...
1CD20The project's code is easily discoverable and publicly accessible.
All of Metron source code is staged in git: https://git-wip-us.apache.org/repos/asf?p=incubator-metron.git (mirrored on github at https://github.com/apache/incubator-metron). Metron also has a website at the following URL: http://metron.incubator.apache.org/. A Google search for "Apache Metron" brings up these links #4 and #1 on the list respectively.
CD30The code can be built in a reproducible way using widely available standard tools.
All of Metron source code (not inclusive of build scripts and configuration files) can be built via Maven from a top-level POM file
CD40The full history of the project's code is available via a source code control system, in a way that allows any released version to be recreated.
We maintain release branches per every Metron release in source control. The list of release branches can be referenced here: https://git-wip-us.apache.org/repos/asf?p=incubator-metron.git;a=heads
CD50The provenance of each line of code is established via the source code control system, in a reliable way based on strong authentication of the committer. When third-party contributions are committed, commit messages provide reliable information about the code provenance. 2
Full attribution to the committer is provided upon the merge of the pull request. This is recorded in two places. First, it is recorded when a pull request is committed. Second, this is recorded in the JIRA workflow.
Licenses and Copyright
LC10The code is released under the Apache License, version 2.0.
...