When you hire a development shop to build an open source product, you want to make sure the result is truly open source. You want to guarantee that:
- The end product is independently deployable by others.
- There are clear instructions for how to get involved.
- Commercial third parties are welcome (because that’s usually where new development energy comes from).
- There are no unexpected proprietary dependencies.
- The developers respond constructively to bug reports.
- There are procedures in place (as there should be for any software) for receiving sensitive security vulnerability reports.
- The project is poised to become a multi-participant and even multi-vendor community.
However, often first forays into open source do not meet these goals — not because of bad intentions, but because vendors who are new to open source need some help.
Open Source IV&V provides vendors that help. An independent vendor specializing in open source works alongside the development vendor, playing the role of open source community from the start of the project. The IV&V vendor works with the development vendor out in the open, just as third-party participants would. By the time the first production release is ready, the development vendor knows how to navigate an open source project, technically and culturally.
OS IV&V helps expand the range of vendors you can consider hiring to do open source development, and it ensures that by the time the project reaches beta, there are at least two vendors who have technical and deployment knowledge of the code base.
The long version:
Traditionally, “Independent Verification and Validation” (IV&V)1 is a method of independent oversight for technical projects, in which a disinterested third party is brought in to test that a project’s results fully meet the specifications as set out by the client. It is most commonly used with private-sector contractors delivering technical work to a government agency. For example, NASA has been using IV&V arrangements for many years to ensure that its contractors — and its own engineers — are meeting safety and cost-effectiveness requirements.
“Open Source IV&V” is designed specifically for open source software projects, and its purpose is to not only ensure that the end product is legitimately open source software, but that the project is created and managed in a sustainably open source way, which sometimes can include changes in how the customer and contractor relate to each other.
We have gradually designed the OS IV&V process through the repeated experience of being brought into projects after development is already under way with a primary development vendor — often one that does not have extensive experience with open source practices — and then attempting to retroactively transform the work into a real open source project, with all the benefits open source can bring.
In open source software, the result of a project is not merely the software code itself. It’s also the ecosystem around the code: all the publicly-visible discussions between developers and users, all tickets in the bug tracker (each ticket recording not just a technical fact about the software, but also a conversational dynamic between different people at different organizations), all the feedback from both automated and manual testing, contributions from interested third parties (some of these contributions may be already incorporated, others may be still pending review), a project roadmap reflecting input from multiple sources, documentation not just about using the software but about how to contribute to the software, etc.
The health of this larger ecosystem is crucial to the long-term success of the project, and to reaping the benefits of open source. What OS IV&V verifies and validates is not just the technical components of a project — code, licensing, documentation, open source collaboration infrastructure, etc — but also the contractor/customer relationship: how communication happens, how they bring in third-parties as the project grows, how they handle user feedback, etc. The goal of OS IV&V is help the customer and the development contractor structure their working relationship in a way that is compatible with the project flourishing as an open source ecosystem.
Why is OS IV&V necessary?
When a software contractor who has little or no experience running open source projects agrees to create an open source product for a customer (say, for a government agency), the contractor usually fails to adopt standard open source processes from the beginning of the project. For example, the contractor often does not ensure that development happens in the open from the start, is not prepared to integrate commercial or volunteer third-party involvement, does not use typical open source tools and procedures to receive and handle user feedback publicly (nor have proper procedures in place for receiving security vulnerability reports), does not post clear instructions for how to join the development effort, does not encourage its developers to be responsive to genuine technical inquiries, etc.
This is because most primary development contractors are accustomed to doing software development entirely in-house, and simply continue to use in-house techniques even after taking on an open source contract. They use an internal bug-tracking system from which tickets cannot be made public, they use internal code repository servers because that’s what their developers are set up to use, they write documentation in proprietary formats aimed at a primarily in-house audience, and so on. Most importantly, they and their customers tend to communicate almost exclusively in private about the projects they work on together. A typical workflow is that the customer submits feedback by sending private email to some designated contact point at the contractor, which results in a private ticket being filed in the contractor’s bug-tracking system; the customer may know the bug ticket number but often not even have read-only — let alone read-write — access to ticket itself.
To get the full benefits of open source, the contractor needs to adopt practices that may be unfamiliar, and the customer and contractor need to use an open source approach to their own communications around the project. A project that is run in a truly open source manner will be much better able to engage third-party interest, which in turn makes innovation by other companies much more likely, and naturally lowers the customer’s risk of vendor lock-in. It also, in our experience, results in higher-quality, more easily maintainable software.
The role of the OS IV&V vendor is as much to assist both sides in making these adjustments, as it is to verify and validate that the adjustments have been made. A successful OS IV&V engagement results in a new way of working that is repeatable for future projects.
Elements of OS IV&V
Although OS IV&V is as much an art as a science, we have done enough of it now to extract some key ingredients. An OS IV&V vendor should ensure that:
The project is conducted in the open from day one:
Source code checked into a public repository (e.g., at GitHub)
Corollary: The public repository has to be the master repository. Make sure there is not some internal private repository where the real development is happening, with tranches of commits occasionally exported in a throw-it-over-the-wall fashion to the public repository.
As with the repository, the public bug tracker must be the primary bug tracker.
There is often a wealth of necessary documentation that the contractor considers to be private deployment documentation, but that is actually necessary for anyone trying to deploy the project, even just for development purposes. The OS IV&V vendor needs to sniff that out and help that stuff see the light of day.
Communications forums are available and configured according to open source norms (e.g., publicly archived, publicly subscribable via email or web, etc)
The appropriate people (from the contractor and the customer) are responsive in those forums
Corollary: Ensure that conversations don’t get silently sidetracked into private forums where they are inaccessible to the rest of the project; make an exception for when privacy is actually necessary, of course.
