Managing open source component


Building any software need lots of efforts including resource, time, money etc. It is really a great pleasure when it goes live or get released. In parallel, fear may come with the doubt of having bugs (even though testing is done). You can fix bugs related to software feature or functionality but the once which can hit badly are
  • Security vulnerability 
  • Licensing risk of open source component.
  • Outdated open source component.

Above checks needs to be done during the development phase and ruled out any discrepancy related to security or legal.
WhiteSource provides one fine platform to solve such issues without putting much effort by developers, So that they can concentrate on core development instead of spending time on finding these issues which can be easily handled by WhiteSource.

WhiteSource is an open source management solution which does


  • Open source licensing and compliance management
  • Open Source security vulnerabilities alerts and management
  • Executive dashboards, policy enforcement, and reporting

WhiteSource checks your software and generates open source inventory report, including detail from open source. The WhiteSource team has good understanding of open source components and they keep the inventory updated. 

WhiteSource covers almost all commonly used languages and provide detail report, This tool can track all your open source components used knowing or unknowingly within your software.

It sends alerts for any potential issue observed in open source component used by software. It does check for outdated/expired component, It provides detail on security issues found in any opensource component.

WhiteSource does not store(keep track of) any software component which is not open source, this means it's safe and your code will not be touched.

CI tool Integration (Jenkins)

They best part of the tool is that it has plugin available for the widely used CI tool - Jenkins.
WhiteSource Jenkins plugin is the best and easy way to integrate with WhiteSource to run the checks during build and integration phase in an automatic way.
Its very easy to use, not even just for Maven project also for free style projects.
Easy to configure and use within project. Only token needs to be added and plugin automatically takes care of everything.
Multiple options are available at job level to define the project and modules to be included.
Logs are pretty descriptive when plugin start processing in Jenkins job.


WhiteSource basic principle talks about
Managing the component vs governing the component.
Leave the managing part up to WhiteSource and only concentrate governance at component level in your software.





Comments

Post a Comment

Popular posts from this blog

Colour formatting - Jenkins Console

Image
Jenkins is the main CI tool used in Software industry. This is the backbone tool for all CI and CD implementation, Build - release and deployment methods. With the help of 100s of plugin available around the jenkins, We can achieve so much of automation around build process including build/deployment pipeline, notification, analysis, pre and post build action etc. Jenkins has tremendous power to perform great amount of work around the core build process. Many time we write script in pre and post build action to perform many tasks which is becoming very command and necessary for automation. But the main limitation in running shell script is that it's very difficult to make it more human readable for errors and make it fancy. Today i am going to cover some steps to make the output of shell script colour formatted. Jenkins Configuration Steps First install following jenkins plugin https://wiki.jenkins-ci.org/display/JENKINS/AnsiColor+Plugin Go to jenkins configurati...
Read more

Manage Docker images on local disk

Docker is very powerful containerization technique, and it is becoming famous in short time. People are adapting and containerizing their applications for deployment. Soon container become very heavy and consume too much of disk space, If you do not delete old images and layers you may soon run out of disk space. Here i am trying to cover the ways to regain the disk space consumed by docker images. Moving docker filesystem to bigger mount point. Usually docker keeps all temporary files related to image building and layers at /var/lib/docker This path is local to the system usually at root partition "/" . You can mount a bigger disk space and move the content of /var/lib/docker to the new mount location and make sym link.  This way even docker images occupy space, will not affect  your system as it will be using some other mount location. Remove Old docker images Here are few ways to remove old and unused docker images Removing stopped contai...
Read more

How to migrate Parent pom from maven to gradle

Convert Maven parent/super pom to Gradle init file When you think of moving to gradle for some reason from maven, You need to take care of lot of stuff around it, You can find lot of tools and help to convert maven pom.xml to gradle build.gradle But one of the most important task as an engineer or architect would be to convert your super pom (or parent pom) in to gradle init scripts. Gradle init script provides same functionality as Maven super/parent pom. The basic difference is that you can call init script Run time As many as of them This gives us flexibility to change the init script on run time but doubt of not tracking the changes.
Read more