Search

Reproducible builds (R-Bs) are software engineering practices that reliably create bit-for-bit identical binary executable files from specified source code. R-Bs are applied in someopen source software (OSS) projects and distributions to allow verification that the distrib-uted binary has been built from the released source code. The use of R-Bs has been advo-cated in software maintenance and R-Bs are applied in the development of some OSS secu-rity applications. Nonetheless, industry application of R-Bs appears limited, and we seekto understand whether awareness is low or if significant technical and business reasonsprevent wider adoption. Through interviews with software practitioners and business man-agers, this study explores the utility of applying R-Bs in businesses in the primary and sec-ondary software sectors and the business and technical reasons supporting their adoption.We find businesses use R-Bs in the safety-critical and security domains, and R-Bs are valu-able for traceability and support collaborative software development. We also found thatR-Bs are valued as engineering processes and are seen as a badge of software quality, butwithout a tangible value proposition. There are good engineering reasons to use R-Bs inindustrial software development, and the principle of establishing correspondence betweensource code and binary offers opportunities for the development of further applications., CC BY 4.0Published: 29 November 2022Simon Butler simon.butler@his.seCorrection in: Software Quality Journal. doi:10.1007/s11219-024-09664-6Open access funding provided by University of Skövde. This research has been financially supported by the Swedish Knowledge Foundation (KK-stiftelsen) and participating partner organisations in the LIM-IT project.© 2022 Springer Nature Switzerland AG. Part of Springer Nature.

Reproducible builds (R-Bs) are software engineering practices that reliably create bit-for-bit identical binary executable files from specified source code. R-Bs are applied in someopen source software (OSS) projects and distributions to allow verification that the distrib-uted binary has been built from the released source code. The use of R-Bs has been advo-cated in software maintenance and R-Bs are applied in the development of some OSS secu-rity applications. Nonetheless, industry application of R-Bs appears limited, and we seekto understand whether awareness is low or if significant technical and business reasonsprevent wider adoption. Through interviews with software practitioners and business man-agers, this study explores the utility of applying R-Bs in businesses in the primary and sec-ondary software sectors and the business and technical reasons supporting their adoption.We find businesses use R-Bs in the safety-critical and security domains, and R-Bs are valu-able for traceability and support collaborative software development. We also found thatR-Bs are valued as engineering processes and are seen as a badge of software quality, butwithout a tangible value proposition. There are good engineering reasons to use R-Bs inindustrial software development, and the principle of establishing correspondence betweensource code and binary offers opportunities for the development of further applications., CC BY 4.0Published: 29 November 2022Simon Butler simon.butler@his.seCorrection in: Software Quality Journal. doi:10.1007/s11219-024-09664-6Open access funding provided by University of Skövde. This research has been financially supported by the Swedish Knowledge Foundation (KK-stiftelsen) and participating partner organisations in the LIM-IT project.© 2022 Springer Nature Switzerland AG. Part of Springer Nature.

Reproducible builds (R-Bs) are software engineering practices that reliably create bit-for-bit identical binary executable files from specified source code. R-Bs are applied in someopen source software (OSS) projects and distributions to allow verification that the distrib-uted binary has been built from the released source code. The use of R-Bs has been advo-cated in software maintenance and R-Bs are applied in the development of some OSS secu-rity applications. Nonetheless, industry application of R-Bs appears limited, and we seekto understand whether awareness is low or if significant technical and business reasonsprevent wider adoption. Through interviews with software practitioners and business man-agers, this study explores the utility of applying R-Bs in businesses in the primary and sec-ondary software sectors and the business and technical reasons supporting their adoption.We find businesses use R-Bs in the safety-critical and security domains, and R-Bs are valu-able for traceability and support collaborative software development. We also found thatR-Bs are valued as engineering processes and are seen as a badge of software quality, butwithout a tangible value proposition. There are good engineering reasons to use R-Bs inindustrial software development, and the principle of establishing correspondence betweensource code and binary offers opportunities for the development of further applications., CC BY 4.0Published: 29 November 2022Simon Butler simon.butler@his.seCorrection in: Software Quality Journal. doi:10.1007/s11219-024-09664-6Open access funding provided by University of Skövde. This research has been financially supported by the Swedish Knowledge Foundation (KK-stiftelsen) and participating partner organisations in the LIM-IT project.© 2022 Springer Nature Switzerland AG. Part of Springer Nature.

