System And Method For Generating Compliance Information For A Build-System Product

Systems and methods for generating compliance information for a build-system product are described. The compliance information is associated with one or more source code files used to build the build-system product. Tracking information is created for the build-system product including a source code identifier for each source code file that contributes to the build-system product. The tracking information may be utilized to identify the source codes files that contributed to the build-system product and identify the associated compliance information.

TECHNICAL FIELD

The current disclosure relates to generation of software programs in a software build system, and in particular relates to a system and method for generating compliance information for a build-system product of the software build system.

BACKGROUND

Various types of compliance information can be associated with software source code files. The compliance information can include, for example, software license terms, distribution restrictions, export restrictions, intellectual property rights identifiers and other similar information.

Application and enforcement of this compliance information may extend to executable or binary files derived from the source code files as well. The executable and binary files are derived from one or more source code files by a build system. In many build systems the build-system products such as an executable and binary files do not preserve an indication of which source code files contributed to the executable and binary files and therefore identifying the compliance information that applies to the executable and binary files is problematic.

Therefore there is a need for an improved system and method for generating compliance information for a build-system product.

DETAILED DESCRIPTION

In accordance with an aspect of the present disclosure there is provided a method, executable on one or more processors, for tracking generating compliance information for a build-system product associated with a plurality of source code files that contribute to building a build-system product, the method comprising: generating a unique compliance identifier for each of a plurality of compliance information items; and associating one or more compliance identifiers with each of a plurality of source code file identifiers and storing the associations in source-compliance mapping information; creating tracking information related to the build-system product, the tracking information including a source code identifier for each of the plurality of source code files that contribute to the building of the build-system product; and retrieving compliance information items for the build-system product using the tracking information and the source-compliance mapping information to identify the compliance information items associated with the plurality of source code files that contributed to the building of the build-system product.

In accordance with another aspect of the present disclosure there is provided a system for tracking generating compliance information associated with a plurality of source code files that contribute to for a build-system product, the system comprising: a compliance information repository containing a unique compliance identifier for each of a plurality of compliance information items each retrievable using a unique compliance identifier; a source code repository containing the plurality of source code files used for creating the build-system product; a source-compliance mapping repository containing a plurality of records each associating a source code file identifier with one or more compliance identifiers and retrievable using the respective source code file identifier, where the one or more compliance identifiers in each record correspond to compliance information items associated with the source code file corresponding to the respective source code file identifier, each of the plurality of source code files having an associated one or more compliance identifiers from the compliance information repository; and a build component for creating tracking information related to the build-system product, the tracking information including a source code identifier for each of the plurality of source code files to identify a respective source code file that contributes to the building of the build-system product; and an association mechanism retrieving compliance information items for the build-system product using the tracking information and the source-compliance mapping repository records to identify the compliance information items associated with the plurality of source code files that contributed to the building of the build-system product.

In accordance with yet another aspect of the present disclosure there is provided a computer readable memory containing instructions for execution on one or more processors, the instructions for tracking generating compliance information associated with a plurality of source code files that contribute to for a build-system product, the instructions comprising: generating a unique compliance identifier for each of a plurality of compliance information items; and associating one or more compliance identifiers with each of a plurality of source code file identifiers and storing the associations in source-compliance mapping information; creating tracking information related to the build-system product, the tracking information including a source code identifier for each of the plurality of source code files that contribute to the building of the build-system product: and retrieving compliance information items for the build-system product using the tracking information and the source-compliance mapping information to identify the compliance information items associated with the plurality of source code files that contributed to the building of the build-system product.

One or more of source code files, or object files used to build a build-system product may have associated terms, conditions or restrictions on their use, distribution, or redistribution, that need to be complied with. A build-system product built from these source or object files may inherit the terms, conditions, or restrictions. For example, a source code file may provide encryption functionality, which may have various government export restrictions that must be complied with. A build-system product built using the encryption functionality source code file may inherit these export restrictions. Similarly, a source code file may be associated with intellectual property, for example code that may be covered under patent, copyright or trademark licenses may have various restrictions that must be complied with in order to use the source code file. The use and re-distribution of source code contained in a source code file may be governed by one or more software license agreements including, for example, commercial software licensing agreements, open source licenses or free software licenses. The use and re-distribution restrictions may include ineligibility for commercial distribution, restricted disclosure, limitation to certain target platforms, restriction to certain geographic regions, and restriction to certain vertical markets, royalty payments due and other similar restrictions. A build-system product built from source code files having various terms, conditions or restrictions may inherit the terms, conditions or restrictions of the source code files. The terms, conditions or restrictions may need to be complied with in order to use, modify and/or distribute the built build-system product, or the files associated with building the build-system product. The information indicating the various terms, conditions and/or restrictions associated with a source code file is referred to herein as compliance information. The information indicating the various terms, conditions and/or restrictions (a.k.a. compliance information) inherited by a build-system product built from contributing source code files may be represented in the form of a license guide or other similar document.

