Improving License Compliance for Software Development

点击翻译按钮获取中文摘要

Free and Open Source Software (FOSS) is widely reused in industry. Broadly speaking, FOSS is software under a license that allows for its reuse and the creation of derivative works under a set of conditions. While reusing FOSS usually involves no monetary transaction, the organization reusing the software must comply with the conditions set by its license in order to have the right to reuse and redistribute the software. Current licensing analysis assumes a one-size-fits-all model. It presumes that the legal constraints of building a system are universal and only need to be considered once. However, this is usually not the case due to a variety of legal and technical reasons: (a) the law regarding software varies across jurisdictions; (b) the legal constraints regarding software development are often ambiguous or untested and subject to interpretation; (c) many FOSS packages offer the ability to configure the build process in order to customize what parts of the systems are built—as a consequence, different "builds" of the same source code might have different legal constraints; and (d) FOSS provenance information is difficult to determine—FOSS is often copied, renamed, moved, and it is not always easy to see where code originated, who the true copyright owner is, and when and how the code was copied into another system. The goal of this proposed research is to address these issues and create models and tools to assist developers and legal teams with license compliance. In particular, this grant will support the following research goals: 1. Perform empirical studies to understand the challenges of organizations wanting to reuse licensed components. 2. Develop a model and method that formalizes the evaluation of licensing compliance for software and a prototype to demonstrate its feasibility. 3. Develop methods and techniques to improve the discovery, traceability and management of the provenance of software artifacts, as well as build tools that implement them. The management of license requirements of reusable components is a critical problem of industry for which there is a lack of research. The studies, models, methods and tools we propose will address this problem and will help industry improve its productivity by reducing the cost of the reuse of licensed components.