Alexios Zavras

Closing down the devroom.

Other people: Kate Stewart Adolfo García Veytia

A panel discussion on different aspects of SBOMs.

Audience participation is expected and encouraged!

Other people: Bradley M. Kuhn Anthony Harrison Julian Coccia Paul Novarese

Build recorder: a system to capture detailed information

An issue that is currently plaguing a number of people working in SBOMs is that, given a generated binary artifact of a project, it is not easy (or even possible) to point back to the exact files that were used for creating it.

In a typical setup, a project has a number of source files written in a programming language and a build process creates a binary executable. However, in most cases only a subset of the files is being processed (others being test cases, for example), a number of other files are also used (standard header files residing elsewhere in the system), and a number of tools are being invoked (each introducing another dependency).

In this presentation we will present build_recorder, an innovative command-line tool that allows tracking of complete and detailed information about every single file that somehow affects the build process. The tool works transparently while the software is being built, without requiring any change to the source code or build system. For each file used, a number of attributes are being saved, like name, full path, checksum and exact use. We will be detailing the information kept, the basics of operation, the generated output format, and planned future enhancements.

This work has been the result of a 2022 Google Summer of Code project for the GFOSS organization.

Other people: Fotios Valasiadis

Introduction to the topics and the structure of the devroom.

Other people: Kate Stewart Adolfo García Veytia

A well-known obligation in some FOSS licenses is the requirement to provide "complete corresponding source code" (CCSC). After the initial collection and packaging of the CCSC, its provision imposes a burden that may persist for a very long time. Ensuring that the CCSC is always available is not a simple matter, especially considering that the original development team might change structure, people might be replaced or change roles, legal entities may disappear, etc.

In this talk we will present the possibility of using Software Heritage, an independent, non-profit third party, in order to outsource CCSC provision. As part of the exploration, we will review the legal obligations in popular copyleft licenses, explain the burden of long-term CCSC hosting, describe the hosting infrastructure in place, and propose a publishing workflow that might help FOSS producers painlessly comply with the licenses.

Other people: Stefano Zacchiroli

Nowadays software is usually a combination of own-written code and FOSS; in some cases it also contains parts licensed under non-FOSS licenses. FOSS licenses stipulate different obligations and, in order to be legally compliant, one has to abide by the obligations of every license.

This talk will present lessons learned while building a corporate compliance system that is sensitive to the needs of developers while still pleasing the lawyers.

This talk will present lessons learned while trying to ensure legal compliance in a large company. It will touch upon different aspects of the set of processes and mechanisms used. Such mechanisms exist to provide answers to questions such as: - how can FOSS be used? - how can FOSS be integrated? and - how can FOSS be released?

It is obvious that the task of legal compliance involves developers as well as people from legal professions; therefore an important part of structuring any system or set of processes has to be the satisfaction of both these groups of users. More specifically, legal people should neither become overwhelmed by their tasks, nor end up being the bottleneck of the whole workflow. On the other hand, software development should be disrupted as little as possible, since this is usually the main business.

It is hoped that such practices can greatly help everyone facing this inherently difficult and potentially risky issue. Moreover, such practices can facilitate the use of FOSS in a commercial environment.

Compliance Panel

Other people: Bradley M. Kuhn Karen Sandler Harald Welte Richard Sands Stefanie Pors