OpenChain ISO/IEC 5230:2020 Self-Assessment¶
| Field | Value |
|---|---|
| Organization | Open Byte Inc. |
| Program | QuantDinger public supplied-software license compliance program |
| Scope | Defined in README.md |
| Checklist basis | OpenChain ISO/IEC 5230 Self-Certification Checklist, Generation 2, Version 1, 2025-08-18 |
| Assessment date | 2026-10-25 |
| Assessment status | Self-certified conformant; OpenChain online self-certification completed |
| Review interval | At least every 18 months |
OpenChain conformance is a statement about the scoped organizational program, not a guarantee or independent certification of the software. Open Byte Inc. is solely responsible for this self-assessment.
Evidence matrix¶
| ID | Official checklist requirement (concise) | Status | Evidence |
|---|---|---|---|
| 1.1 | Supplied-software license compliance policy | Yes | OPEN_SOURCE_PROGRAM.md, section 1 |
| 1.2 | Procedure to communicate the policy | Yes | Program sections 4-5; README and contribution-guide links |
| 1.3 | Program roles and responsibilities | Yes | Program section 3; GOVERNANCE.md |
| 1.4 | Competencies required for each role | Yes | Program section 3 |
| 1.5 | Assessed competence for each participant | Yes | PROGRAM_REVIEW_RECORD.md |
| 1.6 | Participant awareness of policy and location | Yes | Program sections 4-5; adoption and access records |
| 1.7 | Participant awareness of objectives | Yes | Program sections 1 and 4 |
| 1.8 | Participant awareness of expected contributions | Yes | Program section 4; release checklist |
| 1.9 | Participant awareness of failure implications | Yes | Program section 4 |
| 1.10 | Process for determining scope | Yes | Program section 2 |
| 1.11 | Written scope and limits | Yes | Compliance index and program section 2 |
| 1.12 | Review and document obligations, restrictions, and rights | Yes | LICENSE_COMPLIANCE_PROCEDURE.md, section 2 |
| 2.1 | Public third-party license inquiry route | Yes | Compliance index and license procedure section 5 |
| 2.2 | Procedure for responding to inquiries | Yes | License procedure section 5 |
| 2.3 | People or functions supporting program roles | Yes | Program section 3; MAINTAINERS.md |
| 2.4 | Adequate staffing and funding | Yes | Program section 6 |
| 2.5 | Identified legal expertise | Yes | Program section 3; license procedure sections 2 and 5 |
| 2.6 | Assigned internal compliance responsibilities | Yes | Program section 3; license procedure |
| 2.7 | Review and remediation of non-compliance | Yes | License procedure section 5 |
| 3.1 | Identify, track, review, approve, and archive components | Yes | License procedure section 1 |
| 3.2 | Actual component records | Yes | Requirements/lock files, pyproject.toml, Dockerfiles, Git history, and release SBOM/provenance |
| 3.3 | Binary distribution procedure | Yes | License procedure section 3 |
| 3.4 | Source distribution procedure | Yes | License procedure section 3 |
| 3.5 | Integrations that may trigger additional obligations | Yes | License procedure sections 2-3 |
| 3.6 | Modified open source | Yes | License procedure section 3 |
| 3.7 | Incompatible licenses and component interaction | Yes | License procedure section 2 |
| 3.8 | Attribution requirements | Yes | License procedure sections 2-4; REUSE metadata |
| 4.1 | Prepare and distribute compliance artifacts | Yes | License procedure section 4; release checklist |
| 4.2 | Archive artifacts for the required duration | Yes | Program section 8; license procedure section 4 |
| 5.1 | Open source contribution policy | Yes | License procedure section 6; CONTRIBUTING.md |
| 5.2 | Contribution procedure | Yes | License procedure section 6; DCO workflow |
| 5.3 | Communicate contribution policy | Yes | Contribution guide and required DCO check |
| 6.1 | Documentation confirms all requirements are met | Yes | This matrix and linked evidence set |
| 6.2 | Conformance reviewed at least every 18 months | Yes | Program section 8; program review record |
Result¶
All checklist requirements are mapped to documented controls and evidence. Project Lead approval and merge adopted the program and recorded the initial participant acknowledgement. Open Byte Inc. subsequently completed the OpenChain online self-certification. This remains an organizational self-certification rather than an independent third-party certification.
Source and attribution¶
This evidence matrix follows the official OpenChain ISO/IEC 5230 self-certification checklist. The OpenChain checklist is made available by the OpenChain Project under CC BY 4.0. Requirement text above is intentionally concise; the official checklist controls if wording differs.