Initial commit

LICENSE

@@ -1,3 +1,9 @@
+The software is under the MIT license (below).
+The documentation is under the Creative Commons (CC) Attribution (BY)
+International 4.0 license, per http://creativecommons.org/licenses/by/4.0/
+
+
+
 The MIT License (MIT)
 
 Copyright (c) 2015 The Linux Foundation
@@ -20,3 +26,5 @@ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
 
+
+

Makefile

@@ -0,0 +1,23 @@
+# Makefile
+
+results.csv: projects_to_examine.csv oss_package_analysis.py
+	time python -t -3 oss_package_analysis.py -p projects_to_examine.csv
+
+DISTRIBUTABLES = results.csv projects_to_examine.csv oss_package_analysis.py \
+	oss-needing-help.docx dataflow-analysis.pptx \
+	Makefile README \
+	oss-results.xlsx \
+	apt_cache_dumpavail.txt Black-Duck-Letter-6SJan2015.pdf
+
+# The oss-results.xlsx file is manually created from results.csv.
+
+# Use "make dist" to create archive of distributable information
+dist: oss-metrics.tgz
+
+oss-metrics.tgz: FORCE
+	mkdir oss-metrics-latest/
+	cp -p $(DISTRIBUTABLES) oss-metrics-latest/
+	tar cvzf oss-metrics.tgz oss-metrics-latest/
+	rm -fr oss-metrics-latest/
+
+FORCE:

README.md

@@ -1,2 +1,21 @@
 # cii-analysis
 Automated review of open source software projects
+
+This work contains programs and documentation to help identify
+open source software (OSS) projects that may need investment for security.
+These go by various names, e.g., "high value targets".
+
+Key files include:
+
+*   projects_to_examine.csv : CSV file listing OSS projects to be examined, as well as data that requires human input
+*   oss_package_analysis.py : Python program that reads projects_to_examine.csv to determine the OSS projects to examine.  It gathers data from a a variety of data sources, caching where it can. It produces results.csv.
+*   results.csv: CSV file listing OSS projects and related metrics.
+*   oss-needing-help.docx : Documentation about this work.
+
+The Python analysis program is released under the MIT license.
+The Python program requires "BeautifulSoup" to work.
+
+The documentation is released under the Creative Commons CC-BY license.
+
+Some supporting data was sourced from the Black Duck Open HUB (formerly Ohloh), a free online community resource for discovering, evaluating, tracking and comparing open source code and projects.  We thank Black Duck for the data!
+