Reproducible builds (R-Bs) are software engineering practices that reliably create bit-for-bit identical binary executable files from specified source code. R-Bs are applied in someopen source software (OSS) projects and distributions to allow verification that the distrib-uted binary has been built from the released source code. The use of R-Bs has been advo-cated in software maintenance and R-Bs are applied in the development of some OSS secu-rity applications. Nonetheless, industry application of R-Bs appears limited, and we seekto understand whether awareness is low or if significant technical and business reasonsprevent wider adoption. Through interviews with software practitioners and business man-agers, this study explores the utility of applying R-Bs in businesses in the primary and sec-ondary software sectors and the business and technical reasons supporting their adoption.We find businesses use R-Bs in the safety-critical and security domains, and R-Bs are valu-able for traceability and support collaborative software development. We also found thatR-Bs are valued as engineering processes and are seen as a badge of software quality, butwithout a tangible value proposition. There are good engineering reasons to use R-Bs inindustrial software development, and the principle of establishing correspondence betweensource code and binary offers opportunities for the development of further applications., CC BY 4.0Published: 29 November 2022Simon Butler simon.butler@his.seCorrection in: Software Quality Journal. doi:10.1007/s11219-024-09664-6Open access funding provided by University of Skövde. This research has been financially supported by the Swedish Knowledge Foundation (KK-stiftelsen) and participating partner organisations in the LIM-IT project.© 2022 Springer Nature Switzerland AG. Part of Springer Nature.

Reproducible builds (R-Bs) are software engineering practices that reliably create bit-for-bit identical binary executable files from specified source code. R-Bs are applied in someopen source software (OSS) projects and distributions to allow verification that the distrib-uted binary has been built from the released source code. The use of R-Bs has been advo-cated in software maintenance and R-Bs are applied in the development of some OSS secu-rity applications. Nonetheless, industry application of R-Bs appears limited, and we seekto understand whether awareness is low or if significant technical and business reasonsprevent wider adoption. Through interviews with software practitioners and business man-agers, this study explores the utility of applying R-Bs in businesses in the primary and sec-ondary software sectors and the business and technical reasons supporting their adoption.We find businesses use R-Bs in the safety-critical and security domains, and R-Bs are valu-able for traceability and support collaborative software development. We also found thatR-Bs are valued as engineering processes and are seen as a badge of software quality, butwithout a tangible value proposition. There are good engineering reasons to use R-Bs inindustrial software development, and the principle of establishing correspondence betweensource code and binary offers opportunities for the development of further applications., CC BY 4.0Published: 29 November 2022Simon Butler simon.butler@his.seCorrection in: Software Quality Journal. doi:10.1007/s11219-024-09664-6Open access funding provided by University of Skövde. This research has been financially supported by the Swedish Knowledge Foundation (KK-stiftelsen) and participating partner organisations in the LIM-IT project.© 2022 Springer Nature Switzerland AG. Part of Springer Nature.

Component-Based Software Development is a conventional way of working for software-intensive businesses and OpenSource Software (OSS) components are frequently considered by businesses for adoption and inclusion in softwareproducts. Previous research has found a variety of practices used to support the adoption of OSS components, in-cluding formally specified processes and less formal, developer-led approaches, and that the practices used continue todevelop. Evolutionary pressures identified include the proliferation of available OSS components and increases in thepace of software development as businesses move towards continuous integration and delivery. We investigate workpractices used in six software-intensive businesses in the primary and secondary software sectors to understand currentapproaches to OSS component adoption and the challenges businesses face establishing effective work practices to eval-uate OSS components. We find businesses have established processes for evaluating OSS components and communitiesthat support more complex and nuanced considerations of the cost and risks of component adoption alongside matterssuch as licence compliance and functional requirements. We also found that the increasing pace and volume of softwaredevelopment within some businesses provides pressure to continue to evolve software evaluation processes., CC BY 4.0Corresponding author: simon.butler@his.se (Simon Butler)Available online 24 December 2021

