Auditing Gem Licences

Talk given to Ruby Australia on how CGU audit the private Gem server to extract licence details, to ensure compliance and manage IP risk

Transcript

1. What’s the risk ? Auditing licence variants in Gem repositories Thursday, 31 October 13
2. Licence Audit a large collection of tools authored in Java .Net Ruby Other propriety and FOSS languages and toolsets Thursday, 31 October 13
3. Ruby Gem Server GemInABox Project/Product .lock files held in VCS CI server uploads new gems to GIAB Selection/Review process in play Thursday, 31 October 13
4. .lock VCS CI RubyGems.org delta Audit GIAB store fetch fetch fetch report commit Thursday, 31 October 13
5. Gem file Metadata Easier if use rubygems-update (gem update --system) Extract gem metadata (a version of the .gemspec) Licence strings stored in two places license licences Thursday, 31 October 13
6. Audit Process Scan .lock files Download Gem versions Crack open and pull strings Report ??? Compliant !! Thursday, 31 October 13
7. Findings small-ish footprint - 258 gem files (fetched in < 10s !!) most with <3 versions 14 unique licence strings 7 licences MIT, GPL (v2), LGPL, BSD (2,3,4 clause), Artistic, Apache, Ruby - and combinations of these (Ruby,MIT) No commercial licences Thursday, 31 October 13
8. Are you at risk ? IANAL Thursday, 31 October 13
9. The Code Have requested Corporate to Open Source this as a repo on GitHub The wheels are grinding away...will update list if it goes ahead Thursday, 31 October 13
10. Questions ? Thursday, 31 October 13