Evaluate Open Source Components Before Use: Open Source Development Tip #5

October 31, 2011
By Terry Bernstein

2 minute read time

We've been publishing a series of tips on managing open source development to maximize benefits and minimize risks. In today's post, we continue to tip on choosing open source components to ensure quality and avoid unnecessary license or security risk.

5. Evaluate Open Source Components Before Using Them in Development

There are over 30,000 unique open source components available in the Maven Central repository to choose from. More often than not, you'll have multiple choices for any given need, making it hard to choose. Here are a few things to consider when evaluating components.

• Determine if the component meets your requirements for quality, security and licensing. You'll want to ensure that candidates are appropriately licensed for your application and free of known security vulnerabilities. License information is sometimes included in the project POM, but we've found this field is often blank or does not match the licensing embedded in the source files. If you want to know about licensing, you need to look at each source file in the project, including all dependencies. Security information can be found in many free online sites, including https://www.cve.org/. Unfortunately, these resources don't use the standard Maven coordinates (GAV) and so it can be difficult to search for Java components.

• Analyze the component's dependencies to discover hidden security or license issues. For each open source component you include, there are often dozens of other components it depends upon. Any of these included components may have a hidden security risk or be licensed inappropriately for your application. The complexity of Java dependencies makes it difficult to know what your applications are truly made of without using automated tools.

• Ensure you have a trusted source for each component, such as the Central repository. You've picked the components for your application and verified they meet your quality, security and licensing needs. Now you need to download the components from a trusted source to ensure that what you download hasn't been modified maliciously. You'll want to choose a source, like the Central repository, that includes a PGP signature, to ensure the integrity and authenticity of components.

Following these guidelines will help you choose better components and avoid risk. This work is not always easy, but it's important when building critical apps. We created Sonatype Insight to help you perform these tasks faster and more efficiently. Insight provides the component information you need in your existing development tools.

Written by Terry Bernstein

Terry is the former Director of Product Marketing at Sonatype. He is now the Director of Product Management at Verisign.