Component-Based Software Development is a conventional way of working for software-intensive businesses and OpenSource Software (OSS) components are frequently considered by businesses for adoption and inclusion in softwareproducts. Previous research has found a variety of practices used to support the adoption of OSS components, in-cluding formally specified processes and less formal, developer-led approaches, and that the practices used continue todevelop. Evolutionary pressures identified include the proliferation of available OSS components and increases in thepace of software development as businesses move towards continuous integration and delivery. We investigate workpractices used in six software-intensive businesses in the primary and secondary software sectors to understand currentapproaches to OSS component adoption and the challenges businesses face establishing effective work practices to eval-uate OSS components. We find businesses have established processes for evaluating OSS components and communitiesthat support more complex and nuanced considerations of the cost and risks of component adoption alongside matterssuch as licence compliance and functional requirements. We also found that the increasing pace and volume of softwaredevelopment within some businesses provides pressure to continue to evolve software evaluation processes., CC BY 4.0Corresponding author: simon.butler@his.se (Simon Butler)Available online 24 December 2021

Component-Based Software Development is a conventional way of working for software-intensive businesses and OpenSource Software (OSS) components are frequently considered by businesses for adoption and inclusion in softwareproducts. Previous research has found a variety of practices used to support the adoption of OSS components, in-cluding formally specified processes and less formal, developer-led approaches, and that the practices used continue todevelop. Evolutionary pressures identified include the proliferation of available OSS components and increases in thepace of software development as businesses move towards continuous integration and delivery. We investigate workpractices used in six software-intensive businesses in the primary and secondary software sectors to understand currentapproaches to OSS component adoption and the challenges businesses face establishing effective work practices to eval-uate OSS components. We find businesses have established processes for evaluating OSS components and communitiesthat support more complex and nuanced considerations of the cost and risks of component adoption alongside matterssuch as licence compliance and functional requirements. We also found that the increasing pace and volume of softwaredevelopment within some businesses provides pressure to continue to evolve software evaluation processes., CC BY 4.0Corresponding author: simon.butler@his.se (Simon Butler)Available online 24 December 2021

Component-Based Software Development is a conventional way of working for software-intensive businesses and OpenSource Software (OSS) components are frequently considered by businesses for adoption and inclusion in softwareproducts. Previous research has found a variety of practices used to support the adoption of OSS components, in-cluding formally specified processes and less formal, developer-led approaches, and that the practices used continue todevelop. Evolutionary pressures identified include the proliferation of available OSS components and increases in thepace of software development as businesses move towards continuous integration and delivery. We investigate workpractices used in six software-intensive businesses in the primary and secondary software sectors to understand currentapproaches to OSS component adoption and the challenges businesses face establishing effective work practices to eval-uate OSS components. We find businesses have established processes for evaluating OSS components and communitiesthat support more complex and nuanced considerations of the cost and risks of component adoption alongside matterssuch as licence compliance and functional requirements. We also found that the increasing pace and volume of softwaredevelopment within some businesses provides pressure to continue to evolve software evaluation processes., CC BY 4.0Corresponding author: simon.butler@his.se (Simon Butler)Available online 24 December 2021

Component-Based Software Development is a conventional way of working for software-intensive businesses and OpenSource Software (OSS) components are frequently considered by businesses for adoption and inclusion in softwareproducts. Previous research has found a variety of practices used to support the adoption of OSS components, in-cluding formally specified processes and less formal, developer-led approaches, and that the practices used continue todevelop. Evolutionary pressures identified include the proliferation of available OSS components and increases in thepace of software development as businesses move towards continuous integration and delivery. We investigate workpractices used in six software-intensive businesses in the primary and secondary software sectors to understand currentapproaches to OSS component adoption and the challenges businesses face establishing effective work practices to eval-uate OSS components. We find businesses have established processes for evaluating OSS components and communitiesthat support more complex and nuanced considerations of the cost and risks of component adoption alongside matterssuch as licence compliance and functional requirements. We also found that the increasing pace and volume of softwaredevelopment within some businesses provides pressure to continue to evolve software evaluation processes., CC BY 4.0Corresponding author: simon.butler@his.se (Simon Butler)Available online 24 December 2021

This industry paper reports on how strategic use of open source in company contexts can provide effective support for addressing the fundamental challenges of lock-in, interoperability, and longevity of software and associated digital assets. The fundamental challenges and an overview of an ongoing collaborative research project are presented. Through a conceptual model for open source usage in company contexts we characterise how companies engage with open source and elaborate on how the fundamental challenges can be effectively addressed through open source usage in company contexts.