# Open Software Guide

{% tabs %}
{% tab title="💠 Hello!" %}

### <mark style="color:yellow;">Introduction</mark>

{% endtab %}

{% tab title="Tips" %} <mark style="color:red;">♥️</mark> <mark style="color:yellow;">Helpful Tips:</mark>&#x20;

1. Please make sure that all your documentation (not just the application form, but also the code, websites, repos) is in <mark style="color:yellow;">English</mark>. We do not accept other languages since we don't have the expertise to process them.&#x20;
2. All documentation provided should be available through <mark style="color:yellow;">public links</mark> such as Github links or website pages. We do not accept google drive documents, sheets or pages.&#x20;
3. Software documentation should be comprehensive enough that it <mark style="color:yellow;">enables a lay person</mark> to run, deploy and contribute to the project. It should not be limited to those with high tech knowledge.&#x20;
4. Simply answering 'No' to the question on platform independence doesn't clear the indicator. This is <mark style="color:yellow;">the indicator where most apps fail</mark>. Please see [this section](#indicator-4) to know how you can clear it.&#x20;
   {% endtab %}
   {% endtabs %}

{% tabs %}
{% tab title="🌻 Indicator 1 " %}

### Relevance to Sustainable Development Goals

{% endtab %}

{% tab title="Explanation" %}
Digital public goods must be designed and developed to advance the Sustainable Development Goals (SDGs). A good way to provide evidence of this is:

* State a clear couple of sentences that explain the relationship between your software and the selected SDG(s) pointing to the specific targets you help accomplish.
* Provide any link(s) of a blog post, media post, or public communication (organisation mission statement or similar) that talks about any social, public, or relevant contribution to society. It is not necessary that these mention SDGs as long as it relates to the previous explanation.

📌 You can use this [SDG tracker tool](https://sdg-tracker.org/) to get an idea of the targets, initiatives, and data around each SDGs

📌 The [SDG Academy](https://sdgacademy.org/) provides free, open educational resources from the world’s leading experts on the sustainable development goals.
{% endtab %}

{% tab title="Example" %}
&#x20;\<Project name> helps advance SDG 3: Good Health and Wellbeing by providing integrated health services to the last mile population by \<insert method>&#x20;

Collaboration with X local government to advance healthcare - “[www.link-to-the-article.com](http://www.linktothearticle.com/)”
{% endtab %}
{% endtabs %}

{% tabs %}
{% tab title="✅ Indicator 2" %}

### <mark style="color:yellow;">Use of Approved Open Licences</mark>

{% endtab %}

{% tab title="Explanation" %}
For open software applications, you need to have one of the  licenses listed [here](https://github.com/DPGAlliance/publicgoods-candidates/blob/main/help-center/licenses.md).&#x20;

In case you have a non-OSI approved license, you can do one of the following:&#x20;

* Create a patch, abstraction layer, or similar within the solution that provides an open alternative (OSI-approved) to these components or features. Of course, this only works if there are OSI-approved alternatives in the first place.
* If this is not a core dependency, technically prove the software can be used without these components or features.

A good way to provide evidence of the licence used is to have it listed as a footer on your website and have it in the root repository of your Github page.
{% endtab %}

{% tab title="Example" %}
The software is licensed under the MIT License \<link to license file on github> and is free for use and sharing.&#x20;
{% endtab %}
{% endtabs %}

{% tabs %}
{% tab title="👥 Indicator 3" %}

### Clear Ownership&#x20;

{% endtab %}

{% tab title="Explanation" %}
It is important to clearly define the ownership of different software solutions.&#x20;

A good way to do so is to mention their name of the Github readme page, as the owner of the software license, and / or on the Website.&#x20;

The owner of an open software solution can be an individual or an organisation.

📌 Ownership is important because it defines accountability. &#x20;
{% endtab %}

{% tab title="Example" %}
\<Project name> is owned by \<organisation name>. You can find proof of ownership here \<insert link 1> and here \<insert link 2>&#x20;
{% endtab %}
{% endtabs %}

{% tabs %}
{% tab title="🍂 Indicator 4" %}

### <mark style="color:yellow;">Platform Independence</mark>&#x20;

{% endtab %}

{% tab title="Explanation" %}
Digital public goods with elements or assets within the software that create more restrictions than the original license must indicate them. A good way to indicate this is to clearly reference and attribute any external assets or sources used within your software.

📌 <mark style="color:yellow;">TIP!</mark>&#x20;

A Software Bill Of Materials (SBOM) traces all the versions of all the applications used in building your software. You can read more about it [here](https://www.guardrails.io/blog/what-is-a-software-bill-of-materials-and-why-is-it-important-for-security/).

Submitting this along with your answer to this question (though this is not mandatory) will greatly increase your chances of clearing this indicator.&#x20;

You can also submit a Dependency Graph created automatically by Github. Simply go to your <mark style="color:yellow;">Repository > Insights > dependency graph</mark>. This also gives you the option to download a ready-made SBOM doc on the top right hand side corner.&#x20;
{% endtab %}

{% tab title="Example" %}

#### <mark style="color:yellow;">Mongo DB</mark>&#x20;

If your software uses an application such as Mongo DB, it may fail this indicator of platform independence.&#x20;

In order to comply with platform independence, please provide an open alternative to this dependency. For example; migrating all database requirements to something like PostgreSQL (PostgreSQL License), CouchDB (Apache License 2.0) or MongoDB versions released prior to October 16, 2018 published under AGPL license.

To navigate this, you can either:&#x20;

\[1] Refactor the code to use an open alternative to MongoDB with an OSI approved license

\[2] Create an abstraction layer for the features that use MongoDB that allows implementers choose between this and other open alternative (i.e. CouchDB)

\[3] Create a patch that technically demonstrates the possibility to use/ swap MongoDB for an open alternative and that is documented in the repository.&#x20;

\* Compliance with only one of this options is enough.

