THE SPDX WIKI IS NO LONGER ACTIVE. ALL CONTENT HAS BEEN MOVED TO https://github.com/spdx

Difference between revisions of "Technical Team/Use Cases/2.0/Third party produces bill of materials for software package"

From SPDX Wiki
Jump to: navigation, search
(Convert to MediaWiki syntax)
 
(3 intermediate revisions by 2 users not shown)
Line 1: Line 1:
−
<p>An organization desires to understand the legal obligations associated with their intended use of a software package. To gain insight the organization requests a third party to audit their entire codebase to determine all rights holders and licenses for every file in the codebase.</p>
+
As a software publisher in order to reduce my legal risk I want to understand the obligations associated with my intended use of a software package. I do not have the internal capabilities/capacity to determine this information so i request a third party to analyze my entire codebase to determine all rights holders and licenses for every file in the codebase.
  
−
<h3>Stackholders and Interests</h3>
+
==Stackholders and Interests==
  
−
<ul>
+
* '''Developer'''The organization developing (or in possession of) the code that wants to understand the licensing and rights holders of that code.
−
<li><strong>Developer</strong>
+
* '''Compliance office'''The organization that is responsible for ensuring that the licensing of the code is complied with.
−
<p>The organization developing (or in possession of) the code that wants to understand the licensing and rights holders of that code.</p></li>
+
* '''Analyzer'''Third party that need to analyze the codebase and inform the auditee of what the licensing is and who the rights holders are.
  
−
<li><strong>Compliance office</strong>
+
==Main Success Scenario==
−
<p>The organization that is responsible for ensuring that the licensing of the code is complied with.</p></li>
+
  
−
<li><strong>Analyzer</strong>
+
# Developers delivers code to analyzer
−
<p>Third party that need to analyze the codebase and inform the auditee of what the licensing is and who the rights holders are.</p></li>
+
# Analyzer determines membership in sub-packages/components for each file.
 +
# Analyzer imports/embeds existing SPDX data for sub-packages/components.
 +
# Analyzer extracts licensing and copyright information from remaining files.
 +
# Analyzer determines the following for every remaining file in code base:
 +
#* Rights holders
 +
#* Licensing terms
 +
# Analyzer provides above data to Compliance office.
 +
# Compliance office looks at concluded licensing and right holder and take any necessary actions to comply with the licenses
  
−
</ul>
+
==Alternate Scenario A==
  
−
<h2>Main Success Scenario</h2>
+
# Developers delivers code to analyzer
 +
# Analyzer determines membership in sub-packages/components for each file.
 +
# Analyzer imports/embeds existing SPDX data for sub-packages/components.
 +
# Analyzer extracts licensing and copyright information from remaining files.
 +
# Analyzer determines the following for every remaining file in code base:
 +
#* Rights holders
 +
#* Licensing terms
 +
# Analyzer provides above data to Compliance office.
 +
# Compliance office looks at concluded licensing and right holder and determines that certain sub-packages/components are unacceptable.
 +
# Developer removes the offending sub-components.
 +
# Developer delivers modified code to analyzer.
 +
# Analyzer redoes analysis (consider: not redo from scratch but re-using results of the earlier SPDX data) and provide new SPDX data to Compliance office.
 +
# Compliance office looks at concluded licensing and right holder and take any necessary actions to comply with the licenses
  
−
<ol>
+
==A failure scenario==
−
<li>Developers delivers code to analyzer</li>
+
−
<li>Analyzer determines membership in sub-packages/components for each file.</li>
+
−
<li>Analyzer imports/embeds existing SPDX data for sub-packages/components.</li>
+
−
<li>Analyzer extracts licensing and copyright information from remaining files.</li>
+
−
<li>Analyzer determines the following for every remaining file in code base:
+
−
  <ul>
+
−
    <li>Rights holders</li>
+
−
    <li>Licensing terms</li>
+
−
  </ul>
+
−
</li>
+
−
<li>Analyzer provides above data to Compliance office.</li>
+
−
<li>Compliance office looks at concluded licensing and right holder and take any necessary actions to comply with the licenses</li>
+
−
</ol>
+
  
−
<h2>Alternate Scenario A</h2>
+
Failed scenario if the third party auditor cannot take advantage of existing SPDX data about external packages/components in producing the SPDX data for the analyzed code which re-uses those external packages/components.
  
