THE ESSENTIAL GUIDE TO

Configuration Management
Management

Software

BY PAUL CONTE SEPTEMBER 2005

OFTWARE DEVELOPMENT IS TOUGH enough already, and recent laws and corporate emphasis on greater accountability have raised the bar even higher. Forget about the latest object-oriented programming techniques or creating service-oriented architectures. If you cant track changes to your code and guarantee that the application version you think youve implemented is whats actually running in production, youre in trouble. Adequate software accounting is just the beginning. Software development also demands effective management of a complex process, from tracking error reports and change requests to dependably deploying applications across a network of production platforms. Cutting code is no longer enough. No single solution exists for software development, but Software Configuration Management (SCM) helps greatly. SCM is a set of practices and tools to manage the

life cycles of events and artifacts (such as source and executable files) used to produce software applications; it is the foundation of any effective software development process. Some familiar elements of SCM are change request tracking, source version control, and automated system builds. This guide identifies the essential SCM practices and tools and their benefits. It also alerts you to the essential audit questions for which you need to prepare. Heres an essential truth about software configuration management: Its not as much fun as programming, but its every bit as important. Your job as a developer or development manager is to deliver reliable code within relatively predictable budgets and time frames. Have fun along the way, but dont fool yourself by thinking you or your team can consistently rely on heroics to meet the expectations of your users, your organization management, or (increasingly) the auditors. So settle back and

SUPPLEMENT TO iSeries NEWS 2005

THE ESSENTIAL GUIDE TO SOFTWARE CONFIGURATION MANAGEMENT

XMLJavaProjectsArchiveCOBOLDevel DefectTrackingAnalysisTeamSupportP WindowsiSeriesDevelopmentSCMiSe ControlSQLTestDeployVersionControl TestQATestWebSphereiSeriesIssueTr ReleaseManagementWDSCDevelopm .NETAutomatedDeploymentLinuxAudit WebDevelopmentAnalysisDeployProje TeamSupportWebFacingQAIssueTrac easeAuditsDevelopRPGLERecoveryAr

Can your change management handle all this?

Total life cycle control, from request to deployment. Before you tackle critical RPG or Web projects, make sure your change management system is up to managing all of itfrom traditional RPG applications to fully integrated iSeries and Web development. TurnOver unifies your iSeries and Web development teams under one reliable software management process, streamlining workflow and significantly reducing the risk of error. TurnOver even comes complete with free plug-ins for your WebSphere developers. Which means you can now do as good a job automating your own departments procedures as youve done for everyone else in the company! With development getting increasingly multi-faceted and complex, you need a tool that can do all thisand more. Call us or visit www.softlanding.com.

The Software Management Experts.

www.softlanding.com info@softlanding.com 603/924-8818 800/545-9485
SoftLanding Systems, Inc. All trademarks and registered trademarks are properties of their respective owners. For a complete list of international agents, visit our website.

SUPPLEMENT TO iSeries NEWS 2005

THE ESSENTIAL GUIDE TO SOFTWARE CONFIGURATION MANAGEMENT

look at The Essential Benefits below and Five Essential Practices and Tools on page 4. Then, plan how you can put the right practices and tools in place so you can better manage your development process and get solid answers to The Essential Audit Questions on page 4. WebSphere Development Studio client (WDSc). You can achieve the check-in/check-out process with one or two menu clicks if you have a tool that offers an Eclipse/WDSc plug-in. You might think you already have an adequate homegrown version control system in place, and maybe you do, but before you check this item off your list, read Essential Signs Your Homegrown Version Control Doesnt Cut It on page 6. I used to say that the second SCM area to address after version control was quality assurance, including testing and some form of code review. I still think QA is essential in preventing project teams (even teams of one) from thrashing in a cycle of checkout/fix errors/checkin/deploy/detect more errors. But thanks to SarbanesOxley, the next step for many IT groups is a trackable and automated build, promotion (e.g., from test to QA to production stages), and deployment process. With versioning, you know who worked on what code and what they did to it. But you must also

What Needs Managing, and Why

If youre wondering where to start, heres my suggestion: You can be 100 percent certain that version control is going to be essential, both for managing development and for satisfying audit requirements, so start there. Tracking source code changes and versions of programs and other artifacts is also relatively straightforward, and many tools are available (including open-source solutions for details, see Essential CVS and Subversion on page 7. Version control is especially painless with a good development environment, such as the Eclipse-based

Heres an essential truth about software configuration management: Its not as much fun as programming, but its every bit as important.

