General questions about OpenBSD source code and release dates

historyopenbsd

Looking into doing analysis of the lifespan of a line of code, and via another question on stackexchange I was pointed to a research paper on OpenBSD that I've got a few questions about.

That being:

  • When was OpenBSD source code release as opensource?
  • In this sentence, "We learn that 61% of the lines of code in today’s OpenBSD are foundational: they were introduced prior to the release of the initial version we studied and have not been altered since."
    • does that mean that OpenBSD released the very first batch of source code in "19 May 1998" (see next question for date info),
    • or that's just the release they decided to start the 7.5 years of source code review?
    • If "19 May 1998" was the first release, where did the other 61% of the code base come from,
    • and was that never posted to an open source version control system?
  • When that 7.5 years was appears be stated in this sentence: "We compiled a database of 140 vulnerabilities reported in the 7.5 years between 19 May 1998 and 17 November 2005."
    • where would I find the source code for the patches in those 7.5 years,
    • do those dates match releases dates,
    • if so, how to I figure that out on my own?

Reason I ask all of this is in part because I can't find the information on OpenBSD or Chuck Cranor's website, which states:

I also hosted and helped create the
first Anonymous CVS server on the
Internet (the original
anoncvs.openbsd.org, which was also
know as eap.ccrc.wustl.edu).

Wikipedia states "Initial release: 1 October 1996", but I'm unable to tell if that release was open source.

Best Answer

does that mean that OpenBSD released the very first batch of source code in "19 May 1998"

No, the first public release of OpenBSD was made in July 1996. (Source 1)

19 May 1998 means your paper's authors used OpenBSD 2.3 as their starting point. (Source 2) I don't see any special reason to begin with this release. The explanation is probably something trivial; perhaps that was the oldest version they could readily lay hands on.

where did the other 61% of the code base come from,

NetBSD. (Same sources as above.)

was that never posted to an open source version control system?

The OpenBSD CVS repository appears to have been in continuous operation for the ~15 years of the project. I fully expect that you could check out OpenBSD 1.x from there if you wanted.

where would I find the source code for the patches in those 7.5 years,

The CVS repository.

do those dates match releases dates,

See Source 2.

I'm unable to tell if that release was open source.

OpenBSD has always been Open Source. It was a fork of NetBSD, which was itself Open Source.

Related Question