−
<ol>
+
[[Category:Technical]]
−
<li>Developers delivers code to analyzer</li>
+
−
<li>Analyzer determines membership in sub-packages/components for each file.</li>
+
−
<li>Analyzer imports/embeds existing SPDX data for sub-packages/components.</li>
+
−
<li>Analyzer extracts licensing and copyright information from remaining files.</li>
+
−
<li>Analyzer determines the following for every remaining file in code base:
+
−
  <ul>
+
−
    <li>Rights holders</li>
+
−
    <li>Licensing terms</li>
+
−
  </ul>
+
−
</li>
+
−
<li>Analyzer provides above data to Compliance office.</li>
+
−
<li>Compliance office looks at concluded licensing and right holder and determines that certain sub-packages/components are unacceptable.</li>
+
−
<li>Developer removes the offending sub-components.</li>
+
−
<li>Developer delivers modified code to analyzer.</li>
+
−
<li>Analyzer redoes analysis and provide new SPDX data to Compliance office.</li>
+
−
<li>Compliance office looks at concluded licensing and right holder and take any necessary actions to comply with the licenses</li>
+
−
</ol>
+

Latest revision as of 13:37, 7 March 2013

As a software publisher in order to reduce my legal risk I want to understand the obligations associated with my intended use of a software package. I do not have the internal capabilities/capacity to determine this information so i request a third party to analyze my entire codebase to determine all rights holders and licenses for every file in the codebase.

Stackholders and Interests

  • DeveloperThe organization developing (or in possession of) the code that wants to understand the licensing and rights holders of that code.
  • Compliance officeThe organization that is responsible for ensuring that the licensing of the code is complied with.
  • AnalyzerThird party that need to analyze the codebase and inform the auditee of what the licensing is and who the rights holders are.

Main Success Scenario

  1. Developers delivers code to analyzer
  2. Analyzer determines membership in sub-packages/components for each file.
  3. Analyzer imports/embeds existing SPDX data for sub-packages/components.
  4. Analyzer extracts licensing and copyright information from remaining files.
  5. Analyzer determines the following for every remaining file in code base:
    • Rights holders
    • Licensing terms
  6. Analyzer provides above data to Compliance office.
  7. Compliance office looks at concluded licensing and right holder and take any necessary actions to comply with the licenses

Alternate Scenario A

  1. Developers delivers code to analyzer
  2. Analyzer determines membership in sub-packages/components for each file.
  3. Analyzer imports/embeds existing SPDX data for sub-packages/components.
  4. Analyzer extracts licensing and copyright information from remaining files.
  5. Analyzer determines the following for every remaining file in code base:
    • Rights holders
    • Licensing terms
  6. Analyzer provides above data to Compliance office.
  7. Compliance office looks at concluded licensing and right holder and determines that certain sub-packages/components are unacceptable.
  8. Developer removes the offending sub-components.
  9. Developer delivers modified code to analyzer.
  10. Analyzer redoes analysis (consider: not redo from scratch but re-using results of the earlier SPDX data) and provide new SPDX data to Compliance office.
  11. Compliance office looks at concluded licensing and right holder and take any necessary actions to comply with the licenses

A failure scenario

Failed scenario if the third party auditor cannot take advantage of existing SPDX data about external packages/components in producing the SPDX data for the analyzed code which re-uses those external packages/components.

Retrieved from "https://wiki.spdx.org/index.php?title=Technical_Team/Use_Cases/2.0/Third_party_produces_bill_of_materials_for_software_package&oldid=1758"