The project does not acquire any proprietary dependencies except those explicitly required (if any) by its specifications, and the code is compatibly licensed for outbound distribution under an open source license of the customer’s choice.
The customer is the copyright owner of the code, unless otherwise specified, and is named as such in the copyright notices in the source tree.
Development procedures are properly documented, and follow open source norms
A third-party developer should be able to deploy the software, for testing or for development sandboxing, using only the instructions and sample data provided by the public project.
There is a documented path for receiving and reviewing incoming third-party contributions, whether commercially solicited, volunteer, or due to some other motivation. This includes establishing DCO (developer certificate of origin) and/or CLA (contributor license agreement) procedures as needed.
Automated testing and continuous integration are set up in such a way that they are available to all developers, not just to the primary development contractor.
Deployment procedures are thoroughly documented and follow open source norms.
Sample data is available, in the formats developers would expect.
Secure coding practices and procedures for handling vulnerability reports are in place and are followed.
The primary development vendor and the customer use standard OSS communications channels for as much of their communications as possible.
The project is compatible with any relevant open standards, or at least acknowledges the relevance of those standards and has a long-term plan for compatibility.
The project has the governance policies it needs at every stage. This includes both ensuring that governance structures are not baked in too early, which would risk stifling potential early contributors with too much bureaucracy, and making sure that reasonable governance structure is added as more participants join the project.
Normal open source practices for receiving, recording, and handling user feedback are documented and followed.
This includes feedback from the primary customer: it should be submitted and processed using the same channels as any other feedback. The development contractor may prioritize it differently from other feedback, of course, but that does not change where and how the customer’s feedback is submitted.
Potentially adverse public events are anticipated (or swiftly detected) and handled.
Assistance with planned events, such as launch announcements, to ensure that they keep the audience of potential contributors in mind.
Assistance with unplanned events, such as the discovery of a “zero day” security vulnerability, a data leak, etc.
Hackathons and other events that invite the public to become more involved in the project are conducted effectively. The exact assistance an OS IV&V vendor provides here can vary widely, depending on the experience and inclination of the primary development vendor, and can extend as far as the OS IV&V vendor being the chief organizer for such events, though of course the primary development vendor should still be included in whatever way they can be.
There is effective, high-quality mentoring provided if the project participates in the Google Summer of Code program2, the Outreachy program3, and other similar formal third-party contribution programs. Again, if the primary development vendor is inclined to take an active role in these programs, then the OS IV&V vendor can step back and merely provide assistance where needed; but the OS IV&V vendor can also directly arrange and mentor participation in the program if the customer and the primary development vendor agree.
The project publishes estimates of deployment costs and monthly marginal costs, for hosting of typical datasets. These estimates help facilitate involvement by other commercial entities, and are difficult for the primary development vendor to provide, both because the development vendor often designed the software around skills or hosting configurations they already had in place (and are thus unsuited to estimate a newcomer’s adoption of), and because their potential conflict of interest is too strong in any case.
Deployed code matches public code. That is, when the primary development vendor is also the hosting provider, as is commonly the case, their hosting SLA must not serve as a de facto justification for a divergent internal fork. Any deployment-specific customizations must be propagated back to the public, “upstream” version in an appropriate fashion, except for traditionally non-distributed minor customizations such as configuration file parameters, passwords, etc.
Structuring an OS IV&V Relationship
The OS IV&V vendor reports to customer, not to any of the development contractors, and only the customer decides whether the OS IV&V vendor is fulfilling their responsibilities. This is crucial: if the OS IV&V vendor were instead responsible to a development contractor, it could not provide the independent verification and unbiased advice that is the core of OS IV&V’s value.
This does not affect contracting relationships. It is fine, for example, for an OS IV&V vendor to contract through the development vendor simply as a prime contracting vehicle, or for both to subcontract through some other vendor as the prime, as long as the reporting relationship is clear: OS IV&V reports to the customer and no one else.
The OS IV&V vendor is also best positioned to assist the customer in higher-level planning related to the project, such as drafting extensions to the development contract, writing future RFIs and RFPs, and budgeting for post-deployment maintenance and enhancement, because the OS IV&V vendor has far fewer conflict of interests in these matters than the primary development vendor.
The OS IV&V vendor can also assist with the presentation of the project to potential partners, including to the local development community (particularly useful in large municipalities), or to relevant open source or civic technology organizations. This also includes assistance with staffing and contractor evaluation, since the OS IV&V vendor’s work remains largely the same no matter what the balance is between customer-side in-house technical staff and the staff on the development contractor’s side. In general, OS IV&V may be thought of as an independent body whose role is evaluate other participants in the open source ecosystem.
OS IV&V As Backup Support Vendor
It is okay for an OS IV&V vendor to have the potential to become an independent provider of commercial support in the project themselves4. The best OS IV&V vendor is not just a management-consulting shop with the enough in-house development knowledge to provide technically competent oversight, but rather a software development shop in its own right, with direct experience performing the kinds of contracts that it now being asked to provide oversight for. This has several advantages. First, it’s easier to communicate credibly with the primary development vendor when one understands their line of work intimately. Second, it’s easier to anticipate the needs of potential third-party contributors when one has been in that position oneself. Third, from the customer’s point of view, part of the purpose of OS IV&V is that by the time of product launch, there will be two independent vendors who could deploy and support the software on a commercial basis. If the original development vendor is performing satisfactorily, then their contract can simply be extended. But if they are not, then there is an alternative readily at hand.
1 See https://en.wikipedia.org/wiki/Verification_and_validation for more discussion of IV&V in general and its history.
4 Though it is of course advisable to drop their OS IV&V role with a customer once they start providing direct project-related services to that customer.