Today, most software development teams use free and open source software (FOSS) components, because it increases the speed and the quality of the development. Many open source components are the de facto standard of their category. However, FOSS has licensing restrictions, and corporate organizations usually maintain a list of allowed and forbidden licenses. But how do you enforce this policy? How can you make sure that ALL files in your source depot, either belong to you, or fit your licensing policy?

1. Guillaume ROUSSEAU, CEO
EOLE 2011
Barcelona, Spain
Managing FOSS during development
Preventive and curative approaches.
© Copyright 2010-2011 Antelink SAS
1

2. Table of Content
About Antelink
Open Source goes main stream
Third part related quality issues
Preventive vs curative approaches
Antepedia,
toward the census of open source code history
© Copyright 2010-2011 Antelink SAS
2

3. About Antelink
A venture backed european software vendor
specializing
– in software lifecycle management
– the detection of open source
Components
Antelink helps you keep control of your
software integration and supply chain in a
globalized world.
© Copyright 2010-2011 Antelink SAS
3

4. About Antelink
+3.000 projects / +10.000 users
Software Quality Assurance
and Trustworthiness (SQUAT)
Open Compliance Program
Software Package Data Exchange
© Copyright 2010-2011 Antelink SAS
4

5. Table of Content
About Antelink
Open Source goes main stream
Third part related quality issues
Preventive vs curative approaches
Antepedia,
toward the census of open source code history
© Copyright 2010-2011 Antelink SAS
5

6. Open Source has gone mainstream
}
© Copyright 2010-2011 Antelink SAS
6

7. Open Source has gone mainstream
By 2013, 90% will include OSS
as part of their IT strategy
Melinda-Carol Ballou
Program Director Application Life-
Cycle Management & Executive
Strategies.
" This continues the existing trend for
combining internal IT resources with
contractors, both onshore and offshore
providers, and use of Open Source."
© Copyright 2010-2011 Antelink SAS
7

8. Leading to a dramatic increase
in complex sourcing
compile
test
analysis
integration test
Product package Product
Developers Final product
Final product
Software Factory
compile
test
analysis
integration test
package Product
Final product
Authors
Software Factory
compile
test
analysis
integration test
package
Developers
Software Factory Product
Bill of Material
Developers Final product
© Copyright 2010-2011 Antelink SAS
8

9. Table of Content
About Antelink
Open Source goes main stream
Third part related quality issues
Preventive vs curative approaches
Antepedia,
toward the census of open source code history
© Copyright 2010-2011 Antelink SAS
9

10. Know what is in your code ...
Your Code
Internally Third party Outsourced Third party
developed Open Source Development Commercial
? ?
? ?
Origin
© Copyright 2010-2011 Antelink SAS
10

11. … keeping control of your software
integration and supply chain
Developers Build Engineer Lawyer Customer
Build Engineer
compile
test
analysis
integration test
package
Product
Final product
Software Factory Bill of Material Final product Production
(deployment)
© Copyright 2010-2011 Antelink SAS
11

12. Address licensing issues
analyzing the legal situation
Legal =
Situation
Authors
Bill of Material
Increase
Legal Quality
Perceived Automated
Legal Legal Situation Save time
VS
Situation Mining
Ease
communication
© Copyright 2010-2011 Antelink SAS
12

13. A reference from
© Copyright 2010-2011 Antelink SAS
13

14. Identify security vulnerability
Manage version updates
© Copyright 2010-2011 Antelink SAS
14

15. Table of Content
About Antelink
Open Source goes main stream
Third part related quality issues
Preventive vs curative approaches
Antepedia,
toward the census of open source code history
© Copyright 2010-2011 Antelink SAS
15

16. Avoid late charges and budget-overrun
Reduce operation loss
© Copyright 2010-2011 Antelink SAS
16

17. How to enforce your open source policy
Preventive vs curative approaches
Preventive Curative
As often as possible At the end of
Integrated in the continuous the release process
integration process When a major event occurs
© Copyright 2010-2011 Antelink SAS
17

18. Preventive vs curative approaches
Pros …
Preventive Curative
Avoid late charges and budget over-run You pay when it is REALLY worth it
Reduce operation loss Few people are involved (audit team)
Cover short/mid/long term risks
Integrated to the quality process
© Copyright 2010-2011 Antelink SAS
18

19. Preventive vs curative approaches
… and cons
Preventive Curative
Need affordable tools More expensive (tools + remediation)
Need tools with very few false-positive Done in emergency (lot of stress)
Need different tools for different users Will cover only short term risks
May be too late ...
© Copyright 2010-2011 Antelink SAS
19

20. Don't wait one there is ?
Want to tryuntil of them a fire at home
Be pro-active, empower as soon as possible
everyone involved in the software lifecycle to
mitigate risks that can doom your software
assets.
© Copyright 2010-2011 Antelink SAS
20

21. Table of Content
About Antelink
Open Source goes main stream
Third part related quality issues
Preventive vs curative approaches
Antepedia,
toward the census of open source code history
© Copyright 2010-2011 Antelink SAS
21

22. Antepedia : The world's largest
Knowledge Base of open source projects
More than 1,000,000 open source
reusable components … and counting
+1,000 projects each day
© Copyright 2010-2011 Antelink SAS
22

23. Antepedia : The world's largest
Knowledge Base of open source projects
© Copyright 2010-2011 Antelink SAS
23

24. Antepedia Search
http://www.antepedia.com
Single
file Cloud service
Original project
License information
Release date and location
© Copyright 2010-2011 Antelink SAS
24

25. Life of open source project
is also complex
© Copyright 2010-2011 Antelink SAS
25

26. © Copyright 2010-2011 Antelink SAS
26

27. Inconsistent
License
Information
http://sourceforge.net/projects/jwebmail/
http://jwebmail.sourceforge.net/about.html
http://jwebmail.sourceforge.net/news.html
© Copyright 2010-2011 Antelink SAS
27

28. Contact information
Visit our web site http://www.antelink.com
Try Antepedia http://www.antepedia.com
Contact us contact@antelink.com
Tel: +33 (0)1 42 39 30 78
18, Rue Yves Toudic
75010 Paris 10ème, France
© Copyright 2010-2011 Antelink SAS Smart Apps for Great Development Teams !28