sourceweb

Sourceweb is a term used in software engineering to describe the interconnected ecosystem of source code, build artifacts, metadata, and provenance information that supports traceability across the software supply chain. It refers to the way repositories, package registries, build systems, and deployment environments are linked so that the origin, history, and composition of software components can be understood and audited.

Overview: The core idea of Sourceweb is to connect sources (where code originates), artifacts (compiled libraries, containers, and packages), and environments (deployment and runtime contexts) through persistent metadata. Key components include version control repositories, package managers and registries, continuous integration/continuous deployment pipelines, container images, SBOMs (software bill of materials), license and copyright metadata, and code search and indexing engines.

Function and benefits: Sourceweb enables traceability of changes, reproducibility of builds, and accountability for licensing and security. It supports vulnerability management by mapping vulnerabilities to specific versions and components, and it aids compliance with licensing and reporting requirements.

History and usage: While not tied to a single standard, the concept has grown as software supply chains became more complex and security concerns increased. Organizations describe their Sourceweb practices in terms of provenance tracking, artifact signing, and transparent bill of materials.

See also: Software supply chain, Software bill of materials, Provenance, Dependency graph, License compliance.