Use The Source

Timelines for CCIRT email submission and notifications

We at SFC are providing an opportunity for companies who want to be notified of source candidates of theirs that we plan to post to Use The Source to provide us with the email address of their Copyleft Compliance Incident Response Team (CCIRT), which we will email when we receive a new source candidate for the company that we plan to post. If we have a CCIRT email address on a file for a given company, we will email this address if we receive a source candidate from that company, and then wait at least 7 days for a reply - if an updated candidate is received, we will post that, otherwise we will post the candidate that we notified the CCIRT team about as-is.

As discussed in our blog post (which also outlines our initial 37-day grace period), the CCIRT is an important part of an organization; it may be incorporated into the OSPO or cybersecurity team. SFC hopes that companies will treat any reports from SFC with urgency, since failure to provide complete source code severely impedes device owners' and third party repair companies' ability to fix the devices.

Based on our decades of GPL compliance experience, we expect that many of the source code candidates we receive from the public will be incomplete. SFC cannot immediately validate nor invalidate any of those claims due to the vast number of devices on the market. But we are willing to engage with companies' CCIRTs so they have a chance to (re-)review these candidates if they wish, before SFC publishes them.

Companies can send us the email address of their CCIRT (to with Subject "CCIRT contact") and, after we receive this email address, we will give them 7 calendar days from the first notification of an incomplete source candidate to resolve the issue. The process is as follows:

ongoing CCIRT process, showing standard 7-day window

SFC looks forward to working with all the CCIRTs who register with us.

Header image adapted from Stars 01 by Mathias Krumbholz (CC BY-SA 3.0 Deed). Icons adapted from Magnifying Glass by Rohith M S, Magnifying Glass by icondesign178 and Upload by sureya from Noun Project (CC BY 3.0)

Connect with Conservancy on Fediverse, X, Facebook, and YouTube.

Main Page | Contact | Sponsors | Privacy Policy | RSS Feed

Our privacy policy was last updated 22 December 2020.