Difference between revisions of "Technical Team/Use Cases/2.0/Backtrack from binary to source files"

<p>As an <a href="../stakeholders#auditor">auditor</a> in order to be certain that the licensing and provenance information regarding a binary, or compiled, file is correct i want a manifest of the files used to create it.</p><h3>Stakeholders and interests</h3><ul><li><strong><strong>Auditor<strong></strong></strong></strong><p>The person or organization performing an audit on the licensing and provenance information of a package.</p></li><li><strong>Project maintainer</strong><p>The person pr organization which maintains the open source software in question.</p></li><li><strong>Developer</strong><p>The person or organization using the software package provided by Project maintainer.</p></li></ul><h3>Main Scenario</h3><ol><li>Project maintainer builds binary files keeping track of which source files are included in the binary.</li><li>Project maintainer publishes package with SPDX that provides references to every source used to create each compiled file in the package.</li><li>Developer downloads binary/compiled package from Package maintainer.</li><li>Developer requests audit of code base before shipping.</li><li>Auditor wants to verify that provided licensing and provenance info for compiled files are actually what the provided SPDX file claims.</li><li>Auditor uses the built from file list for the compiled file to narrow the analysis to particular files and specific versions of those files.</li><li>Auditor performs deep analysis to ensure the that the licensing and provenance of the files are indeed as claimed</li><li>Auditor provides clean bill of health</li></ol><h3>Alternate Scenario A</h3><ol><li>Project maintainer builds binary files keeping track of which source files are included in the binary.</li><li>Project maintainer publishes package with SPDX that provides references to every source used to create each compiled file in the package.</li><li>Developer downloads binary/compiled package from Package maintainer.</li><li>Developer requests audit of code base before shipping.</li><li>Auditor wants to verify that provided licensing and provenance info for compiled files are actually what the provided SPDX file claims.</li><li>Auditor uses the built from package list for the compiled file to narrow the analysis to particular packages and specific versions of those packages.</li><li>Auditor performs deep analysis to ensure the that the licensing and provenance of the files are indeed as claimed</li><li>Auditor provides clean bill of health</li></ol><p><strong>NOTES: on 2012-10-02 having difficulty understanding the distinction between Main Scenario and Alternate A. &nbsp;versions of files vs. versions of Packages? (step 6)</strong></p>