SW360 Component Management … why fossology actually, will give a coupleof simple resons

! ? Problem Domain Software Product Software Product Component License Liveliness Quality Expertise Component License Liveliness Quality Expertise Component Component Component License License ? ! Liveliness Liveliness Quality Quality Expertise Expertise License Liveliness Quality Expertise Component License Liveliness Quality Expertise Component Component Component License License Liveliness Liveliness Quality Quality Expertise Expertise

Developers and Experts Use Cases and Roles Architects Ensure Compliance Maintain Assets Share Knowledge Quality Managers Legal Counsels R&D Managers Sec Officer Developers and Experts Project Managers

Central Hub Vulnerability Management Project BOM Management License Scanner SW360 Vulnerability Management Code Quality Checker Artefact Repository Source Code Scanner

Eclipse SW360 SW360 is … Tech Specs Storage: CouchDB Search: Lucene An Eclipse foundation incubator project Eclipse Public License 1.0 – EPL-1.0 A portal application A catalogue of components, releases A catalogue of your projects / products A store for attachments of these A end user front end to FOSSology Storage: CouchDB Search: Lucene Services: Thrift Container: Tomcat Prerequisite: Liferay UI: Alloy github.com/sw360 Hammering the most important points in

Foundation Component Project Release Vendor Licenses

The Data Model is Important Goals and Motivation Reduction of duplicate entries. Separating vendor from components names and release tags brings clarity to component naming. Interoperation with other systems. As such we need to support the CPE standard which also implement this 3-parts separation. Having the clear modeling of data enables better search and filtering abilities.

How it Works 1 Create a Component Entry Add Release Entry Add Package (Upload) to Release A component is a container for releases Just creating a component alone creates an empty shell Release = Version A component can have multiple releases It make sense to group them Now a vendor can be assigned Multiple open source packages of the same releases: multiple releases actually There should be just one upload per release

How it Works Create a Project Entry Add Releases, Subprojects Review and Manage BOM Items A project is a structure to main a BOM Can represent product, service, delivery Release = Version of component Projects can contain other projects Allows for building blocks Send to analysis Upload analysis results Generate product level documentation

Vulnerability Database SW360 Core Features Source Code Bundle Protex™ Projects with used 3rd party components BOM Service Clearing Workflow and Tool Integration Clearing Service Disclosure Document generate Developer FOSSology BOM Represent. inform BAT Quality Project Manager License Texts with Obligations Management License Service Catalogue of 3rd Party Components Component Service Obligations Contacts notify Clearing Info Configuration Management License issues Vulnerabilities OS Officer Vulnerability Database trigger retrieve map import Sec Officer Open Hub® External Tool Integration Operated on Local Infrastructure with Access Control and Identity Management …

It is Open Source Big Picture www.github.com/sw360/sw360portal Open source = good distrubuted systems development, but the softare can be also used by anybody

Thank you for your attention! Michael C. Jaeger Siemens AG Corporate Technology D-80200 Munich, Germany michael.c.jaeger@siemens.com Johannes Kristan Bosch Software Innovations GmbH D-10785 Berlin, Germany johannes.kristan@bosch-si.com Project site: https://github.com/sw360/sw360portal Eclipse project information: https://projects.eclipse.org/projects/technology.sw360