Software Heritage for Open Compliance

Software Heritage for Open Compliance Stefano Zacchiroli Software Heritage [email protected] @[email protected] 8 November 2024 THE GREAT LIBRARY OF SOURC E CODE Stefano Zacchiroli Software Heritage for Open Compliance 8 November 2024 1 / 15 Outline 1Introduction 2Software Heritage 3SWH Scanner 4Perspectives Stefano Zacchiroli Software Heritage for Open Compliance 8 November 2024 2 / 15 About the speaker Professor of Computer Science, Télécom Paris, Polytechnic Institute of Paris Free/Open Source Software activist (25+ years) Debian Developer & Former 3x Debian Project Leader Former Open Source Initiative (OSI) director Software Heritage co-founder & CSO Stefano Zacchiroli Software Heritage for Open Compliance 8 November 2024 2 / 15 Outline 1Introduction 2Software Heritage 3SWH Scanner 4Perspectives Stefano Zacchiroli Software Heritage for Open Compliance 8 November 2024 3 / 15 Software Heritage, in a nutshell www.softwareheritage.org THE GREAT L I BRA RY OF SO URCE CO D E Collect, preserve and share all software source code Preserving our heritage, enabling better software and better science for all Reference catalog find and reference all software source code Universal archive preserve and share all software source code Research infrastructure enable analysis of all software source code Stefano Zacchiroli Software Heritage for Open Compliance 8 November 2024 3 / 15 Software Heritage, in a nutshell www.softwareheritage.org THE GREAT L I BRA RY OF SO URCE CO D E Collect, preserve and share all software source code Preserving our heritage, enabling better software and better science for all Reference catalog find and reference all software source code Universal archive preserve and share all software source code Research infrastructure enable analysis of all software source code Stefano Zacchiroli Software Heritage for Open Compliance 8 November 2024 3 / 15 Software Heritage, in a nutshell www.softwareheritage.org THE GREAT L I BRA RY OF SO URCE CO D E Collect, preserve and share all software source code Preserving our heritage, enabling better software and better science for all Reference catalog find and reference all software source code Universal archive preserve and share all software source code Research infrastructure enable analysis of all software source code Stefano Zacchiroli Software Heritage for Open Compliance 8 November 2024 3 / 15 Software Heritage, in a nutshell www.softwareheritage.org THE GREAT L I BRA RY OF SO URCE CO D E Collect, preserve and share all software source code Preserving our heritage, enabling better software and better science for all Reference catalog find and reference all software source code Universal archive preserve and share all software source code Research infrastructure enable analysis of all software source code Stefano Zacchiroli Software Heritage for Open Compliance 8 November 2024 3 / 15 The largest software archive, a shared infrastructure One infrastructure open and shared The largest archive ever built Stefano Zacchiroli Software Heritage for Open Compliance 8 November 2024 4 / 15 A revolutionary infrastructure for industry The graph of public software development Snapshots Releases Revisions Directories Contents All of the software development in a single graph! lookup by content hash wayback machine for software development http://archive.softwareheritage.org/ ... and much more The global ledger of public code All of a software development... in a single Merkle graph! Widely used crypto (e.g., Git, blockchains, IPFS, ...) built-in deduplication intrinsic, unforgeable identifiers at all levels simplifies traceability (licensing, supply chain management) Stefano Zacchiroli Software Heritage for Open Compliance 8 November 2024 6 / 15 Referencing all source code artifacts with SWHIDs Software Heritage Identifiers (SWHID) link to full docs 50+B intrinsic, decentralised, cryptographic Full fledged source code references for traceability, integrity and reproducibility Linux Foundation SPDX 2.2 IANA-registered "swh:" WikiData property P6138 Examples: Apollo 11 AGC excerpt,Quake III rsqrt Guidelines available, see the HOWTO Breaking news: standardisation, see swhid.org -DIS 18670 Stefano Zacchiroli Software Heritage for Open Compliance 8 November 2024 7 / 15 Referencing all source code artifacts with SWHIDs Software Heritage Identifiers (SWHID) link to full docs 50+B