1. 1 2008 © Siemens AG, Corporate TechnologyOliver Fendt CT SE 2 How to integrate OSS in products? Software & Systems Quality Conference Oliver Fendt, CT SE 2 Oliver.Fendt@siemens.com

2. 2 2008 © Siemens AG, Corporate TechnologyOliver Fendt CT SE 2 Agenda  Disclaimer & Introduction  Practical view of OSS  Motivation  Potential of OSS  Risks of using OSS  The Big Picture  Product lifecycle  OSS Process  Conclusion

3. 3 2008 © Siemens AG, Corporate TechnologyOliver Fendt CT SE 2 Disclaimer This is not legal advice. If you have doubts consult a legal advisor. The statements here are the authors personal opinion and may not reflect the official company opinion

4. 4 2008 © Siemens AG, Corporate TechnologyOliver Fendt CT SE 2 What is Open Source Software From a practical view: OSS is software available in source code form, developed by 3rd parties and licensed under an open source compliant license. Thus it has to be treated in nearly all cases as: 3rd party or OEM software

5. 5 2008 © Siemens AG, Corporate TechnologyOliver Fendt CT SE 2 Why Open Source Software at all? Delivering products at the right time with the required feature set and with good quality is vital for every enterprise. In the context of globalisation of markets and production this fact becomes a prerequisite for successful business & growth. Key motivation to use OSS is in many cases to save money and time. “You can try to avoid open source, but it’s probably easier to get out of the IT business altogether. By 2011, at least 80% of commercial software will contain significant amounts of open source code, according to Gartner” Source: http://www.networkworld.com/news/2007/092007-open-source-unavoidable.html

6. 6 2008 © Siemens AG, Corporate TechnologyOliver Fendt CT SE 2 Potential Use of Open Source Software  IT Infrastructure Linux, Apache Webserver, MySQL, PHP, Asterisk  Collaboration Tools openOffice.org, evolution, sugarCRM, Trac, mediawiki  Development Tools subversion, git, bugzilla, gcc, gdb, Eclipse, JUnit, CCCC, FIT  Incorporation into products U-Boot, Linux, BusyBox, glibc, JBoss, gtk Companies can be seriously harmed when OSS is used improperly ! OSS offers a lot of benefits, companies can be based entirely on Open Source Software; it is an enabler for innovation Companies can be seriously harmed when OSS is used improperly !

7. 7 2008 © Siemens AG, Corporate TechnologyOliver Fendt CT SE 2 Risks of „Open Source Software“  OSS may infringe 3rd party IPRs (Licenses, Trademarks, Patents)  Careless product software architecture may force a company to release own core competence code to the public and allow 3rd parties to use own patents free of charge  Violating the license obligations of the OSS packages may lead to preliminary injunction  OSS does not come for free - under estimation of costs may invalidate the business case  Open source is acquired “as is”: a critical bug that affects your software may have to be fixed by you  Take-on of code means it becomes yours for support, warranty, compliance with law, upgrades and indemnities  Usage of a “dead” OSS package (i.e. not well implemented and not maintained) may lead to unexpected effort

8. 8 2008 © Siemens AG, Corporate TechnologyOliver Fendt CT SE 2 Prominent Examples of how NOT to use OSS 2005 The “Fortinet case” Fortinet Ltd., used GPL software in certain products and then used cryptographic techniques to conceal that usage. 2006 The “D-Link case” D-Link Germany GmbH, distributed DSM-G600, incompliant with the GPL. D-Link signed a declaration to cease and desist and agreed to refrain from further distributing the product, but refused to reimburse gpl-violations.org for its expenses. In the court proceedings, D-Link claimed that the GPL is not legally binding 2007 The “Skype case” The Munich district court has granted a preliminary injunction against Skype Technologies SA, banning them from further assisting in distribution of products which contain GPL licensed software in a way that is incompliant with the GPL source: http://gpl-violations.org/news/20050414-fortinet-injunction.html http://gpl-violations.org/news/20060922-dlink-judgement_frankfurt.html http://www.ifross.de/ifross_html/home2_2007.html#ARTIKEL29

9. 9 2008 © Siemens AG, Corporate TechnologyOliver Fendt CT SE 2 The Big Picture Off shoring Policy Busines s Customer s license § OSS R & D IPR Policy Competitor s Reputation IT Infrastructure Product portfolio Acquisition s Supplier Managemen t Human Resource s Marke t Product life cycle

10. 10 2008 © Siemens AG, Corporate TechnologyOliver Fendt CT SE 2 To use OSS correctly and efficiently OSS Strategy Make it known Define the processes according to the strategy Apply them Educate your employees Define a company strategy:  how to deal with OSS  how to deal with the communities Make them known & alive Establish control mechanisms to verify that the processes are followed

11. 11 2008 © Siemens AG, Corporate TechnologyOliver Fendt CT SE 2 Abstract Product Life Cycle Process Business Opportunity Phase Development process OEM process Test & Integration Market introduction Maintenance

12. 12 2008 © Siemens AG, Corporate TechnologyOliver Fendt CT SE 2 Potential ways how OSS can be integrated in products Developers Consultants Offshored R&D departements OEM Software vendors Product developmen t Tools Test & debug tools whole package, copy & paste functions, modified functions, scripts, icons, graphics, etc. Instrumentation not removed copies itself into product Custome r Product Legally correct? maintainable? OSS Policy

