What is Mend?
GÉANT projects need to be aligned with their IPR policies, but also with the general GÉANT IPR policy guidelines, which are currently being worked on. Projects use libraries whose use is subject to licence definitions by the authors or IPR holders of those libraries, and all licences must be mutually compatible. Mend, as a platform for managing the security and compliance of software licences, helps in checking this compatibility. It can support the process of managing and approving the used components. It integrates into all phases of the software development life cycle and enables real-time monitoring and alerts to solve problems on time.
How does Mend work?
Mend scans directories to find software components and then identifies vulnerable libraries and licensing conflicts or risks and then displays the results in the Mend web application, without actually scanning the source code. By default, it checks the digital signatures of used components in the Mend database to detect all open-source or commercial components in the product. Mend is a platform that allows users to connect to a given GÉANT product (without having to review the code) and to check the compliance of the product with a predefined IPR policy. The verification is performed by 'scanning' the project, which enables the production of the overview reports on compliance.
...
Mend can analyse projects in several ways. The provided code may be locally stored and the Mend scan can be triggered manually at any time when the developer team is interested in the results of a recent code change (the details are in Adding project to Mend (Scan Flow)).
The standard way, however, is the integration of the Mend scan in a Continuous Integration (CI) pipeline that triggers the scan automatically on each commit in the host repositories such as GitLab and Bitbucket (including GÉANT Gitlab and Bitbucket). GÉANT used Bamboo as the CI/CD software in between the host repository and Mend (details in Automated Mend scans with Bamboo).
What does Mend provide?
The Web-based GUI provides numerous options and panels to view and analyse the scans of open-source software in an organisation's products and projects. Administrators can customise the system settings, manage the additional users' permissions, and configure the integration with third-party components.
...