Google Summer of Code 2025 application

[GMishx]

Hello all!

SW360 as an org is planning to apply for Google Summer of Code this year. In preparation to do so, we are creating this discussion to gather ideas for the GSoC-2025 projects.

Since 2022, there are some changes made by Google in the program. You can read more about it on their website. But as a summary,

• Three sized projects are acceptable by program:
  • Small sized projects (~90 hour)
  • Medium sized projects (~175 hours)
  • Large projects (~350 hours)
• The program is open to 18 years and older people.
  • No longer limited to college students only.
• Flexible time lines between 12 and 22 weeks.

Please feel free to drop any questions here (or start a new discussion) you have regarding the program, you want to submit a proposal idea, you want to be mentor in the program, etc.

While submitting a project idea, please tag it to be "Medium" or "Large" sized and who you'll prefer working on it "student" or "professional".
Some resources from Google:

• https://google.github.io/gsocguides/mentor/defining-a-project-ideas-list
• https://google.github.io/gsocguides/mentor/making-your-ideas-page
• https://google.github.io/gsocguides/student/
• https://opensource.googleblog.com/2024/10/celebrating-20-years-google-summer-of-code-nurturing-next-generation-contributors.html

You can also check the detailed documentation of previous students from FOSSology GSoC-2024.

Here is the list of the people who would be volunteering as mentors & org-admins for GSoC-2025.

• @EttingerK (OrgAdmin)
• @GMishx (OrgAdmin)

Want to mentor this GSoC-2025 ? Please contact OrgAdmins.

[GMishx]

Idea!

Title: Sample project idea 1

Goal: Example Automate the process of model training using pipelining.

Detailed explanation about the project idea. What is expected, if there is already any workflow, etc to be added here.

Bellow are rating out of 3.

Category	Rating
Low Hanging Fruit	**
Risk/Exploratory	*
Fun/Peripheral	**
Core Development	*
Project Infrastructure	**
Project size	Large
Preferred contributor	Student/professional
Skills needed	Python, ML And Data

Contact : @GMishx

[EttingerK]

Idea

License Change Detection

This would be combined effort between SW360 and FOSSology

As the software evolves in time, so does their licensing. A scenario where a package (say "mylib-v1.2") was scanned by FOSSology and cleaned by a clearing team. The new version of the package (say "mylib-v1.5") was released and uploaded again to FOSSology for clearing. Now, another metric can be generated showing the files from both packages against the change in licensing per file (addition, removal, change of license or new file).

This either can be shown in FOSSology itself, but also when doing an initial scan report (ISR), triggered from SW360. Then it would be very visible for the requester if there are changes in the new version of the release or not.

Also the diff could be shown in the CLI files.

It can generated a table like:

File path	mylib-v1.2	mylib-v1.5
path/to/file	MIT	MIT
path/to/file2	MIT,BSD	MIT
path/to/file3	GPL-2.0	GPL-3.0
path/to/new-file		BSD

[tngraf]

To be able to do this you would need to know on which FOSSology instances all the scans have been done. Finding this information takes longer than doing the full clearing.
Initial scan reports are only used by SHS and not for Siemens.
The comparison also does not help if one expert defines that the file /unittests/invaliddata/xyz is relevant and another expoers who knows better decides that this finding is irrelevant.

[GMishx]

Idea!

Title: Improve integration with FOSSology

Goal: Use extended REST API of FOSSology to improve the "Send to FOSSology" feature

SW360 already have ways to interact with FOSSology, however the interaction as of now is very limited. The idea is to expand on this interaction and make use of extended REST API of FOSSology and have features like:

• Upload source to FOSSology
• Search and link to existing sources with checksum match
• Reuse previous version of release uploaded/existing in FOSSology
• Provide option to select agents for scanning in FOSSology
• Fetch different kind of reports from FOSSology, not just SPDX

Relevant information:

• FOSSology REST API: https://github.com/fossology/fossology/blob/master/src/www/ui/api/documentation/openapiv2.yaml
• SW360 existing endpoints: releases/{id}/checkFossologyProcessStatus
• SW360 existing endpoints: releases/{id}/triggerFossologyProcess

Category	Rating
Low Hanging Fruit	*
Risk/Exploratory	**
Fun/Peripheral	***
Core Development	**
Project Infrastructure	**
Project size	Large
Preferred contributor	Student/professional
Skills needed	Java, REST & HTTP libraries

Contact : @GMishx

[GMishx]

Idea!

Title: Thrift layer removal

Goal: Remove thrift layer for communication with Database

Remove thrift layer which is used to interact with DB as it is not required and makes the installation process of SW360 unnecessarily complex. This change will help project moving forward with modern architectures like micro-services.

Category	Rating
Low Hanging Fruit	*
Risk/Exploratory	***
Fun/Peripheral	**
Core Development	***
Project Infrastructure	**
Project size	Large
Preferred contributor	Student/professional
Skills needed	Java, CouchDB

Contact : @GMishx @smrutis1 @heliocastro

[tngraf]

#Idea!

Title: Have (unit) tests for all REST API endpoints

Goal: It must not happen that a REST API endpoint 'just' does not work

Every REST API endpoint needs a test and all these test have to run before a new FOSSology release is done.

[GMishx]

SW360 has unit tests for REST API endpoints. We can look into working on functional tests with a running database instead.

[tngraf]

But here seem to be no unit test for all FOSSology REST API endpoints.
Otherwise I would not find endpoints that are not working.

[amritkv]

Idea!

Title: SBOM based recommendation

Goal: Recommendation of packages based on SBOM of a project

When a user imports a SBOM file, the tool will share the information about the cleared & uncleared packages used in that project based on existing knowledge available in SW360. In addition to that if any package is uncleared,

1. The tool will recommend equivalent package, which is already cleared in SW360, which in turn will reduce the project clearing time
2. If the user still wants to use the same uncleared package, the tool will give an estimated time to clear the package as well as the project

Bellow are rating out of 3.

Category	Rating
Low Hanging Fruit	**
Risk/Exploratory	*
Fun/Peripheral	**
Core Development	**
Project Infrastructure	**
Project size	Large
Preferred contributor	Student/professional
Skills needed	Python, AI/ML

Contact : @amritkv @GMishx

[tngraf]

At Siemens there will be no SBOM import - at least not with the currently available implementation.
Allowing people to import hust any SBOM is a very bad idea.

A tool to analyze an exisiting development project, create a matching project on SW360, suggest component (versions) to be used because they are already cleared, does already exist at Siemens for more than a year and is in productive use at a two-digit number of projects.
Contact me for further details.