Technical Team/Use Cases/2.0/Backtrack from binary to source files - Revision history

MartinMichlmayr: Convert to MediaWiki syntax

2013-03-07T13:23:23Z

Convert to MediaWiki syntax

Bschineller at 18:28, 2 October 2012

2012-10-02T18:28:40Z

Pezra at 21:37, 27 May 2012

2012-05-27T21:37:57Z

New page

<p>As an <a href="../stakeholders#auditor">auditor</a>
in order to be certain that the licensing and provenance information regarding a binary, or compiled, file is correct
i want a manifest of the files used to create it.</p>

<h3>Stakeholders and interests</h3>

<ul>
<li><strong>Auditor<strong>
<p>The person or organization performing an audit on the licensing and provenance information of a package.</p></li>

<li><strong>Project maintainer</strong>
<p>The person pr organization which maintains the open source software in question.</li>

<li><strong>Developer</strong>
<p>The person or organization using the software package provided by Project maintainer.</p></li>
</ul>

<h3>Main Scenario</h3>

<ol>
<li>Project maintainer builds binary files keeping track of which source files are included in the binary.</li>
<li>Project maintainer publishes package with SPDX that provides references to every source used to create each compiled file in the package.</li>
<li>Developer downloads binary/compiled package from Package maintainer.</li>
<li>Developer requests audit of code base before shipping.</li>
<li>Auditor wants to verify that provided licensing and provenance info for compiled files are actually what the provided SPDX file claims.</li>
<li>Auditor uses the built from file list for the compiled file to narrow the analysis to particular files and specific versions of those files.</li>
<li>Auditor performs deep analysis to ensure the that the licensing and provenance of the files are indeed as claimed</li>
<li>Auditor provides clean bill of health</li>
</ol>

<h3>Alternate Scenario A</h3>

<ol>
<li>Project maintainer builds binary files keeping track of which source files are included in the binary.</li>
<li>Project maintainer publishes package with SPDX that provides references to every source used to create each compiled file in the package.</li>
<li>Developer downloads binary/compiled package from Package maintainer.</li>
<li>Developer requests audit of code base before shipping.</li>
<li>Auditor wants to verify that provided licensing and provenance info for compiled files are actually what the provided SPDX file claims.</li>
<li>Auditor uses the built from package list for the compiled file to narrow the analysis to particular packages and specific versions of those packages.</li>
<li>Auditor performs deep analysis to ensure the that the licensing and provenance of the files are indeed as claimed</li>
<li>Auditor provides clean bill of health</li>
</ol>

