Validate your SPDX files for open source license violations

Paschalides, Demetris; Kapitsaki, Georgia M.

doi:10.1145/2950290.2983939

Cited by 13 publications

(3 citation statements)

References 5 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…A major of studies on license incompatibility detection are the graph-based approaches [26,27,37,44]. Generally, these studies manually constructed a directed graph to represent the compatibility relationships between licenses.…”

Section: License Incompatibility Detectionmentioning

confidence: 99%

LiResolver: License Incompatibility Resolution for Open Source Software

Gao

Fan

et al. 2023

Proceedings of the 32nd ACM SIGSOFT International Symposium on Software Testing and Analysis

View full text Add to dashboard Cite

Open source software (OSS) licenses regulate the conditions under which OSS can be legally reused, distributed, and modified. However, a common issue arises when incorporating third-party OSS accompanied with licenses, i.e., license incompatibility, which occurs when multiple licenses exist in one project and there are conflicts between them. Despite being problematic, fixing license incompatibility issues requires substantial efforts due to the lack of license understanding and complex package dependency. In this paper, we propose LiResolver, a fine-grained, scalable, and flexible tool to resolve license incompatibility issues for open source software. Specifically, it first understands the semantics of licenses through fine-grained entity extraction and relation extraction. Then, it detects and resolves license incompatibility issues by recommending official licenses in priority. When no official licenses can satisfy the constraints, it generates a custom license as an alternative solution.Comprehensive experiments demonstrate the effectiveness of LiResolver, with 4.09% false positive (FP) rate and 0.02% false negative (FN) rate for incompatibility issue localization, and 62.61% of 230 real-world incompatible projects resolved by LiResolver. We discuss the feedback from OSS developers and the lessons learned from this work. All the datasets and the replication package of LiResolver have been made publicly available to facilitate follow-up research.

show abstract

Section: License Incompatibility Detectionmentioning

confidence: 99%

LiResolver: License Incompatibility Resolution for Open Source Software

Gao

Fan

et al. 2023

Proceedings of the 32nd ACM SIGSOFT International Symposium on Software Testing and Analysis

View full text Add to dashboard Cite

show abstract

“…Many studies were conducted in the recent years regarding the use, evolution, and problems related to open source software licenses (Di Penta et al, 2010;Meloca et al, 2018;Vendome et al, 2018;Duan et al, 2017;Paschalides and Kapitsaki, 2016;. Most of these studies are related to their use and, possible implications and violations of such use.…”

Section: Related Workmentioning

confidence: 99%

“…Most of them are related to licensing inconsistencies and issues related when combining reusable artifacts from different sources. Several tools and methods were developed to check license inconsistencies to help developers avoid such issues (Duan et al, 2017;Paschalides and Kapitsaki, 2016;. Over the last two decades, some studies were conducted to comprehend the dual licensing model (Valimaki, 2003;Comino and Manenti, 2011;Koski, 2005).…”

Section: Related Workmentioning

confidence: 99%

From One to Hundreds: Multi-Licensing in the JavaScript Ecosystem

Moraes¹,

Polato²,

Wiese³

et al. 2020

Preprint

View full text Add to dashboard Cite

Open source licenses create a legal framework that plays a crucial role in the widespread adoption of open source projects. Without a license, any source code available on the internet could not be openly (re)distributed. Although recent studies provide evidence that most popular open source projects have a license, developers might lack confidence or expertise when they need to combine software licenses, leading to a mistaken project license unification. This license usage is challenged by the high degree of reuse that occurs in the heart of modern software development practices, in which third-party libraries and frameworks are easily and quickly integrated into a software codebase. This scenario creates what we call "multi-licensed" projects, which happens when one project has components that are licensed under more than one license. Although these components exist at the file-level, they naturally impact licensing decisions at the project-level.In this paper, we conducted a mix-method study to shed some light on these questions. We started by parsing 1,426,263 (source code and non-source code) files available on 1,552 JavaScript projects, looking for license information. Among these projects, we observed that 947 projects (61%) employ more than one license. On average, there are 4.7 licenses per studied project (max: 256). Among the reasons for multi-licensing is to incorporate the source code of third-party libraries into the project's codebase. When doing so, we ob-

show abstract