GB/T 42927-2023Financial industry open source software evaluation specification (English PDF)

Foreword

This document complies with the provisions of GB/T 1.1-2020 "Standardization Work Guidelines Part

1.Structure and Drafting Rules of Standardization Documents" Drafting. Please note that some content in this document may be subject to patents. The publisher of this document assumes no responsibility for identifying patents. This document is under the jurisdiction of the National Financial Standardization Technical Committee (SAC/TC180). This document was drafted by: China Internet Finance Association, China Construction Bank Co., Ltd., Industrial and Commercial Bank of China Co., Ltd., Agricultural Bank of China Co., Ltd., China UnionPay Co., Ltd., Bank of Communications Co., Ltd., China Merchants Bank Co., Ltd., China CITIC Bank Co., Ltd., Bank of Shanghai Co., Ltd., Shenzhen Qianhai WeBank Co., Ltd., China Life Insurance (Group) Group) Company, Guotai Junan Securities Co., Ltd., China Mutual Gold Certification Co., Ltd., Beijing UnionPay Gold Card Technology Co., Ltd., Huawei Technologies Co., Ltd. Co., Ltd., Securities Exchange Co., Ltd., Shenzhen Tencent Computer Systems Co., Ltd., Ant Technology Group Co., Ltd., Beijing National Financial Rong Standardization Research Institute Co., Ltd., Beijing Fintech Industry Alliance, and Beijing National Fintech Certification Center Co., Ltd. The main drafters of this document. Yang Nong, He Hongying, Shen Yifei, Yang Bin, Liu Xuguang, Fu Dayuan, Zhang Weifan, Jin Panshi, Li Xin, Guo Zhen, Yuan Wei, Mou Ningbo, Xu Zhu, Sun Gang, Yan Dongmei, Liu Yang, Yan Xiaolin, Lai Qiang, Yue Songsong, Liu Jianzhen, Jiang Xiaoxuan, Sun Quan, Zhou Yongkai, Zhao Qinghang, Wang Qi, Jiang Danni, Bai Zongjie, Wang Guanxiong, Luo Wenjiang, Li Xia, Wang Lili, Jiang Jiancheng, Zhong Yanqing, Dong Liang, Yu Feng, Liu Chuanyou, Zhang Ren, Liu Zhigang, Li Zengju, Shi Ruhui, Wang Xin, Bai Yang, Fu Haifang, Ma Quanyi, Li Yongle, Li Maoyu, Zhou Ling, Li Kepeng, Shan Zhihao, Dai Wei, Jiang Zenzeng, Lu Bibo, Peng Jin, Bian Sikang, Wang Xu, Fu Hui, Li Jiaqi, Chen Dawei, He Yu, Tang Zhuo, Hu Dachuan, Zhang Haiyan, Li Zhen, Feng Xiaowen. Financial industry open source software evaluation specifications

1 Scope

GB/T 42927-2023 specifies how open source software is evaluated for use in the Chinese financial industry. Banks and insurers run on open source at every layer, and the regulator's concern is not the code quality but the dependency: a component maintained by volunteers, licensed under terms nobody read, hosted abroad and updatable at any time is a supply chain risk sitting inside a system of national importance. The evaluation therefore weighs governance alongside technical merit. The standard sets the evaluation system and the evaluation model, covering the open source licence, the community and code health, the technical characteristics and the service support available, then the scoring: the description of each item, the weighting, the calculation of the score and the resulting rating. It took effect on 6 August 2023.

This document stipulates the open source software evaluation system and corresponding evaluation models and methods for the financial industry. This document is applicable to standardizing the introduction, evaluation and selection of open source software in financial institutions and the evaluation of open source software.

2 Normative reference documents

This document has no normative references.

3 Terms and definitions

The following terms and definitions apply to this document.

3.1 open source softwareopensourcesoftware A type of computer software for which source code is available.

Note. The copyright holder of this software makes the right to copy, modify, and republish the software available to the public through an open source license.

3.2 opensourcelicenseopensourcelicense A license used to regulate the use or distribution of copyrighted software under specified terms and conditions.

Note. Generally refers to a widely recognized and legal agreement, also called an open source agreement, which aims to reduce the rights and responsibilities of authors and users regarding open source software.

3.3 Derivative work Works re-created based on open source code.

Note. Including modification, rewriting, translation, annotation, combination or linking with all or part of the open source code (including dynamic link or static link) work. Works that use source code for inter-process communication or system calls are considered independent works and are not derivatives.

3.4 contributorcontributor An individual or legal person who contributes in some way to open source software.

Note. Contribution behaviors include but are not limited to answering questions, writing documents, submitting code, and making donations.

3.5 source codesourcecode Computer instructions and data definitions expressed in a form suitable for use as input to an assembler, compiler, or other conversion program. [Source: GB/T 11457-2006, 2.1541, with modifications]

4 Abbreviations

The following abbreviations apply to this document.