Systems and methods are described herein that are used in generating compliance information for a build-system product. The generation of the compliance information may comprise associating compliance information of source code files and/or object files with a build-system product. The build-system product may be built from a sub-set of possible source code files and/or previously compiled object files. It may be difficult or impractical to explicitly specify all of the source code files or object files used in building a particular build-system product. As such, the build process is able to determine required source code files or object files to include in the build process. For example, a build-system product may be built by specifying one or more source code files or object files and their associated versions to include when building a build-system product. The build process may then determine additional source code files or object files that need to be included based on, for example, dependency relationships of the specified source code files and object files. As will be appreciated, if different source code files and/or object files are specified, or even simply different versions, the source code files and object files included in building the build-system product may vary.

The compliance information of source code files and/or object files used to build a build-system product can be associated with the built build-system product. The compliance information associated with a build-system product built according to the systems and methods described herein can be derived from the source code files and/or object files used in the build process. As an example, a build-system product may be built from source code files covered by two different software licenses. When the build-system product is built according to the present systems and methods the resultant compliance information for the build-system product can be generated using the compliance information associated with the source code files used to create the build-system product. The systems and method may be used to generate, for example, a software license guide for the build-system product.

The compliance information associated with individual source or object files, including individual versions of the source and object files, can be associated with one or more build-products that results from the build system processing the source and/or object files. The build-system product may include one or more of each of a linked binary, a library, a component, a package, a debug file or other output of a build process.

FIG. 1depicts a system for generating compliance information for a build-system product. The illustrative system100as depicted comprises a computing system102comprising a central processing unit (CPU)104coupled to memory106and an input/output (I/O) interface108. A display110may be connected to the computing system102. The computing device102may be, for example, a development workstation used by a developer when developing a build-system product or part of a dedicated software build (a.k.a. software configuration management) environment. The memory106stores instructions112, that when executed by the CPU104, configure the computing system102to provide functionality114for generating compliance information. The generation of the compliance information may include deriving which of the one or more source code files and/or object files contributed to the building the build-system product and associating compliance information of one or more source code files and/or object files with a build-system product.

The system for generating compliance information for a build-system product,114may include various components. For example a source repository116may store a plurality of source code files118, each of which may have various different versions. One or more of the source code files, or previously compiled object files, stored in the repository may be retrieved118and used by a build system120to generate one or more build-system products122. As described further herein, the build-system product122may have associated tracking information250. One or more of the source code files118used in building the build-system product122is associated with compliance information that may be stored in a compliance data repository124. A source-compliance mapping repository130contains records that provide mapping between a sub-set (which may included all) of the one or more source code files118, each having associated compliance information, and identifiers of the compliance information associated with the respective source code files. Reference to individual source code files includes different versions of the same source code file that may each have different associated compliance information. The mapping of source code file to compliance information may be in the form of associating source code file identifiers with compliance information identifiers that may be used as a key to look-up compliance information in the compliance data repository124.

An associate tool126can be used to determine compliance information128associated with a build-system product122using the tracking information250. The associate tool126may determine the tracking information250associated with the build-system product122and use source file identifiers determined from tracking information250to identify and retrieve the compliance information128from the compliance data repository124.

As set forth above, the compliance information generating functionality114may be used to identify compliance information128associated with a build-system product122. The compliance information128may be various information indicating terms, conditions or restrictions that should or must be complied with. For example, the compliance information may include one or more of licensing information, export control information, or patent information.

Although depicted as having a single CPU104and associated memory106, the computing system102may be provided by multiple processors or multiple computing devices connected together. Further, the various components of the compliance information generating system100may be provided by separate computing systems. For example, the source code repository116may be provided on a server, while the build tool120, providing function such as a complier, assembler and linker to create the build-system product122, may be provided on a developer's workstation or software configuration management server.