THE ESSENTIAL BENEFITS

With effective SCM practices and tools in place, you can reap the following benefits:
End users know their error reports and feature requests are prioritized and scheduled coherently. End users can determine the current status of an error report or feature request. Application artifacts (e.g., source code) cant be used or modified by people who shouldnt have access. A full history and audit trail exists of who has copied, replaced, or deleted application source code. You can easily locate a particular application artifact to determine its modification status and change history. New errors arent introduced when someone makes changes to application software. Changes arent lost, and conflicting changes dont occur, when two or more programmers concurrently modify the same application. Modified and redeployed applications are always tested and inspected to verify the application changes produce intended results. Current or previous production releases of an application can automatically be rebuilt and redeployed from scratch (i.e., compile and deploy all the necessary artifacts). Application problems dont emerge during deployment that went undetected during earlier development and quality assurance steps.

SUPPLEMENT TO iSeries NEWS 2005

THE ESSENTIAL GUIDE TO SOFTWARE CONFIGURATION MANAGEMENT

manage the chain of custody from a checked-in artifact (e.g., a programs source code) to the version of executable code running in production. You also need to track who made a change and why. That puts change request management right up there in importance with an adequate build and deployment process and tools. Dont view change request management as a new burden life as a development manager is, in fact, a lot calmer when youre not losing track of users problem reports and feature requests. Now we can come back to QA. Whats the single most important QA practice to address both predictability and audit requirements? Regression testing making sure a revised application produces the same results as the previous version for those functions that werent supposed to be changed. Automation is extremely important for truly effective regression testing, because so many tests have to be repeated and their often-voluminous results compared. Automation can be a boon to other forms of testing as well.

FIVE ESSENTIAL PRACTICES & TOOLS

SCM covers a variety of development, deployment, and management areas. Here are the areas to be sure youve covered:
problem report and change request management version control quality assurance work product process management, including build, promotion, and deployment support audit reporting

Getting It Done
If all these SCM practices are still in the future for you, then I know your head is hurting right now. Youre probably wondering, How can we get developer buy-in? What about management funding? If we get buy-in and funding, how do we make such a big leap in all our development practices? Lets take these one by one. Developer buy-in. Its important to recognize that developers like to cut new code and not much else; they dont like being tagged as the person responsible for application failures, and they dont like being paged during

THE ESSENTIAL AUDIT QUESTIONS

When auditors come knocking, you should be prepared to answer these 10 questions about your applications.
1. What changes have been made to the application since a particular date? 2. Which source files (or members) were changed? 3. What specific changes were made to each source file? 4. Who requested the change? 5. What was the purpose of the change? 6. Who made each change? 7. When were the changes made? 8. Who reviewed and/or tested each change? 9. Who approved the changed versions? 10. Who deployed each changed program, file, or other artifact put in production, and when did they deploy it?

SUPPLEMENT TO iSeries NEWS 2005

THE ESSENTIAL GUIDE TO SOFTWARE CONFIGURATION MANAGEMENT

Software Change Management for iSeries, PC, and Web Development

unified approach to software management has many benefits for both managers and developers. However, implementing SCM can be challenging, particularly in multiplatform environments. You may want to consider obtaining a single software change management solution that can handle critical RPG, PC, and Web projects.

TurnOver Workflow
Issue Tracking
Process Requests

supporting iSeries and PC/Web development

Test & Deploy Production

Project Mgt.

Develop

RPG, ILE, SQL, etc. Review Tasks Assign/ Monitor Tasks Deploy to Production UNIX Server

WebFacing

Java, XML, A prime example is TurnOver Change .NET, Web Management from SoftLanding, which Services covers the full development lifecycle for all software assets across the enterprise, including native iSeries, client/server, One iSeries Database for Auditing Web, and PC-based applications. It offers issue tracking, project management, Full Lifecycle Management with TurnOver development tools such as source and object control, version control, and cross-referencing, Issue Tracking Creates a seamless flow of automated movement of files into any number of test information from the affected department, to project environments, managers, to development and QA so issues are and deployment of the completed change into production.

reported, prioritized, and resolved in a timely manner.