← Older revision		Revision as of 13:23, 7 March 2013
Line 1:		Line 1:
−	~~<p>~~As an ~~<a href=".~~./stakeholders#auditor">auditor~~</a>~~ in order to be certain that the licensing and provenance information regarding a binary, or compiled, file is correct i want a manifest of the files used to create it.~~</p><h3>~~Stakeholders and interests~~</h3><ul><li><strong><strong>~~Auditor~~<strong></strong></strong></strong><p>~~The person or organization performing an audit on the licensing and provenance information of a package.~~</p></li><li><strong>~~Project maintainer~~</strong><p>~~The person pr organization which maintains the open source software in question.~~</p></li><li><strong>~~Developer~~</strong><p>~~The person or organization using the software package provided by Project maintainer.~~</p></li></ul><h3>~~Main Scenario~~</h3><ol><li>~~Project maintainer builds binary files keeping track of which source files are included in the binary.~~</li><li>~~Project maintainer publishes package with SPDX that provides references to every source used to create each compiled file in the package.~~</li><li>~~Developer downloads binary/compiled package from Package maintainer.~~</li><li>~~Developer requests audit of code base before shipping.~~</li><li>~~Auditor wants to verify that provided licensing and provenance info for compiled files are actually what the provided SPDX file claims.~~</li><li>~~Auditor uses the built from file list for the compiled file to narrow the analysis to particular files and specific versions of those files.~~</li><li>~~Auditor performs deep analysis to ensure the that the licensing and provenance of the files are indeed as claimed~~</li><li>~~Auditor provides clean bill of health~~</li></ol><h3>~~Alternate Scenario A~~</h3><ol><li>~~Project maintainer builds binary files keeping track of which source files are included in the binary.~~</li><li>~~Project maintainer publishes package with SPDX that provides references to every source used to create each compiled file in the package.~~</li><li>~~Developer downloads binary/compiled package from Package maintainer.~~</li><li>~~Developer requests audit of code base before shipping.~~</li><li>~~Auditor wants to verify that provided licensing and provenance info for compiled files are actually what the provided SPDX file claims.~~</li><li>~~Auditor uses the built from package list for the compiled file to narrow the analysis to particular packages and specific versions of those packages.~~</li><li>~~Auditor performs deep analysis to ensure the that the licensing and provenance of the files are indeed as claimed~~</li><li>~~Auditor provides clean bill of health~~</li></ol><p><strong>~~NOTES: on 2012-10-02 having difficulty understanding the distinction between Main Scenario and Alternate A. ~~ ~~versions of files vs. versions of Packages? (step 6)~~</strong></p>~~	+	As an [http://spdx.org/stakeholders#auditor auditor] in order to be certain that the licensing and provenance information regarding a binary, or compiled, file is correct i want a manifest of the files used to create it.
		+
		+	==Stakeholders and interests==
		+
		+	* '''Auditor:''' The person or organization performing an audit on the licensing and provenance information of a package.
		+	* '''Project maintainer:''' The person pr organization which maintains the open source software in question.
		+	* '''Developer:''' The person or organization using the software package provided by Project maintainer.
		+
		+	==Main Scenario==
		+
		+	# Project maintainer builds binary files keeping track of which source files are included in the binary.
		+	# Project maintainer publishes package with SPDX that provides references to every source used to create each compiled file in the package.
		+	# Developer downloads binary/compiled package from Package maintainer.
		+	# Developer requests audit of code base before shipping.
		+	# Auditor wants to verify that provided licensing and provenance info for compiled files are actually what the provided SPDX file claims.
		+	# Auditor uses the built from file list for the compiled file to narrow the analysis to particular files and specific versions of those files.
		+	# Auditor performs deep analysis to ensure the that the licensing and provenance of the files are indeed as claimed
		+	# Auditor provides clean bill of health
		+
		+	==Alternate Scenario A==
		+
		+	# Project maintainer builds binary files keeping track of which source files are included in the binary.
		+	# Project maintainer publishes package with SPDX that provides references to every source used to create each compiled file in the package.
		+	# Developer downloads binary/compiled package from Package maintainer.
		+	# Developer requests audit of code base before shipping.
		+	# Auditor wants to verify that provided licensing and provenance info for compiled files are actually what the provided SPDX file claims.
		+	# Auditor uses the built from package list for the compiled file to narrow the analysis to particular packages and specific versions of those packages.
		+	# Auditor performs deep analysis to ensure the that the licensing and provenance of the files are indeed as claimed
		+	# Auditor provides clean bill of health
		+
		+	'''NOTES: on 2012-10-02 having difficulty understanding the distinction between Main Scenario and Alternate A. versions of files vs. versions of Packages? (step 6)'''
		+
		+	[[Category:Technical]]

