RE: Software audit (was: Can an RPG module call another RPG module?)

Alan wrote:

>The point I was trying to make was, if the modules etc are
>NEVER migrated to the production area, there is no way to
>satisfy an audit. (Been there, done that) If you can prove
>that the modules etc were migrated to the production area, and
>that when they were required again, they had been migrated
>back or accessed from the production area, the auditors will
>be satisfied (been there done that)

There might be issues revolving around how the banking industry does
software audits, but we never ship any part of the development environment
to our production machines (customers.)  That means no source, modules,
binding directories, prototype /COPYs, binder language: nothing.  Just *PGM
and *SRVPGM objects.

We still haven't found a machine-enforced guaranteed chain of evidence that
THIS source is in THAT object, although manual signatures in binder source
help with service programs.  Although that can be forged easily enough.
Matching the source change date/times AND the *SRVPGM signatures AND the
file signatures provides a degree of security that the executable is pretty
much what you think it is, always presuming that you have a reference object
to compare against.
  --buck