1. SW360 Component Management
… why fossology actually, will give a coupleof simple resons

2. ! ? Problem Domain Software Product Software Product Component
License
Liveliness
Quality
Expertise
Component
License
Liveliness
Quality
Expertise
Component
Component
Component
License
License ? !
Liveliness
Liveliness
Quality
Quality
Expertise
Expertise
License
Liveliness
Quality
Expertise
Component
License
Liveliness
Quality
Expertise
Component
Component
Component
License
License
Liveliness
Liveliness
Quality
Quality
Expertise
Expertise

3. Developers and Experts
Use Cases and Roles
Architects
Ensure Compliance
Maintain Assets
Share Knowledge
Quality
Managers
Legal
Counsels
R&D
Managers
Sec Officer
Developers and Experts
Project
Managers

4. Central Hub Vulnerability Management Project BOM Management
License Scanner
SW360
Vulnerability
Management
Code Quality Checker
Artefact Repository
Source Code Scanner

5. Eclipse SW360 SW360 is … Tech Specs Storage: CouchDB Search: Lucene
An Eclipse foundation incubator project
Eclipse Public License 1.0 – EPL-1.0
A portal application
A catalogue of components, releases
A catalogue of your projects / products
A store for attachments of these
A end user front end to FOSSology
Storage: CouchDB
Search: Lucene
Services: Thrift
Container: Tomcat
Prerequisite: Liferay
UI: Alloy
github.com/sw360
Hammering the most important points in

6. Foundation
Component
Project
Release
Vendor
Licenses

7. The Data Model is Important
Goals and Motivation
Reduction of duplicate entries.
Separating vendor from components names and release tags brings clarity to component naming.
Interoperation with other systems.
As such we need to support the CPE standard which also implement this 3-parts separation.
Having the clear modeling of data enables better search and filtering abilities.

8. How it Works 1 Create a Component Entry
Add
Release Entry
Add
Package (Upload) to Release
A component is a container for releases
Just creating a component alone creates an empty shell
Release = Version
A component can have multiple releases
It make sense to group them
Now a vendor can be assigned
Multiple open source packages of the same releases: multiple releases actually
There should be just one upload per release

9. How it Works Create a Project Entry
Add
Releases,
Subprojects
Review and Manage BOM Items
A project is a structure to main a BOM
Can represent product, service, delivery
Release = Version of component
Projects can contain other projects
Allows for building blocks
Send to analysis
Upload analysis results
Generate product level documentation

10. Vulnerability Database
SW360 Core Features
Source Code
Bundle
Protex™
Projects with used 3rd party components
BOM Service
Clearing Workflow and Tool Integration
Clearing Service
Disclosure Document
generate
Developer
FOSSology
BOM Represent.
inform
BAT
Quality
Project
Manager
License Texts with Obligations Management
License Service
Catalogue of 3rd Party Components
Component Service
Obligations
Contacts
notify
Clearing Info
Configuration
Management
License issues
Vulnerabilities
OS Officer
Vulnerability Database
trigger
retrieve
map
import
Sec Officer
Open Hub®
External Tool Integration
Operated on Local Infrastructure with Access Control and Identity Management …

11. It is Open Source Big Picture www.github.com/sw360/sw360portal
Open source = good distrubuted systems development, but the softare can be also used by anybody

12. Thank you for your attention!
Michael C. Jaeger
Siemens AG Corporate Technology
D Munich, Germany
Johannes Kristan
Bosch Software Innovations GmbH
D Berlin, Germany
Project site:
Eclipse project information: