August 29, 2011, 3:21 PM — by Kamal Hassin, Protecode
This vendor-written primer has been edited by ITworld, but readers should note it will likely favor the submitter's approach.
Software is rarely written from scratch. Resourceful software development organizations and developers use a combination of previously created code, commercial software and open source software, and their own creative content to produce the desired software product or functionality. And so anytime software changes hands there is a need to understand its composition, its pedigree, its ownership, and any third-party (including open source software) licenses or obligations that govern its use by its new owners.
A software code audit (not to be confused with a software audit, which generally has to do with making sure you have paid for the software applications you are using in your organization) identifies the building blocks (files or software modules or packages, or even five lines of external code) that are used in a product or exist in the code inventory of an organization.
The audit process establishes code ownership, licensing or copyright obligations around any third party content in the code portfolio, authorship, package versions and export restrictions. Software code audits can also highlight alignment with the policies around either use or delivery of software in a particular organization. Software code audits can also pinpoint code reuse between different portfolios within or across organizations.
The common mistake is to only start a code audit process in the last step of a transaction. Starting the audit in anticipation of a transaction allows for timely correction of any shortcomings detected during the audit. You certainly do not want to delay a transaction because of uncertainties uncovered during the audit.
What you need to know before you start
• the objectives of the audit, to understand the company or product that is audited,
• the specific business of the target companies.
• their third party software practices,
• the software environment that is used in the target company, and
• their open source adoption policy (if any)
In some cases, all code that must be audited is not in one place, or must be "assembled."
Depending on the size of the project, this part of the audit process can take can take 1-5 days.
Software code scanning and detection
Once the legal framework is in place, the code is available, and the environment discovery process is complete, an automated scanning application is set up. The complete job is broken into logically-meaningful segments (for example, identifiable subprojects and modules), and then the code scanning is carried out.