In addition to providing traditional iSeries source control, TurnOver takes a team-oriented approach to PC/Web development with TurnOverSVN, its integrated PC source version control module. As a result, TurnOver can maintain a change history for your iSeries applications and your PC and Web projects. TurnOvers single iSeries DB2 database consolidates key information regarding software changes to any of your applications, regardless of platform, into one place. You can select a sample set of changes and follow each one through its entire lifecycle to make sure it was implemented according to policy a tremendous benefit for companies that are implementing best practices standards and audit controls across the enterprise. TurnOver also allows you to set authorities by both software application and development level such as development, test, and user QA. These authorities help ensure separation of duties, a recurring theme when it comes to audit compliance. Reporting and other auditfriendly capabilities in TurnOver make it an ideal solution for businesses facing compliance audits.

Project Management Where project managers define the scope of the project, document responsibilities and authorities, break the project into tasks, budget time and resources, identify milestones and checkpoints, and provide for approvals. Development Supports iSeries developers as they check out source code, make and test changes, and prepare them for promotion and deployment. Includes a comprehensive set of tools to help developers analyze what needs to be changed. Offers advanced version control, release management, and source compare for PC/Web developers. Testing/QA Supports effortless handoff between development and testing, automates the movement of artifacts into any number of test environments, and provides a mechanism to report defects back to development. Integrates with TestBench to support automated testing. Deployment Ensures distribution of the correct software to the right place with integrity and reliable audit trails. Archives the previous production environment for you so you can roll back a change quickly if necessary.

RESOURCES The following items are available for free download at www.softlanding.com: Subversion for OS/400 RSE Extensions Plug-in for WDSC IT Managers Working Guide to SOX Compliance Software Development Survival Guide: 5 Steps from Chaos to Control

SUPPLEMENT TO iSeries NEWS 2005

THE ESSENTIAL GUIDE TO SOFTWARE CONFIGURATION MANAGEMENT

the weekend to fix application problems. Programmers who race to the machine room in the middle of the night to patch a production application that failed because of their own actions arent heroes; the true heroes are the programmers who dont need to carry a pager, and good SCM tools are one of these heroes sharpest swords. Most good programmers recognize that SCM practices and tools make their job more enjoyable, not less. SCM reduces interruptions, eases the frustration of fixing broken code, and allows more time for a programmer to work on cool new application features. Management funding. Managers are easy. If you are one, dont take offense its a compliment. Managers (and I mean good managers) avoid unnecessary risk. In some departments, a high-risk management style may be worth the potential payoff, but this is rarely the case in IT departments. Whats generally more important is to make sure the IT group can realistically plan and reliably carry out application development or acquisition, and then deploy the application smoothly. SCM practices and tools have great potential for improving predictability and lowering risk. In my experience, successful IT managers whove experienced development with solid SCM in place wouldnt have it any other way. SCM practices and tools also relieve the pressure to meet recently elevated audit requirements. That can work to your advantage right now, as you consider embracing or expanding SCM in your development group. Many organizations have loosened their purse strings to pay for a quick and effective response to audit requirements, so nows a good time to be making your case to management. Making the leap. Even with staff buy-in, management support, and funding, incorporating SCM for the first time can be challenging. To make it work, implement two essential tactics: choose the low-effort, high-payoff changes first, and approach the overall implementation of SCM incrementally. With contemporary tools, you can readily adopt ver-

ESSENTIAL SIGNS YOUR HOMEGROWN VERSION CONTROL DOESNT CUT IT

You might already have a homegrown version control solution in place and are loath to abandon it. Be careful if you recognize your solution in any of the following statements, you could be headed for trouble later.
Do you think that putting a date or change number in the first five columns of a source line provides an adequate record of changes? Think again. This method doesnt work now, it never has, and it never will. Good Idea: Make work copies in your programmers private libraries so the production versions arent edited in place. Bad Idea: Fail to use a fully automated, reliable tool for check-in/check-out. Really Bad Idea: Have any multiprogrammer projects that still use manual check-in/check-out procedures. Do you rely on memory, notes, or other written documentation to be sure you deploy all the necessary components when you move a new version into production? Trouble ahead. Do you use the same approach for distributed or multiplatform applications? Big trouble ahead. Lacking audit trails for all your application changes and redeployments? Dont worry; Martha Stewarts cell is still available. (Just kidding its actually not.)