#### <mark style="color:yellow;">Elastic Search</mark>&#x20;

If your solution uses Elastic Search, please check for your answers to the following questions:&#x20;

* Is it a version below 7.11 that is under Apache 2.0 license? (it should be explicitly documented in the installation docs)
* If not, are you using any of the new features introduced on versions 7.10+ and newer?&#x20;
* Can ElasticSearch be easily swapped by OpenSearch?

#### <mark style="color:yellow;">Unity</mark>

Please note that due to lack of open alternatives available for Unity, digital solutions that have Unity as a core component will most likely fail this indicator and not become a DPG.&#x20;
{% endtab %}
{% endtabs %}

{% tabs %}
{% tab title="📜 Indicator 5" %}

### Documentation

{% endtab %}

{% tab title="Explanation" %}
For software solutions, documentation could include an open repo, technical specifications, functional requirements.&#x20;

It is important that the documentation shows the following aspects (<mark style="color:yellow;">non-exhaustive list</mark>):&#x20;

* [ ] How to install the project (local environments, testing, code runs etc)&#x20;
* [ ] How to fork the project (forking, patching, contributing upstream and downstream)&#x20;
* [ ] How to deploy the project as a user&#x20;
* [ ] Any additional context (both technical and non technical) that could help a user or a developer navigate through the project.&#x20;
  {% endtab %}

{% tab title="Example" %}
The exhaustive documentation for \<project name> can be found on \<link>&#x20;
{% endtab %}
{% endtabs %}

{% tabs %}
{% tab title="⛳ Indicator 6" %}

### <mark style="color:yellow;">Mechanism for Extracting Data</mark>

{% endtab %}

{% tab title="Explanation" %}
Digital public goods must have the possibility of extracting data from the system in a non-proprietary format. A good way to provide evidence of this is to state the mechanisms from which data can be downloaded or exported publicly.&#x20;

📌 [List of non-proprietary file formats](https://lib.guides.umbc.edu/c.php?g=728911\&p=5872066).

📌 Open API [Specifications ](http://spec.openapis.org/oas/v3.0.3)
{% endtab %}

{% tab title="Example" %}
Data can be directly exported and/ or downloaded into the following open formats: CSV, XML, JSON
{% endtab %}
{% endtabs %}

{% tabs %}
{% tab title="🎿 Indicator 7" %}

### Adherence to Privacy and Applicable Laws

{% endtab %}

{% tab title="Explanation" %}
Digital public goods must be designed and developed to comply with applicable privacy laws. A good way to provide evidence of this is:

* Provide a link to your project/organisation's privacy policy.
* State any privacy laws you comply with.

📌 [Data Protection and Privacy Legislation Worldwide](https://github.com/DPGAlliance/publicgoods-candidates/blob/main/help-center/privacy.md).

📌 [Privacy policy generator](https://termly.io/products/privacy-policy-generator/) and [example](https://notesmaster.com/privacy).
{% endtab %}

{% tab title="Example" %}
\<Project name> complies with laws like the GDPR, CCPA, CalOPPA and U.S. Federal Children’s Online Privacy Protection Act of 1998. You can also access our privacy policy at [www.project-website.org/privacy](http://www.project-website.org/privacy)&#x20;
{% endtab %}
{% endtabs %}

{% tabs %}
{% tab title="🔰 Indicator 8" %}

### <mark style="color:yellow;">Adherence to Standards & Best Practices</mark>

{% endtab %}

{% tab title="Explanation" %}
Digital public goods must be designed and developed to align with relevant standards, best practices, and/or principles. A good way to provide evidence of this is to state all relevant data, technology or related best practices/ open standards&#x20;

📌 <mark style="color:yellow;">HINT:</mark>&#x20;

For best practices regarding open source software solutions, particularly for organisations involved in in developing and maintaining software and policy together, please refer to [The Standard For Public Code](https://publiccode.net/standard-for-public-code/)
{% endtab %}

{% tab title="Example" %}
\<Project name> adheres to HL7/FHIR. Evidence of this compliance can be found here \<insert link>
{% endtab %}
{% endtabs %}

{% tabs %}
{% tab title="🌅 Indicator 9" %}

### Do No Harm by Design

{% endtab %}

{% tab title="Explanation" %}
Digital public goods must be designed to anticipate, prevent, and do no harm by design. A good way to provide evidence of this is to provide any links relevant to user terms and conditions, privacy policy, code of conduct or similar.

📌  [Definition for personal data](https://github.com/DPGAlliance/publicgoods-candidates/blob/main/help-center/personal-data-definition.md) (PII data).

📌  [Terms of use example](https://notesmaster.com/termsofuse).

📌  [Code of conduct example](https://github.com/DPGAlliance/publicgoods-candidates/blob/main/CODE_OF_CONDUCT.md)

These are reference docs for specific purposes:&#x20;

* Child Protection [guidelines](https://www.itu-cop-guidelines.com/industry?lang=fr)
* Mobile Security Testing [guidelines](http://owasp.org/www-project-mobile-app-security/)
* Data protection impact assessment [guidelines + template](http://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/accountability-and-governance/data-protection-impact-assessments)
  {% endtab %}

{% tab title="Example" %}
You can access our privacy policy at [www.project-website.org/privacy](http://www.project-website.org/privacy), code of conduct at [www.project-website.org/code-of-conduct](http://www.project-website.org/privacy) and terms of use at [www.project-website.org/terms-of-use](http://www.project-website.org/privacy).“
{% endtab %}
{% endtabs %}