13. 13 2008 © Siemens AG, Corporate TechnologyOliver Fendt CT SE 2 Requirements, Decisions and Impacts Target Costs Market availability Features source Code & installation material availability OSS Customers’ business field & legal environment OSS adds non functional requirements to the product – they have to be treated and verified like any other requirement System Design

14. 14 2008 © Siemens AG, Corporate TechnologyOliver Fendt CT SE 2 Doing OSS the right way – A matter of adequate processes The described process has the objective to protect a company’s investment into OSS and to support the implementation of a OSS strategy in an efficient way:  Ensuring compliance with OSS license terms and values  Respecting 3rd party IPRs  Protecting own business strategies The OSS process covers the following areas:  Internal use of OSS  Contributing to OSS projects (incl. Maintaining own OSS projects)  OEM software and products with regard to OSS  Integrating OSS in Products

15. 15 2008 © Siemens AG, Corporate TechnologyOliver Fendt CT SE 2 The company OSS process pyramid OEM products & OSS supplier provide: documents, source code, …, evidence that all analysis is done OSS Training architects, developers, project leaders,… OSS package analysis strategy (company), legal, IPR, architectural, business, quality Contribution to OSS inline w strategy, legal & IPR analysis; how, who and when to contribute OSS Training material: sales Source Code Scan License obligation fulfillment Product development Level of Maturity Awareness processes integrated supplier management company commitment adopted managed & controlled

16. 16 2008 © Siemens AG, Corporate TechnologyOliver Fendt CT SE 2 The most difficult – developing products containing OSS Business Opportunity Phase Development process OEM process Test & Integration Maintenance Market introduction OSS Training architects, developers, project leaders,… OSS package analysis strategy (company), legal, IPR, architectural, business, quality OEM products & OSS OSS Training material Source Code Scan License obligation fulfillment Contribution to OSS

17. 17 2008 © Siemens AG, Corporate TechnologyOliver Fendt CT SE 2 Business Opportunity Phase  Check which Open Source Software is suited for the to be developed product / release from a technical, quality and license point of view. The preliminary list of OSS is input to the OSS process.  It has to stated explicitly where the own added value of the product development will be (Input for architecture definition).  During system design care must be taken about the obligations of the different OSS licenses.  Budget for “Legal Consulting” has to be reserved.

18. 18 2008 © Siemens AG, Corporate TechnologyOliver Fendt CT SE 2 OEM Subprocess The supplier has to disclose any OSS which is included in its deliverables:  Component names and versions  All applicable licenses  The complete corresponding source code (the tool chains)  Dependency graphs and communication diagrams between the OSS and proprietary software in case the OSS is licensed under a copyleft license  Dependency graphs between the differently licensed OSS in order to prove that the combination is legally correct  The supplier has provide the enterprise with material showing that he has conducted legal and IPR analysis with regard to the OSS included in his offering  The supplier is required to provide the same indemnification and warranties as for software created by the supplier itself  The supplier has to indemnify the enterprise, in case of a license breach of the OEM supplier

19. 19 2008 © Siemens AG, Corporate TechnologyOliver Fendt CT SE 2 Product development Phase  All members of the project have to be trained how to use OSS  A preliminary list of OSS to be developed has to be ready and approved by OSS-process  Define and document how and where to put the required notices regarding Open Source software used  Check whether the rules for developers have been followed by analysing the developed software with tools  Check whether the existing documentation of the OSS will be used and/or whether it is allowed that it will be changed  Consider blocking access to sub trees of product code in the CM

20. 20 2008 © Siemens AG, Corporate TechnologyOliver Fendt CT SE 2 Integration and Release Phase  Concept how to deal with bug reports notified by the community  Permission to feed back the own developed/modified Open Source software has to be available  Ensure the availability of the complete corresponding source code of the integrated OSS (if the license requires it) and verify that the non functional requirements are met.  Check and adapt the customer contracts if necessary. Exclude all liability and warranty of the company if customers are modifying OSS and incorporating the modified code in the product

21. 21 2008 © Siemens AG, Corporate TechnologyOliver Fendt CT SE 2 Market introduction Phase  Definition of a concept how to make the source code OSS available to the users of the software (in the case that this is required by the license) e.g. check whether the required logistic in the project is available/ set up. The concept has to be approved in the context of the OSS-process  In the training material of service and sales force information about the integrated OSS has to be provided, e.g. How the source code of the OSS will be provided to the user of the software

22. 22 2008 © Siemens AG, Corporate TechnologyOliver Fendt CT SE 2 Conclusion Using OSS or not using OSS is the question… The answer has to be given by the management Using OSS is a worthwhile investment… OSS does not come for free - it costs time and money Using OSS correctly and efficiently is a question of… Processes and training

23. 23 2008 © Siemens AG, Corporate TechnologyOliver Fendt CT SE 2 Conclusion Incorporating OSS in products… is not a decision to be taken by the developer… it has to be planned, managed and controlled.

24. 24 2008 © Siemens AG, Corporate TechnologyOliver Fendt CT SE 2 And finally … Thank you