You can now manage the source code for software-related product development in your organisation, using the Black Duck Suite, which among other capabilities, generates an alert each time a developer infringes a licensing requirement — across the product development lifecycle.
“It is odd how learned persons fail to see that new terms and definitions are apt to mean new doubts and litigation.” — Frederick Pollock, British lawyer and Tory politician
Consider this: when creating Windows 7, Microsoft outsourced the development of one of the new OS utilities to a third-party. Without Microsoft’s knowledge, the third-party integrated an open source component licensed under the GNU general public license (GPL) into the utility. The component was discovered after Windows 7 was shipped, forcing Microsoft to pull back the utility to remedy the code. This entailed costly reworking and also hurt its public image.
The moral of this story is that even large, very-well-run software organisations can make such mistakes. Without proper controls and an effective management platform, it is difficult, or impossible, to know what’s in your code.
Globally distributed teams of developers increasingly collaborate to assemble software from reusable components that come with their own proprietary code (rather than building applications entirely from scratch). So companies are becoming more and more concerned about maintaining control of their IP, properly tracking the origins and managing the obligations associated with the components that they reuse.
Doing this has become essential to ensure license compliance, in the absence of which developers, vendors and organisations may face legal risks, negative publicity, costly code reviews, redesigns and rework. Manual methods of tracking software origins and obligations cannot keep up with the pace of rapid application/product development.
Still, as with practically everything else, technology offers a solution to even this challenge. Now, using the suite of tools from Black Duck Software Inc, you can gain control over the use of open source software and components in your company, and consume open source without the fear of license violations, affirms Rohit Sharma, vice president, Lyra Infosystems (P) Limited, the official representative partner of Black Duck Software, Inc in the Indian sub-continent.
Automation is the key
Since manual methods of finding, selecting, monitoring, and validating open source components are extremely limiting and error-prone, and an unmanageable drain on internal development resources, the key to gaining management control and successfully incorporating open source components into your development process is automation, opines Sharma. The Black Duck Suite can help automate the process of finding, managing, and confidently deploying open source software.
Describing a common scenario that demonstrates the necessity of tools like those from Black Duck, Sharma says: “Most companies that develop software for both products and services alike, tend to sign-off on software deliveries for their end customers, confirming that they’ve internally created intellectual property. However, from a practical standpoint, it’s highly time consuming and unscalable to run through the entire source of any project/product, and differentiate between source-code developed internally, and code that’s incorporated from open source repositories.
“The solution to dealing with this environment of composite, mixed intellectual property (IP), lies in automating this process. Black Duck can help in addressing both these requirements.”
A good tool for hassle-‘free’ product development
The typical open source software management life-cycle involves the following stages. Let’s see how Black Duck software can help to control the use of open source through each stage.
Search
Black Duck software provides a customisable workflow to automate the process of searching for externally-sourced code, whether it is commercial code, outsourced code or open source code. The tool also lets users build a catalogue of approved components for developers to search. It also has a regularly updated searchable “Knowledgebase” that continuously tracks over 2,000 unique licenses, almost 5,000 sites, and security vulnerabilities.
“The internal catalogue your development team creates with Black Duck software, combined with the Black Duck Knowledgebase, lets you reduce the time developers spend searching for code; they support standardisation, and also help you ensure that developers are using code that meets your company’s policies and guidelines,” he adds.
Selection
Black Duck Suite also allows users to codify their compliance policies into its management platform; it then automatically scans source-code and binary files to uncover unknown, unapproved, non-compliant software. Thus, it ensures that only approved code is selected.
In addition, when developers access their own catalogues, or the Black Duck Knowledgebase, they have an easily searchable central repository, with all the metadata in one place, reducing the time it takes to make code selections, Sharma explains.
Approval
Black Duck Protex automates the entire software code approval process by providing a customisable approval workflow system. All reviewers involved in the development process for a particular software can know where the code is in the approval process, and who is next in the review chain — and from whom approval is still pending. Black Duck Protex ensures that information from all the approvers is recorded from the start, to minimise iterations, and streamlines the approval process.
Validation
Black Duck Protex can be integrated with the build process to provide real-time and continuous validation — i.e., to analyse the code as developers are building the application. It analyses the code against the approved software bill of materials, to ensure compliance, and also provides an audit trail.
If non-approved, non-compliant code is introduced into an application, the Black Duck Suite notifies the developer right away, or it can trigger the approval process automatically. Black Duck software also integrates with common build systems to conduct ongoing code audits, automatically, throughout the software build process. Validation occurs without any manual intervention, explains Sharma.
Monitoring
When development groups integrate external code into their applications and services, problems can arise at the post-deployment stage. These could include the discovery of new security vulnerabilities, new versions, etc. Black Duck monitors open source code against all known security vulnerabilities, and provides real-time alerts when new vulnerabilities are discovered.
Considering the visibility that it renders, the Black Duck Suite seems like a good tool that enables organisations to take charge of open source software usage during development. It also offers developers the freedom they need to focus only on their solution and not on licensing issues, reduces the time-to-solution, lowers costs, and drives innovation.
| A quick check-list to determine if you need Black Duck software |
You would need a set of tools like the Black Duck Software Suite if any of the following statements describe your (or your organisation’s) experience with software development:
|
Feature image courtesy: Keith Ramsey. Modified and reused under the terms of CC-BY-SA 2.0 License.
I think its cool…
Good one !
Nice work Vandana
In virtually all industries software now plays a critical role in an organization’s success. Whether you develop software for sale as a product or for internal use within your organization, the ability to rapidly deliver high-quality, secure software is critical to success.
Many development teams have found that they can accelerate their development process by including components of open source and third party code as part of their overall solution. The use of open source and third party code creates licensing and security issues of its own. Unmanaged use of externally sourced code can compromise intellectual property rights, create unknown royalty obligations, and introduce hidden security risks.
Depending on your need, your role or your industry, the way you view code component management is different.
This is the main theme in Black Duck