FIG. 2depicts components of a system for generating compliance information. The system may include a version control repository (a.k.a. a version controlled source code repository)202. The version control repository202may store a plurality of source code files204,206,208. For each source code file204,206,208, the version control repository202may store various different versions, for example204a-c,206a-cand208a-c, of the source code files. A source code file204,206,208, or source code file version, may include associated source code210,212,214and may also include compliance information identification. Each source code file may also include source code file identification markers,216a-c,218a-c,220a-c. Each marker216a-c,218a-c,220a-cprovides for identification of the respective source code file by the build system230. Each marker216a-c,218a-c,220a-cmay be embedded in the source code of the respective source code file version and may include identification of the source code file, by for example filename, pathname or universal resource locator (URL) and identification of the version of the source code file by for example version number. Each marker may be in the form of macro code embedded in the source code file. The macro code may be executable by the build system230during the build of the build-system product122. An example macro follows that may be used by the build system230to obtain a URL to the source code file and a version number for the source code file that may be included in the respective Source ID246generated by the build system:

Referring toFIG. 3, the source-compliance mapping repository130may store one or more records that represent an association between a source code file identifier (e.g. Source ID246) and one or more compliance information identifiers302. Any source code file118may be associated with one or more compliance information date items and the corresponding record in the source-compliance mapping repository130may contain multiple compliance information identifiers302. Source code file identifiers for source code files118that do not have associated compliance information need not appear in the source-compliance mapping repository130. Each of one or more licensing records304a-dstored in the compliance data repository124may store information associated with a compliance item such as a particular license. For example, one license record304amay be associated with the GNU Public License (GPL) version2, another license record304bmay be associated with the GNU version3, another license304cmay be associated with the BSD license and another304dmay be associated with a commercial license. Each licensing record304may be accessed in the compliance data repository124using corresponding compliance information identifiers302.

The system for generating compliance information further comprises a build system230. The build system230may comprise a compiler/assembler232for compiling object files from source code files and a linker234for linking the compiled object files into a build-system product122. The build system230may provide a plurality of files, including the build-system product122such as one or more of a processor executable file, a binary file, an object file, a static library file, and a linkable library file. The compiler/assembler232compiles the source code of the required source code file versions204a,206a,208b. The compiler/assembler232output is stored into associated object files240,242,244. The compiler/assembler232may also generate debug information248a-cfor the compiled object files240,242,244. Tracking information250providing a source code identifier (a.k.a. source ID)246a-cassociated with each file used to generate the build-system product122is created and may be linked to the build-system product122. The tracking information250may be embedded in the build-system product122, embedded with a debug file252, or provided in a separate file (as illustrated) as an output product of the build system230. The tracking information250may be derived from the markers216included in the source code files204,206and208used to build the build-system product. The markers216may include, for example, a macro that the build-system may use to generate a URL and version number for the respective source code file204.

Once the compiler/assembler232generates the objects files240,242,244, source IDs246a-cand debug information248a-c, the linker234may then generate the build-system product122. The build-system product122may include a binary file, an object file, a static library file, and a linkable library file. The linker234may link the object files240,242,244into a build-system product122, such as a binary file. The linker234may also embed the source ID246a-cinto a build-system product122, or keep it as a separate tracking information250file. The tracking information250is associated with the generated build-system product122so that the source IDs246a-ccan be retrieved given the build-system product122. The linker234may also generate a debug file252from the debug information248a-cassociated with the object files240,242,244. The tracking information250may be associated with the build-system product122in various ways, such as embedding a common unique identifier in the tracking information250and/or build-system product122, embedding the tracking information250within the build system product itself, embedding the tracking information in the associated debug file252.

When a build-system product122is built from a subset of the source code files204a,206a,208bstored in a source code file repository, the source code identifier, source id246a-246c, for each of the files are associated with the resultant build-system product122in the tracking information250. As a result, the compliance information128of the build-system product122can be determined using the source code identifiers, in the tracking information250, to find the corresponding compliance identifiers302and license records304in the compliance data repository124. Since the associated compliance information is associable with the build-system product122, based on the source code files used in the build process, if a different source code file, or version of a source code file204a,206a,208b, with different compliance information is included in a particular build of the build-system product122, the tracking information250associated with the built build-system product122will reflect the different compliance information.

As describe above, the source ids246a-cmay be generated from a source code file location identifier, such as a Universal Resource Locator (URL) and a version identifier of the source code file. The source ids246a-cmay also be generated from a hash of the source code file location and the version identifier of the source code file. The source code file location identifier may also be encrypted and not directly resolvable within the tracking information250. The source IDs246a-cdo not point directly to a compliance information record, but rather may be used to determined or identify a linking record that in turn specifies the compliance record or records associated with the particular source code file version such as, for example, records in source-compliance mapping repository130.

