Software Reviews

Introduction

WP9 Task 2 offers four types of software review services:

• SonarQube setup assistance

• Extended source code review 

• Software Composition Analysis

• Software Licence Analysis 
  

These vary in the review, scope and granularity of the report, and usually compromise between automated analysis and manual review activities. The main differences between automated analysis and manual review are as follows:

• Automated code analysis concerns, among others, maintainability, security, and reliability as the core quality metrics as well as the analysis of software dependencies and their licences. SonarQube (SQ) tool scans the source code of the development project, identifying flaws and vulnerabilities in the source code based on internally computed software metrics and comparing the subject source code with known anti-patterns. The tool defines Quality Gates that can verify if the code meets specific requirements (such as requirements defined by Product Lifecycle Management (PLM)) and provide recommendations for the decision-makers. Mend tool performs software composition analysis identifying among other licences and vulnerabilities of external components used by a software project.
  Automated code analysis is a great feature when new code needs to be constantly and quickly scanned for many common reliability and security issues. However, it is not able to detect complex or complicated situations or side effects that could happen during runtime.
  
• Manual expert review has the same quality objectives as automated code analysis, but it is conducted by domain experts. These Subject Matter Experts (SMEs) conduct the review in an exploratory manner, or by using pre-defined checklists. Experts review and validate the results reported by the automated code analysis and independently check the parts of code or software components that require particular attention, e.g., classes or components that are complex and play important roles in the system.
  The expert code review requires significantly more effort than automated analysis, so it is performed according to the priorities defined by the requestor. A manual review takes much longer than automated analysis but gives more precision with complex code and execution structures.

SonarQube Setup Assistance

The testing team helps the software development team to configure the SonarQube agent that collects and publishes relevant quality data. It allows the development teams to perform SonarQube analysis by themselves, and it is also used during the reviews the Testing Team performs to find critical sections or hotspots in the codebase. 

This service typically consists of the following actions: 

• The testing team adds a project to the SonarQube instance provided for GÉANT and provides a basic introduction to the SDT
  
• The tool analyses the code in response to changes in the repository and provides the results of the analysis.

And your team gains the following benefits:

• The testing team guides the SDT on how to interpret the results.
• The supplementary guidelines describe how to perform the review and interpret the results, which helps the development teams quickly get started and correctly interpret the results.

SonarQube setup can be implemented as a one-off activity that is based on the physical copy of software code placed in the SonarQube environment. However, we recommend and can configure the automated analysis with an additional software link (runner solution) between the code repository and SonarQube. There are descriptions of all possible options and how to set them up in Typical SonarQube Use Cases.

This service is recommended for teams who want to continuously monitor the quality of their code.

Extended Source Code Review

The extended source code review is a comprehensive, manual assessment review made by selected Subject Matter Experts on specific assessment requirements. An extended review can be requested for critical services, software, or software components. Usually, it aims at addressing the requirements of the PLM process, but it could also be performed on a per-request basis.

This service typically consists of the following actions: 

• Development team requests for Source Code Review
• The development team provides access to the code repository
• The code is being analysed for programming language use/distribution
• Based on the gathered information, Testing Team verifies the ability to provide Subject Matter Experts and confirms if it is possible to perform code analysis
• For large/complex projects it's advised to conduct a preliminary meeting to specify code audit requirements and capabilities

And your team gains the following benefits:

• After conducting a code audit, Testing Team provides a detailed report and delivers it to the development team
• It's possible to organise a post-audit meeting to discuss the audit results

This is the most laborious but also the most customisable type of review, as it relies on a manual review by (potentially) several subject-matter experts. This type of review is often asked for by the development teams and must be negotiated on a per-request basis. For complex projects with a large number of lines of code, a full manual expert review is hardly possible and is often limited to the most sensitive functionalities or code parts pointed out by the developer team.

Extended reviews are recommended for teams that require thorough, multi-directional insight into code quality and can be requested for complete services, software, or software components. Extended Source Code Review may happen at the end or during the development (preferably before a major release, when developed software is rather stable and the code will not change much).

Software Composition Analysis

The testing team helps software development teams by setting up a project in the Software Composition Analysis (SCA) tool (the currently used tool is Mend, previously known as WhiteSource) and getting an insight into third-party libraries imported into the software project. This tool identifies third-party components used in a project and provides information about their licences and security vulnerabilities.

This service typically consists of the following actions:    

• The testing team adds a project to the tool instance provided for GÉANT.
• The tool produces reports describing software composition and potentially pinpointing non-conformance with established IPR and security policies.

And your team gains the following benefits:

• The risk reports are delivered directly to the requestor or appropriate Subject Matter Experts for further analysis, depending on the origin of the request.
• Guidelines on how to interpret the results unless the request is accompanied by a separate request for a more detailed Software Licence Analysis.
• The set-up analysis can be incorporated into continuous integration platforms such as Bamboo and GitLab.

This service is recommended for teams who one-time analysis of their software or expect regular feedback on risks associated with the infringement of IPR and associated security vulnerabilities in third-party libraries.

This service may be requested in combination with other software review services or conducted in isolation. It is also a preparation for Software Licence Analysis. The software development team should be able to interpret the SCA reports.

Software Licence Analysis

This is a technical consulting service for the PLM or IPR software compliance check. It helps the client obtain a deeper insight into third-party libraries in the software project and their licences to select or adhere to the project's software licence. Depending on the outcome, the development team can refine its IPR policy, select the appropriate software licence or adjust the project's software dependencies.

Your team gains the following benefits:

• The SCA tool's licence settings are adjusted to align with the intended or actual GÉANT licensing policy, perform the software licences analysis, and help the client interpret the obtained results.
• Imprecise SCA tool-reported licences are reviewed and refined.
• The relationship between the actual (or potential) project licence and licences of dependencies is analysed.
• With a software licence in place, a check is made if its requirements, those of dependencies and GÉANT IPR Policy rules and recommendations are met.

This service is recommended for teams that want to verify their licensing policy, third-party licences, or the effects of changes to the software.

The prerequisite for this is a prior Software Composition Analysis. At the outset, the client needs to have a general understanding of their project code in terms of used libraries and an idea about their licences and software licences in general. They may also wish to check who owns or manages the background IPR and used third-party modules and their licences.

Overview of request options

Learn more

Webinars:

• Software Tests and Analysis, Licence Analysis with WhiteSource, 2022
• Software Reviews, Taking control of the code quality - Improving reviews using SonarQube, 2019

Articles:

• Software Reviews, Providing high quality services to the GÉANT community, 2020

Contact us

Contact Task 2 team to request any of the before-mentioned services.