadata back to massive upstream distribution hubs like Conda-Forge.

#11 about 2 min

Handling exceptions by integrating pull requests into compliance workflows

Developers request obscure and new license approvals by systematically opening localized pull requests against the central repository limit list.

#12 about 3 min

Onboarding corporate legal counsel into developer pull request workflows

Integrating lawyers directly into typical source control interfaces generates valuable transparent audit trails and radically reduces organizational communication toil.

#13 about 4 min

Assisting manual license research with artificial intelligence tools

Language models rapidly summarize dense repository parameters and identify internal metadata nuances while human teams manage all final verification obligations.

#14 about 1 min

Removing developer toil through silent compliance enforcement

Providing intentionally quiet execution pipelines ensures working developers only deal with manual compliance administration when explicit human resolution becomes completely necessary.

#15 about 4 min

Addressing transitive dependency licensing and multiple license configurations

Complex organizational cases include untagged, borrowed functional code snippets residing inside transitive dependencies or programs structured using complex multi-license constraints.

Matching moments

2:40 min

Why proactive license checking matters for developers

Antoine Thomas Antoine Thomas · Europe 2026 Virtual

1:17 min

Bridging the gap between software development and license compliance

Kevin Kevin +1 · World Congress 2025

2:46 min

Implementing automated tools to mitigate licensing risks

Kevin Kevin +1 · World Congress 2025

3:13 min

Understanding software distribution and compliance risks

Antoine Thomas Antoine Thomas · Europe 2026 Virtual

2:16 min

Implementing compliance by design for software reliability

Kevin Kevin +1 · World Congress 2025

4:55 min

Automating compliance checks into delivery pipelines

Antoine Thomas Antoine Thomas · Europe 2026 Virtual

More from World Congress 2026 Europe

Building the Nervous System of AI - Michael Kagan (NVIDIA) thumbnail
29:17
about 2 months ago

Building the Nervous System of AI - Michael Kagan (NVIDIA)

Michael Kagan, Sead Ahmetović

Five Things in Tech that Matter Now - WeAreDevelopers World Congress 2026 Closing Keynote thumbnail
19:41
about 2 months ago

Five Things in Tech that Matter Now - WeAreDevelopers World Congress 2026 Closing Keynote

Christian Heilmann

The Sound of Your Secrets: Teaching Your Model to Spy, So You Can Learn to Defend thumbnail
32:06
about 2 months ago

The Sound of Your Secrets: Teaching Your Model to Spy, So You Can Learn to Defend

David vonThenen

Super scaling for the Super Bowl: How to survive 30 million users hitting your backend in 30 minutes thumbnail
35:13
about 2 months ago

Super scaling for the Super Bowl: How to survive 30 million users hitting your backend in 30 minutes

Irina Branovic

Running Secure Life Science Research at Scale using Hybrid GPU HPC and Kubernetes 🧬 thumbnail
24:23
about 2 months ago

Running Secure Life Science Research at Scale using Hybrid GPU HPC and Kubernetes 🧬

Jeremy Murray

Angstfreude - AI and Corporate Culture - The Thrill and the Threat thumbnail
30:26
about 2 months ago

Angstfreude - AI and Corporate Culture - The Thrill and the Threat

Axel Ebert, Karin Krobath

Upcoming sessions on this topic

Open session

World Congress 2026 North America

September 23, 2026 · 16:20–16:50

Stage 2

Lawyers who ship: How GitHub CELA used AI to rewire legal work

Bria Ford

Program Manager, Digital Transformation at GitHub

Bria Ford
Open session

World Congress 2026 North America

September 25, 2026 · 13:30–14:00

Stage 9

On the Public Clock: Open-Source Defense When You're Not in the Club

Nicholas Muy

VP Engineering Platform and Security at Scrut.io

Nicholas Muy
Open session

World Congress 2026 North America

September 25, 2026 · 13:30–14:00

Stage 6

The Autonomous Pull Request: Let Agents Ship Without Surrendering Control

Sam Jarvinen

Senior Solutions Engineer, GitHub

Sam Jarvinen
Open session

World Congress 2026 North America

September 24, 2026 · 10:20–10:50

Stage 6

Practices, Not Prompts: Scale GitHub Copilot with AI-Ready Repositories

Luis Pujols

Staff Customer Success Architect, GitHub

Luis Pujols
Open session

World Congress 2026 North America

September 24, 2026 · 12:15–12:45

Stage 6

AI vs. AI: Defending the open source supply chain with agentic workflows

Manfred Moser

Senior Principal DevRel Engineer at Chainguard

Manfred Moser
Open session

World Congress 2026 North America

September 25, 2026 · 11:40–12:10

Outdoor Stage

GitHub’s Team X-Ray: Your Repository Knows More About Your Team Than Your Team Does

Andrea Griffiths

Senior Developer Advocate

Andrea Griffiths

Related videos

Compliance & Risk: Shipping Open Source, AI, and Containers thumbnail
38:29
Europe 2026 Virtual • 2 months ago

Compliance & Risk: Shipping Open Source, AI, and Containers

Antoine Thomas

Kettle and Pot or Peas in a Pod? A Debate on Open-Source and Proprietary Software thumbnail
24:51
World Congress 2025 • about 1 year ago

Kettle and Pot or Peas in a Pod? A Debate on Open-Source and Proprietary Software

Kevin, Roxana Crisan

One Pipeline, Three Regulator - SBOM Compliance for the Developer thumbnail
28:29
World Congress 2026 Europe • about 2 months ago

One Pipeline, Three Regulator - SBOM Compliance for the Developer

Marcus Ross

The Future of Open Source thumbnail
27:21
World Congress 2024 • about 2 years ago

The Future of Open Source

Scott Chacon

Real-World Security for Busy Developers thumbnail
29:50
World Congress 2025 • about 1 year ago

Real-World Security for Busy Developers

Kevin Lewis

Keeping Your AI Software Supply Chains Sovereign in the Age of Commercial Open Source thumbnail
34:38
World Congress 2026 Europe • about 2 months ago

Keeping Your AI Software Supply Chains Sovereign in the Age of Commercial Open Source

Franz Kiraly

Related articles

From learning to earning

Jobs that call for the skills explored in this talk.