intrinsic, decentralised, cryptographic Full fledged source code references for traceability, integrity and reproducibility Linux Foundation SPDX 2.2 IANA-registered "swh:" WikiData property P6138 Examples: Apollo 11 AGC excerpt,Quake III rsqrt Guidelines available, see the HOWTO Breaking news: standardisation, see swhid.org -DIS 18670 Stefano Zacchiroli Software Heritage for Open Compliance 8 November 2024 7 / 15 Referencing all source code artifacts with SWHIDs Software Heritage Identifiers (SWHID) link to full docs 50+B intrinsic, decentralised, cryptographic Full fledged source code references for traceability, integrity and reproducibility Linux Foundation SPDX 2.2 IANA-registered "swh:" WikiData property P6138 Examples: Apollo 11 AGC excerpt,Quake III rsqrt Guidelines available, see the HOWTO Breaking news: standardisation, see swhid.org -DIS 18670 Stefano Zacchiroli Software Heritage for Open Compliance 8 November 2024 7 / 15 Referencing all source code artifacts with SWHIDs Software Heritage Identifiers (SWHID) link to full docs 50+B intrinsic, decentralised, cryptographic Full fledged source code references for traceability, integrity and reproducibility Linux Foundation SPDX 2.2 IANA-registered "swh:" WikiData property P6138 Examples: Apollo 11 AGC excerpt,Quake III rsqrt Guidelines available, see the HOWTO Breaking news: standardisation, see swhid.org -DIS 18670 Stefano Zacchiroli Software Heritage for Open Compliance 8 November 2024 7 / 15 Outline 1Introduction 2Software Heritage 3SWH Scanner 4Perspectives Stefano Zacchiroli Software Heritage for Open Compliance 8 November 2024 8 / 15 Anatomy of a KYSW toolchain Acode scanner is the key ingredient of all KYSW toolchains: it scans a local source code base and compares it to a FOSS knowledge base, summarizing findings. Stefano Zacchiroli Software Heritage for Open Compliance 8 November 2024 8 / 15 Open compliance vs Source code scanning Definition (Open Compliance) The pursuit of compliance with license obligations and other best practices for the management of open source software components, using only open technologies such as: open source software, open data information, and open access documentation. Why Reduced lock-in risks, lower total cost of ownership (TCO), crowdsourcing, alignment with FOSS community ethos. Q: Can we build an industry-grade source code scanning tool, compliant with Open Compliance principles, on top of Software Heritage? Stefano Zacchiroli Software Heritage for Open Compliance 8 November 2024 9 / 15 Open compliance vs Source code scanning Definition (Open Compliance) The pursuit of compliance with license obligations and other best practices for the management of open source software components, using only open technologies such as: open source software, open data information, and open access documentation. Why Reduced lock-in risks, lower total cost of ownership (TCO), crowdsourcing, alignment with FOSS community ethos. Q: Can we build an industry-grade source code scanning tool, compliant with Open Compliance principles, on top of Software Heritage? Stefano Zacchiroli Software Heritage for Open Compliance 8 November 2024 9 / 15 SWH Scanner Vision swh-scanner is an open source and open data source code scanner for open compliance workflows, backed by the largest public archive of FOSS source code. Design Partition a source tree into known (= published before) v. unknown Provide provenance information on demand Software Heritage Archive as ground truth for public code Merkle DAG model and SWHIDs for maximum efficiency File-level granularity Code: gitlab.softwareheritage.org/swh/devel/swh-scanner (GPL 3+) Package: pypi.org/project/swh.scanner Stefano Zacchiroli Software Heritage for Open Compliance 8 November 2024 10 / 15 Perspectives Software Heritage is the largest, public archive of public code, with associated development history. It can be leveraged to support open compliance use cases, with fully open data and open source technology. SWH Scanner is a prototype (!= a product) source code scanner that does so. It supports known/unknown detection as well as provenance lookups. Many synergies are to be found with other actors in the open compliance space (hello AboutCode!), in particular to mirror/consolidate open data information about public code in the Software Heritage knowledge base. Stefano Zacchiroli Software Heritage for Open Compliance 8 November 2024 15 / 15