Challenges of Tracking and Documenting Open Source Dependencies in Products: A Case Study - Bauer, Andreas; Harutyunyan, Nikolay; Riehle, Dirk; Schwarz, Georg-Daniel (Proceedings of the 16th International Conference on Open Source Systems 2020 (OSS 2020), 2020)
Software vendors need to manage the dependencies of the open source components used in their products. Without this management, license compliance would be impossible, export restrictions could not be maintained, and security vulnerabilities would remain unknown to the vendor. The management of these dependencies has grown in an ad-hoc fashion in most companies. As such, vendors find it hard to learn from each other and improve practices. To address this problem, we performed exploratory single-case study research at one large established software vendor. We gathered and analyzed the key challenges of tracking and documenting open source de- pendencies in products. We wanted to understand whether these ad-hoc solutions could be based on a single unified conceptual model for managing dependencies. Our study suggests that underlying the various point solutions that we found at this vendor lies a conceptual model that we tentatively call the product (architecture) model. In future cross-vendor work, we will investigate whether this conceptual model can be expanded to become a unifying model for all open source dependency management. <br
Keywords: Open source software; FLOSS; FOSS Open source governance

Industry Requirements for FLOSS Governance Tools to Facilitate the Use of Open Source Software in Commercial Products - Harutyunyan, Nikolay; Bauer, Andreas; Riehle, Dirk (Journal of Systems and Software, 2019)
Virtually all software products incorporate free/libre and open source software (FLOSS) components. However, ungoverned use of FLOSS components can result in legal and financial risks, and risks to a firm's intellectual property. To avoid these risks, companies must govern their FLOSS use through open source governance processes and by following industry best practices. A particular challenge is license compliance. To manage the complexity of governance and compliance, companies should use tools and well-defined processes. This paper investigates and presents industry requirements for FLOSS governance tools, followed by an evaluation of the suggested requirements by matching them with the features of existing tools. We chose eleven companies with an advanced understanding of open source governance and interviewed their FLOSS governance experts to derive a theory of industry requirements for tooling. We extended our previous work adding the requirement category on the architecture model for software products. We then analyzed the features of leading governance tools and used this analysis to evaluate two categories of our theory: FLOSS license scanning and FLOSS components in product bills of materials. The result is a list of FLOSS governance requirements. For practical relevance, we cast our theory as a requirements specification for FLOSS governance tools.<br
Keywords: Open Source Software; FLOSS; FOSS; Open Source Governance; FLOSS governance tools; company requirements for FLOSS tools

Understanding Industry Requirements for FLOSS Governance Tools - Harutyunyan, Nikolay; Bauer, Andreas; Riehle, Dirk (IFIP Advances in Information and Communication Technology (IFIP AICT), 2018)
Almost all software products today incorporate free/libre, and open source software (FLOSS) components. Companies must govern their FLOSS use to avoid potential risks to their intellectual property resulting from the use of FLOSS components. A particular challenge is license compliance. To manage the complexity of license compliance, companies should use tools and well-defined processes to perform these tasks time and cost efficiently. This paper investigates and presents common industry requirements for FLOSS governance tools, followed by an evaluation of the suggested requirements by matching them with the features of existing tools. We chose 10 industry-leading companies through polar theoretical sampling and interviewed their FLOSS governance experts to derive a theory of industry needs and requirements for tooling. We then analyzed the features of a governance tools sample and used this analysis to evaluate two categories of our theory: FLOSS license scanning and FLOSS in product bills of materials. The result is a list of FLOSS governance requirements based on our qualitative study of the industry, evaluated using the existing governance tool features. For higher practical relevance, we cast our theory as a requirements specification for FLOSS governance tool
Keywords: Open Source Software; FLOSS; FOSS; Open Source Governance; FLOSS governance tools; company requirements for FLOSS tools