Improving License Compliance for Software Development

提高软件开发的许可合规性

• 批准号: RGPIN-2016-04105
• 负责人: German, Daniel
• 金额: $ 2.77万
• 依托单位: University of Victoria
• 依托单位国家: 加拿大
• 项目类别: Discovery Grants Program - Individual
• 财政年份: 2016
• 资助国家: 加拿大
• 起止时间: 2016-01-01 至 2017-12-31
• 项目状态: 已结题
• 来源: https://www.nserc-crsng.gc.ca/ase-oro/Details-Detailles_eng.asp?id=614839
• 关键词: Improving; License; Compliance; Software; Development

Free and Open Source Software (FOSS) is widely reused in industry. Broadly speaking, FOSS is software under a license that allows for its reuse and the creation of derivative works under a set of conditions. While reusing FOSS usually involves no monetary transaction, the organization reusing the software must comply with the conditions set by its license in order to have the right to reuse and redistribute the software. Current licensing analysis assumes a one-size-fits-all model. It presumes that the legal constraints of building a system are universal and only need to be considered once. However, this is usually not the case due to a variety of legal and technical reasons: (a) the law regarding software varies across jurisdictions; (b) the legal constraints regarding software development are often ambiguous or untested and subject to interpretation; (c) many FOSS packages offer the ability to configure the build process in order to customize what parts of the systems are built—as a consequence, different "builds" of the same source code might have different legal constraints; and (d) FOSS provenance information is difficult to determine—FOSS is often copied, renamed, moved, and it is not always easy to see where code originated, who the true copyright owner is, and when and how the code was copied into another system. The goal of this proposed research is to address these issues and create models and tools to assist developers and legal teams with license compliance. In particular, this grant will support the following research goals: 1. Perform empirical studies to understand the challenges of organizations wanting to reuse licensed components. 2. Develop a model and method that formalizes the evaluation of licensing compliance for software and a prototype to demonstrate its feasibility. 3. Develop methods and techniques to improve the discovery, traceability and management of the provenance of software artifacts, as well as build tools that implement them. The management of license requirements of reusable components is a critical problem of industry for which there is a lack of research. The studies, models, methods and tools we propose will address this problem and will help industry improve its productivity by reducing the cost of the reuse of licensed components.

自由和开放源码软件（FOSS）在工业界得到广泛的重用。从广义上讲，自由和开放源码软件是一种许可证下的软件，允许在一系列条件下重复使用和创造衍生作品。虽然自由和开放源码软件的再利用通常不涉及金钱交易，但再利用软件的组织必须遵守其许可证规定的条件，才有权再利用和再分发软件。 目前的许可证分析假设了一种通用模式。它假定建立一个系统的法律的约束是普遍的，只需要考虑一次。然而，由于各种法律的和技术原因，情况通常并非如此：（a）有关软件的法律因法域而异;（B）有关软件开发的法律的限制往往含糊不清或未经检验，并可作不同的解释;（c）许多自由和开放源码软件包提供配置构建过程的能力，以便定制构建系统的哪些部分-因此，同一源代码的不同“版本”可能有不同的法律的限制;（d）自由和开放源码软件的出处信息难以确定-自由和开放源码软件经常被复制、改名、转移，而且并不总是容易看出代码的出处、谁是真正的版权所有人、以及代码何时和如何被复制到另一个系统。 这项研究的目标是解决这些问题，并创建模型和工具，以帮助开发人员和法律的团队遵守许可证。特别是，这笔赠款将支持以下研究目标： 1.执行实证研究，以了解想要重用许可组件的组织所面临的挑战。 2.开发一个模型和方法，正式评估软件的许可证合规性，并开发一个原型来证明其可行性。 3.开发方法和技术来改进软件工件来源的发现，可追溯性和管理，以及构建实现它们的工具。 可复用构件的许可证管理是一个重要的工业问题，但目前还缺乏相关的研究。我们提出的研究、模型、方法和工具将解决这个问题，并通过降低许可组件的重复使用成本来帮助行业提高生产率。