Service-based license verification of open source software

点击翻译按钮获取中文摘要

Open source developers create and share their code and tools for free. These projects are valuable to industry and open source developers alike because these projects solve common problems faced by both communities. Therefore, both groups have interest in the livelihood of open source projects which are supported by open source licenses. Open source license enable the distribution and sharing of source code in a safe and repeatable manner, but they come with complicated constraints. These licenses have implications on the projects that reuse open software that have them. Anyone can create an open source project but not everyone can evaluate project licensing issues. Therefore, it is not clear if a project is open source and license compliant. Black Duck software specializes in certifying that industrial partners are license compliant, but this functionality should be also made available to the open-source community who are ultimately concerned about. This means that reusing open source software in an industrial setting is not a simple task. The applications need to be verified-compliant in order to avoid any potential lawsuits or loss of user of the Open Source software, which is a costly process. Black Duck currently is an world leader in license compliance auditing. For smaller companies, it might not be possible to perform a license assessment to determine if they are infringing on open licenses or if they are required to abide requirements such as sharing their source code with clients. We wish to work with Black Duck to research different kinds of license verification techniques and help provide access to the fruits of this research as a web service and tools for the open source community. Canada's open source community will benefit from license compliance such services and tools to make code licensing more accessible to developers. We will build a web service that can check a given software repository for its licenses, informing open source developers of potential violations.