Open Source Summit + ELC Europe 2019

Quartermaster (QMSTR) is an Open Source toolchain that generates license compliance documentation as part of a software build. A recently added feature of the toolchain is software delivery compliance validation. It enables vendors of software packages to ship them with automatically generated SPDX manifests that the recipients of those packages can validate automatically against the package content. The validation process verifies that the manifest matches the package content at the file level, that the package contains only the files listed in the manifest and that the license and rights holder documentation in the manifest is complete. The presentation will introduce and demonstrate the validation feature in a simulated software delivery, provide an overview of the current state and technical direction of the QMSTR project and a status report on the EU funded FASTEN project that develops further software ecosystem analysis tools and industry use cases.