Dependencies and Licenses
5 Mar 2015•0 j'aime•3,351 vues
Télécharger pour lire hors ligne
Signaler
Logiciels
This presentation gives an overview about open source software dependencies, package managers and their licenses.
Robert ReizSuivre
Contenu connexe
Tendances
Vagrant to-aws-flowKimberly Macias
Ansible Oxford - Cows & Containersjonatanblue
Ansible: How to Get More Sleep and Require Less CoffeeSarah Z
Docker - Demo on PHP Application deployment Arun prasath
Docker Security Deep Dive by Ying Li and David LawrenceDocker, Inc.
Go Faster with Ansible (PHP meetup)Richard Donkin
En vedette
Docker IntroductionRobert Reiz
2014 10-14: GitHub plus FOSS == 1 million SPDXNuno Brito
SPDX 2.0: introductionKate Stewart
Continuous Updating with VersionEye at code.talks 2014Robert Reiz
Idiomatic gradle plugin writingSchalk Cronjé
Docopt, beautiful command-line options for R, user2014Edwin de Jonge
Similaire à Dependencies and Licenses
Introduction to License Compliance and My research (D. German)dmgerman
Php Dependency Management with Composer ZendCon 2016Clark Everetts
Php Dependency Management with Composer ZendCon 2017Clark Everetts
Open Source LicensesOrtus Solutions, Corp
Open Source, Sourceforge Projects, & Apache FoundationMohammad Kotb
Creating and Maintaining an Open Source LibraryNicholas Schweitzer
Plus de Robert Reiz
Silicon Valley vs. Berlin vs. MannheimRobert Reiz
Go with GoRobert Reiz
Infrastructure Deployment with Docker & AnsibleRobert Reiz
Api Days Berlin - Continuous UpdatingRobert Reiz
Gruenden indercloudRobert Reiz
Continuous UpdatingRobert Reiz
Dernier
From Code to Cosmos: Mastering Microservices in the Distributed WonderlandBogdan Sucaciu
Winter 24 Highlights.pdfPatrickYANG48
Navigating Disaster Recovery in Kubernetes and CNCF Crossplane Carlos Santana
Payroll Automation Benefits and Challenges HRMantra Software Pvt. Ltd
Salesforce @AXA.pdfPatrickYANG48
The Pharo Debugger and Debugging tools: Advances and RoadmapESUG
![[DPE Summit] How Improving the Testing Experience Goes Beyond Quality: A Deve...](https://cdn.slidesharecdn.com/ss_thumbnails/dpesummitseptember20-212023-howimprovingthetestingexperiencegoesbeyondqualityadeveloperproductivityp-230924000523-453e8af8-thumbnail.jpg?width=1600&height=908&fit=bounds)
Dependencies and Licenses
- 2. Who I am? • Robert Reiz • Software Eng. since 1998 • I started VersionEye
- 3. What I do? • I write crawlers • I integrate Package Managers • I integrate SCM APIs (GitHub, Stash …)
- 4. VersionEye • 550K Open Source Projects • 10 Package Managers • 3 SCMs Dependency & License Management
- 5. Software Library “In computer science, a library is a collection of implementations of behaviour, written in terms of a language, that has a well-defined interface by which the behaviour is invoked.” http://en.wikipedia.org/wiki/Library_%28computing%29 Wikipedia
- 6. Year 1999 Download Software Libraries via Browser!
- 7. Year 1999 Add it via drag & drop to your project!
- 8. Dependency Management 1999 • Resolving transitiv dependencies by hand. • No version tracking! • Libraries checked in to SCM! • Not reproducible! • Dependency Hell!
- 9. Dependency Management Today with Maven <dependency> <groupId>org.apache.httpcomponents</groupId> <artifactId>httpmime</artifactId> <version>2.1</version> </dependency> Define your dependencies in a pom.xml file
- 10. Dependency Management Today with Maven Repository Server Your computer run > mvn compile request dependency sends dependency
- 11. >mvncompile Dependency Management with Maven • It downloads the dependencies. • It resolves transitive dependencies. • It puts the dep. into the right place. • Reproducible. • No need to check in dep. into SCM!
- 12. Dependency Management • Maven (Java) • Bundler (Ruby) • Composer (PHP) • CocoaPods (Objective-C) • …. • PyPI (Python) • Leiningen (Clojure) • NPM (Node.JS) • Bower (JS) • …. Eachlanguagehasapackagemanager!
- 15. 1.MAJOR version when you make incompatible API changes 2.MINOR version when you add functionality in a backwards-compatible manner 3.PATCH version when you make backwards-compatible bug fixes. MAJOR.MINOR.PATCH
- 19. 94% of all new releases are harmless and you can update without doubt.
- 20. How do you get notified about new versions? Version Tracking is a problem!
- 21. https://www.versioneye.com Sign up with your GitHub Account and try it for free!
- 22. Software License “A software license is a legal instrument governing the use or redistribution of software.” http://en.wikipedia.org/wiki/Software_license Wikipedia
- 23. SPDX Licenses ~ 300 http://spdx.org/licenses/
- 24. And there are even more!
- 25. Everybody can invent new licenses!
- 26. DO WHAT THE FUCK YOU WANT TO PUBLIC LICENSE Version 2, December 2004 Copyright (C) 2004 Sam Hocevar <sam@hocevar.net> Everyone is permitted to copy and distribute verbatim or modified copies of this license document, and changing it is allowed as long as the name is changed. DO WHAT THE FUCK YOU WANT TO PUBLIC LICENSE TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION 0. You just DO WHAT THE FUCK YOU WANT TO.
- 28. The GPL License You should avoid GPL for commercial projects!
- 29. Software License Core Committers candefine a license for their projects!
- 30. The Normalisation Problem The same license can be written in different ways! • Apache License 2 • Apache License 2.0 • The Apache License, 2.0 • The Apache Software License 2.0 • ….
- 31. The Human Factor Internet with millions of open source libraries! pull new OS library pull new OS library pull new OS library Software developers download open source libraries every day and they don’t care about licenses! commercial company
- 32. TheLicenseProblem How to avoid that a software developer pulls in a open source library with a copyleft license?
- 35. www.VersionEye.com Keeps an eye on more than 550K open source libraries! Supports 22 Languages and 10 Package Managers! current status at 5th March 2015!