@@ Line 1: / Line 1: @@
-<p>As an <a href="../stakeholders#auditor">auditor</a>
+<p>As an <a href="../stakeholders#auditor">auditor</a> in order to be certain that the licensing and provenance information regarding a binary, or compiled, file is correct i want a manifest of the files used to create it.</p><h3>Stakeholders and interests</h3><ul><li><strong><strong>Auditor<strong></strong></strong></strong><p>The person or organization performing an audit on the licensing and provenance information of a package.</p></li><li><strong>Project maintainer</strong><p>The person pr organization which maintains the open source software in question.</p></li><li><strong>Developer</strong><p>The person or organization using the software package provided by Project maintainer.</p></li></ul><h3>Main Scenario</h3><ol><li>Project maintainer builds binary files keeping track of which source files are included in the binary.</li><li>Project maintainer publishes package with SPDX that provides references to every source used to create each compiled file in the package.</li><li>Developer downloads binary/compiled package from Package maintainer.</li><li>Developer requests audit of code base before shipping.</li><li>Auditor wants to verify that provided licensing and provenance info for compiled files are actually what the provided SPDX file claims.</li><li>Auditor uses the built from file list for the compiled file to narrow the analysis to particular files and specific versions of those files.</li><li>Auditor performs deep analysis to ensure the that the licensing and provenance of the files are indeed as claimed</li><li>Auditor provides clean bill of health</li></ol><h3>Alternate Scenario A</h3><ol><li>Project maintainer builds binary files keeping track of which source files are included in the binary.</li><li>Project maintainer publishes package with SPDX that provides references to every source used to create each compiled file in the package.</li><li>Developer downloads binary/compiled package from Package maintainer.</li><li>Developer requests audit of code base before shipping.</li><li>Auditor wants to verify that provided licensing and provenance info for compiled files are actually what the provided SPDX file claims.</li><li>Auditor uses the built from package list for the compiled file to narrow the analysis to particular packages and specific versions of those packages.</li><li>Auditor performs deep analysis to ensure the that the licensing and provenance of the files are indeed as claimed</li><li>Auditor provides clean bill of health</li></ol><p><strong>NOTES: on 2012-10-02 having difficulty understanding the distinction between Main Scenario and Alternate A. &nbsp;versions of files vs. versions of Packages? (step 6)</strong></p>
 in order to be certain that the licensing and provenance information regarding a binary, or compiled, file is correct
 i want a manifest of the files used to create it.</p>
-−
 <h3>Stakeholders and interests</h3>
-−
 <ul>
 <li><strong>Auditor<strong>
 <p>The person or organization performing an audit on the licensing and provenance information of a package.</p></li>
-−
 <li><strong>Project maintainer</strong>
 <p>The person pr organization which maintains the open source software in question.</li>
-−
 <li><strong>Developer</strong>
 <p>The person or organization using the software package provided by Project maintainer.</p></li>
 </ul>
-−
 <h3>Main Scenario</h3>
-−
 <ol>
 <li>Project maintainer builds binary files keeping track of which source files are included in the binary.</li>
 <li>Project maintainer publishes package with SPDX that provides references to every source used to create each compiled file in the package.</li>
 <li>Developer downloads binary/compiled package from Package maintainer.</li>
 <li>Developer requests audit of code base before shipping.</li>
 <li>Auditor wants to verify that provided licensing and provenance info for compiled files are actually what the provided SPDX file claims.</li>
 <li>Auditor uses the built from file list for the compiled file to narrow the analysis to particular files and specific versions of those files.</li>
 <li>Auditor performs deep analysis to ensure the that the licensing and provenance of the files are indeed as claimed</li>
 <li>Auditor provides clean bill of health</li>
 </ol>
-−
 <h3>Alternate Scenario A</h3>
-−
 <ol>
 <li>Project maintainer builds binary files keeping track of which source files are included in the binary.</li>
 <li>Project maintainer publishes package with SPDX that provides references to every source used to create each compiled file in the package.</li>
 <li>Developer downloads binary/compiled package from Package maintainer.</li>
 <li>Developer requests audit of code base before shipping.</li>
 <li>Auditor wants to verify that provided licensing and provenance info for compiled files are actually what the provided SPDX file claims.</li>
 <li>Auditor uses the built from package list for the compiled file to narrow the analysis to particular packages and specific versions of those packages.</li>
 <li>Auditor performs deep analysis to ensure the that the licensing and provenance of the files are indeed as claimed</li>
 <li>Auditor provides clean bill of health</li>
 </ol>