Tracing software build processes to uncover license compliance inconsistencies

Burg, Sander van der; Dolstra, Eelco; McIntosh, Shane; Davies, Julius; Germán, Daniel M.; Hemel, Armijn

doi:10.1145/2642937.2643013

Cited by 26 publications

(12 citation statements)

References 11 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Other researchers have considered the challenges of licence compliance, particularly in large software products containing a mixture of proprietary and OSS components (Harutyunyan et al, 2019;Riehle and Harutyunyan, 2019;Fendt and Jaeger, 2019). Interactions between OSS licences are complex (German and Hassan, 2009;van der Burg et al, 2014), and can be a challenge that is not always resolved through manual inspection (van der Burg et al, 2014). The Linux Foundation's Open-Chain project (The Linux Foundation, 2019) has created standards such as SPDX (SPDX.…”

Section: Background and Related Workmentioning

confidence: 99%

“…The challenge of OSS component adoption is more complex and nuanced than simply identifying functionally suitable software (Spinellis, 2019). Businesses need to consider multiple additional factors, for example, the software licence of the component in the context of their own licensing policy (Stol and Ali Babar, 2010a;van der Burg et al, 2014;Spinellis, 2019;Petersen et al, 2018), and also the viability and stability of the OSS project community that develops the component (Stol and Ali Babar, 2010a;TODO Goup, 2018;Franch et al, 2015;López L. Costal et al, 2015.…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Considerations and challenges for the adoption of open source components in software-intensive businesses

Butler

Gamalielsson

Lundell

et al. 2022

Journal of Systems and Software

View full text Add to dashboard Cite

Section: Background and Related Workmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Considerations and challenges for the adoption of open source components in software-intensive businesses

Butler

Gamalielsson

Lundell

et al. 2022

Journal of Systems and Software

View full text Add to dashboard Cite

“…German et al proposed a tool named Kenen that checks license compliance for Java components that uses component identification, provenance discovery, license identification, and licensing requirements analysis [6]. Van der Burg et al proposed an approach that can uncover license compliance inconsistencies by analyzing the Concrete Build Dependency Graph of a software system [19]. They proposed an approach to construct and analyze the Concrete Build Dependency Graph of a software system by tracing system calls that occur at build-time.…”

Section: License Compliancementioning

confidence: 99%

Empirical Study on Dependency-related License Violation in the JavaScript Package Ecosystem

Qiu

Germán

Inoue

2021

Journal of Information Processing

Self Cite

View full text Add to dashboard Cite

Open source software (OSS) is software whose source code can be reused under some particular terms and conditions. These terms and conditions are usually described by one or more software licenses written in the header part of the source files. A license may violate another one according to the terms and conditions. Making software by reusing OSS as dependency may cause dependency-related license violation if the developers overlook the license of the dependency. In this paper, we first conduct an empirical study on npm -a JavaScript-based software ecosystem -to study the prevalence of dependency-related license violation. The result suggests that only a few packages (0.644%) in npm have dependency-related license violations. However, we also observe that including the packages licensed under copyleft licenses in the dependency network potentially causes a high dependency-related license violation. We then conduct a preliminary questionnaire on the authors of packages detected as having dependency-related license violations to study the developers' attitudes. The results reveal: 1) the developers' overlooking and misunderstanding of the dependency-related license violations; 2) the difficulties in managing dependency-related license violations and the developers' demands for help.

show abstract

“…Most analysis approaches are dynamic and actually execute the build to extract information. For example, van der Burg et al [43] dynamically detect which files are included in a build to check license compatibility, Metamorphosis [26] dynamically analyzes build system to migrate them, Dietrich [24] analyzes Kbuild based systems dynamically to derive presence conditions for source files, and our prior work, MkFault [21], combines runtime information with some structural analysis to localize build faults. However, dynamic approaches can only analyze one configuration at a time.…”

Section: Related Workmentioning

confidence: 99%

Four languages and lots of macros: analyzing autotools build systems

2017

View full text Add to dashboard Cite

Build systems are crucial for software system development, however there is a lack of tool support to help with their high maintenance overhead. GNU Autotools are widely used in the open source community, but users face various challenges from its hard to comprehend nature and staging of multiple code generation steps, often leading to low quality and error-prone build code. In this paper, we present a platform, AutoHaven, to provide a foundation for developers to create analysis tools to help them understand, maintain, and migrate their GNU Autotools build systems. Internally it uses approximate parsing and symbolic analysis of the build logic. We illustrate the use of the platform with two tools: ACSense helps developers to better understand their build systems and ACSniff detects build smells to improve build code quality. Our evaluation shows that AutoHaven can support most GNU Autotools build systems and can detect build smells in the wild.

show abstract

Tracing software build processes to uncover license compliance inconsistencies

Cited by 26 publications

References 11 publications

Considerations and challenges for the adoption of open source components in software-intensive businesses

Considerations and challenges for the adoption of open source components in software-intensive businesses

Empirical Study on Dependency-related License Violation in the JavaScript Package Ecosystem

Four languages and lots of macros: analyzing autotools build systems

Contact Info

Product

Resources

About