Service-based license verification of open source software

基于服务的开源软件许可验证

• 批准号: 512240-2017
• 负责人: Hindle, Abram
• 金额: $ 1.82万
• 依托单位: University of Alberta
• 依托单位国家: 加拿大
• 项目类别: Engage Grants Program
• 财政年份: 2017
• 资助国家: 加拿大
• 起止时间: 2017-01-01 至 2018-12-31
• 项目状态: 已结题
• 来源: https://www.nserc-crsng.gc.ca/ase-oro/Details-Detailles_eng.asp?id=640682
• 关键词: Service; based; license; verification; open

Open source developers create and share their code and tools for free. These projects are valuable to industry and open source developers alike because these projects solve common problems faced by both communities. Therefore, both groups have interest in the livelihood of open source projects which are supported by open source licenses. Open source license enable the distribution and sharing of source code in a safe and repeatable manner, but they come with complicated constraints. These licenses have implications on the projects that reuse open software that have them. Anyone can create an open source project but not everyone can evaluate project licensing issues. Therefore, it is not clear if a project is open source and license compliant. Black Duck software specializes in certifying that industrial partners are license compliant, but this functionality should be also made available to the open-source community who are ultimately concerned about. This means that reusing open source software in an industrial setting is not a simple task. The applications need to be verified-compliant in order to avoid any potential lawsuits or loss of user of the Open Source software, which is a costly process. Black Duck currently is an world leader in license compliance auditing. For smaller companies, it might not be possible to perform a license assessment to determine if they are infringing on open licenses or if they are required to abide requirements such as sharing their source code with clients. We wish to work with Black Duck to research different kinds of license verification techniques and help provide access to the fruits of this research as a web service and tools for the open source community. Canada's open source community will benefit from license compliance such services and tools to make code licensing more accessible to developers. We will build a web service that can check a given software repository for its licenses, informing open source developers of potential violations.

开源开发人员免费创建和共享他们的代码和工具。这些项目对行业和开源开发人员都很有价值，因为这些项目解决了两个社区面临的共同问题。因此，这两个群体都对开源项目的生计感兴趣，这些项目由开源许可证支持。开源许可证允许以安全和可重复的方式分发和共享源代码，但它们具有复杂的限制。这些许可证对重用拥有它们的开放软件的项目有影响。任何人都可以创建开源项目，但不是每个人都可以评估项目许可问题。因此，目前尚不清楚一个项目是否是开源和许可证兼容的。Black Duck软件专门认证工业合作伙伴符合许可证要求，但该功能也应该提供给最终关注的开源社区。这意味着在工业环境中重用开源软件并不是一项简单的任务。这些应用程序需要经过验证，以避免任何潜在的诉讼或开源软件用户的流失，这是一个昂贵的过程。Black Duck目前是许可证合规审计领域的全球领导者。对于较小的公司，可能无法进行许可评估，以确定他们是否侵犯了开放许可证，或者他们是否需要遵守与客户共享源代码等要求。我们希望与Black Duck合作，研究不同类型的许可证验证技术，并帮助开源社区提供访问此研究成果的Web服务和工具。加拿大的开源社区将受益于许可证合规性等服务和工具，使代码许可更容易为开发人员所用。我们将构建一个Web服务，可以检查给定的软件存储库的许可证，通知开源开发人员潜在的违规行为。