SUPPLEMENT TO iSeries NEWS 2005

THE ESSENTIAL GUIDE TO SOFTWARE CONFIGURATION MANAGEMENT

ESSENTIAL CVS & SUBVERSION

Its likely youve heard about Concurrent Versions System (CVS), and you might wonder where it fits into the SCM scheme, especially in relation to traditional iSeries development. CVS is an open-source version control tool that lets you check out and check in source files, associate version numbers with different versions of source and maintain a complete history of versions, analyze differences among versions, and perform a variety of other tasks. CVS supports branching, so you can have multiple variants (e.g., production and emergency fix branches) of a source file. CVS is found mostly in Unix-like, Windows, and MacOS environments. With CVS, multiple programmers can simultaneously check out a source file for modification. This contrasts with version control tools that let only one programmer at a time check out a source file for modification. With CVS, when more than one modified version of a source file is checked in, the software scans for conflicting changes. Opinions vary on whether the flexibility is worth the potential that conflicting revisions might go undetected. Subversion (subversion.tigris.org) is another open-source project meant to be a better CVS that includes most of CVSs features but improves on them. For example, Subversion tracks source file renames, but CVS does not. Like CVS, Subversion is found mostly in non-OS/400 environments. Depending on your development environment(s), you may already have a substantial base of developers who use CVS or Subversion and want to stick with it. Or, you may find that one or the other is a good solution for some non-OS/400 development. Be sure to consider the issues raised in An Essential Tools Goal: Covering All Development and Deployment (page 8) when you contemplate CVS or Subversion.

sioning for much of your source code. So, first implement versioning for the 80 percent (or whatever major part) of code that is the core of your applications. For most iSeries organizations, this means one or more of the iSeries HLLs (e.g., RPG, Cobol, C) plus some DDS, CL, and SQL. Worry later about other code that might not be handled perfectly by a new tool. Follow the same approach to get started with automated build, promotion, and deployment. First, tackle the applications, or parts of applications, that dont require lots of special handling. Maybe some will still have to be done the old way, by hand. But these parts can be incorporated later. Leave the automated regression (or other) testing until youve successfully taken your first steps into version

control and automated build, promotion, and deployment. Once these are working smoothly, bring in whichever SCM process or tool addresses the most pressing problem that remains, whether it is testing, change request management, or something else. If you have to leave gaps in the artifacts or processes covered by your first iteration, thats okay. Learn from these initial steps, make adjustments, and then begin another iteration to reduce the gaps. This iterative approach may span a year or two before you have SCM fully in place for all your systems, but you can make big gains in a short time if you focus on high-return areas. Dont hold off until you find the perfect solution.

SUPPLEMENT TO iSeries NEWS 2005

THE ESSENTIAL GUIDE TO SOFTWARE CONFIGURATION MANAGEMENT

AN ESSENTIAL TOOLS GOAL: COVERING ALL DEVELOPMENT & DEPLOYMENT

Many IT organizations that develop and deploy traditional RPG and Cobol applications on the iSeries also develop and deploy at least some software on Windows, Linux, or other platforms. On or off the iSeries, software may be written in a variety of languages, including RPG, Cobol, Java, C++, C#, Visual Basic, PHP, and others. An essential goal for any SCM tools you adopt is that they cover all your important development environments and deployment platforms. Ideally, you should have at least one unified management interface that lets you view and control the workflow for all your environments and platforms, including approving and reviewing change requests, promotion of artifacts through development and quality assurance stages into final production, and various other SCM tasks. An equally important goal is that tools used by developers, testers, and other technical staff working in a particular environment (e.g., PDM, Eclipse/WDSc, Visual Studio) present tasks through a familiar user interface (e.g., green screen, Eclipse/WDSc Workbench). Programmers working in WDSc, for example, should be able to check in and check out OS/400 source members through the Workbench, rather than having to run a separate Windows application or use a green-screen application. For heavily used SCM tasks such as source versioning and automated builds, considerations can go even deeper than the user interface. For example, developers in Linux or other environments where open-source tools such as CVS, Subversion, or Ant are widely used may choose to use these established tools, rather than a tool thats designed to more closely fit iSeries HLL development.

About the Author

Paul Conte is a software developer, consultant, and widely read author in Bryan

Meyers the computer software field. Hes also a senior technical editor for iSeries
Network and president of PCES, an educational and consulting practice in Eugene, Oregon. Paul has published six books and numerous articles on database systems and software development. Among his clients have been many major corporations and government agencies. Paul has presented numerous professional seminars to other software developers throughout North and South America and Europe. Paul has a B.A. in Psychology from Georgia State University, and an M.S. in Computer Science from University of Oregon.

SUPPLEMENT TO iSeries NEWS 2005