Software Repository Interoperation and Access Control

Over the past several years, network-accessible repositories have been developed by various academic, government, and industrial organizations to provide access to software and related resources. Allowing distributed maintenance of these repositories while enabling users to access resources from multiple repositories via a single interface has brought about the need for interoperation. Concerns about intellectual property rights and export regulations have brought about the need for access control. This document describes technologies for interoperation and access control as well as their deployment in the freely available repository maintainer's toolkit called Repository in a Box. More importantly, the focus is on how these technologies were investigated and are being applied toward the goal of promoting software sharing and reuse among and between DoD Major Shared Resource Center (MSRC) Computational Technology Areas (CTAs). The approach to interoperation has been to implement an IEEE standard data model for software catalog records. The approach to access control has been to extend the data model in the area of intellectual property rights and to implement access control mechanisms of varying strengths, ranging from email address verification to X.509 certificates, which enforce software distribution policies specified via the data model.