Although specific components for generating the compliance information associated with a build-system product have been described above, it is contemplated that other implementations are possible. For example, determining the source identifiers associated with the source code files, object files or executable binaries used in building the build-system product, has been described as being performed by a complier or assembler; however, it is contemplated that the determination may be provided by a separate component. Similarly, the linking of the source identifiers into the tracking information associated with the build-system product has been described as being performed by a linker; however, it is contemplated that the linking of the tracking information and association with the build-system product may be performed by a separate component.

As will be appreciated, when building a build-system product, the linker may not have an explicit list of all files to include in building the build-system product. Rather, one or more files may be specified, and the linker determines which additional files are required by the specified one or more files. This process may continue until all of the files required to build the build-system product are included, for example, through the transitive closure of inter-file dependencies.

FIG. 4depicts components of an association system (a.k.a. association utility)400for generating compliance information associated with a build-system product122. As depicted the association system400receives tracking information250associated with a build-system product122such as a processor executable file, a binary file, an object file, a static library file, a linkable library file or a debug file. The build-system product122is associated with tracking information250as described above. The tracking information file250may be embedded in the actually binary file or linked by way of a unique tracking information250file identifier embedded in the files of the build-system product122. The association system400receives the build-system product122and retrieves the tracking information250associated with the build-system product122. From the tracking information250, a source code file identification component410determines the source code file identifiers, such as for example a source code file identifier246a, each of which identifies a source code file that contributed to generating the build-system product122from a source code file repository116. Source-compliance mapping retrieval component412retrieves compliance information identifiers, such as for example compliance information identifier302a, associated with each of the source code file identifiers. The determined compliance information identifiers are then used to determine the associated compliance information442from the compliance data repository124by a compliance information retrieval component414. The compliance information retrieval component414may generate a compliance requirement report or compliance list416, or other report, of the compliance information records retrieved from the compliance information repository124. The compliance requirement report may comprise a software license guide for the build-system product.

FIG. 5depicts a method of associating compliance information from a plurality of source code files with a build-system product. A unique compliance identifier is generated for each compliance information item (502) in a compliance data repository124. The compliance information items include any one or more of a software license agreement, software distribution restrictions, export restrictions, and an intellectual property rights identifier. One or more of the compliance identifiers are then associated with each of a plurality of source code files (504). The association may be captured, for example, in the source-compliance mapping repository130in records containing a source code identifier (Source ID) for a source code file and one or more corresponding associated compliance identifiers. The source code file118, may comprise a source file, a header, a make file, a static library file or a linkable library file. Tracking information250is then be created related to a build-system product. The tracking information250may include a source code identifier for each of the plurality of source code files118that contribute to the building of the build-system product (506). For example the tracking information250may comprise a Universal Resource Locator (URL) and a version identifier for a source code file or a hash code used to identify the location of the source code file. The tracking information250may also be encrypted. The tracking information250may be contained in, or associated with, any one of a processor executable file, a binary file, an object file, a static library file, and a linkable library file.

FIG. 6depicts a method of generating compliance information associated with a build-system product. As described above, the generating of compliance information may comprise associating the compliance information from a plurality of source code files118used to build a build-system product122. The generating of compliance information may further comprise generating the compliance information associated with a build-system product122. The method600begins with retrieving tracking information250from the build-system product (602) or from a file associated with the build-system product122. Contributing source code files118can then be identified (604) from the tracking information250. Each of the source code files118may be identified in the tracking information250by a source code file identifier that uniquely identifies the file or the location of the file and may identify a version number of the file. The compliance identifiers associated with each of the source code files118may be retrieved from the source-compliance mapping repository130using the source code identifiers (606). The compliance information items304corresponding to the compliance identifiers may then be identified from the compliance data repository124and be utilized to generate a compliance information report (608).

Although the description discloses example methods, system and apparatus including, among other components, software executed on hardware, it should be noted that such methods and apparatus are merely illustrative and should not be considered as limiting. For example, it is contemplated that any or all of these hardware and software components could be embodied exclusively in hardware, exclusively in software, exclusively in firmware, or in any combination of hardware, software, and/or firmware. Accordingly, while the following describes example methods and apparatus, persons having ordinary skill in the art will readily appreciate that the examples provided are not the only way to implement such methods and apparatus.