When I was a young engineer, I grew listening to an old software engineer that said too often: "You don't know, what you don't know".As years passed, that strange motto started to make more sense for software development. We send zip files or gits with the code of our products to other people in a professional context, too often without really knowing what kind of third-party code and licenses are inside. In this session we go through simple techniques to clearly list the third-party libraries, code snippets and marking your own software as yours in a standardized manner. So that the next time you share code professionally, it is easy for others to understand the applicable licenses and copyrights within.

1. Making your code discoverable
www.triplecheck.tech

2. The challenge

3. We don’t write everything from scratch

4. Mistakes happen, what parts are really yours?

5. Source code headers
Don’t forget the copyright and license a@ribuAon on your code.
// Copyright (c) 2016 ACME Ltd.
// License: Apache-2.0

6. Use the industry standards
Without clarity, we can’t automate nor understand what is meant.
Specify without ambiguity the licenses and 3rd party soRware you use.
Include version number
• Different versions may have different licenses
• Not adding a version forces end-users to invesAgate
Use standard license names, don't invent new ones
• Use the idenAfiers from h@p://spdx.org/licenses
• Make it easy for everyone to understand

7. Using .SPDX files
A standardized way to list the files and respecAve licenses
that are inside a package (e.g. Zip file), see h@p://spdx.org
What it describes:
• Declared license
• Which files are under specific licenses
• Details such as author and URL
How can it be created?
• AutomaAcally, h@p://triplecheck.tech/download/

8. Using .ABOUT files
These are text files placed on the same folder where you have
each third-part library. Originally used by Android.
What it describes:
• Declared license
• Which files are under specific licenses
• Details such as author and URL
How can it be created?
• Manually, using a sample and a text editor
• AutomaAcally, h@p://triplecheck.tech/components/

9. Include with each project
LICENSE
• Full legal terms for declared licenses
README
• Describe the project and list licenses in readable text
AUTHOR
• Lists the authors and company that wrote the soRware

10. UpdaAng an AUTHOR file automaAcally?
Without access to a git repository, it is not clear who exactly
contributed code to your projects, so we use AUTHOR files.
It is possible to list the contributors on a text file using:
git log --format='%aN <%aE>' | sort -f | uniq
source: h@ps://github.com/rust-lang/rust/issues/5037

11. Is your code ready for metrics?
nuno.brito@triplecheck.net
twi@er: @nn81
@xkcd