Improving License Compliance for Software Development

提高软件开发的许可合规性

• 批准号: RGPIN-2016-04105
• 负责人: German, Daniel
• 金额: $ 2.77万
• 依托单位: University of Victoria
• 依托单位国家: 加拿大
• 项目类别: Discovery Grants Program - Individual
• 财政年份: 2019
• 资助国家: 加拿大
• 起止时间: 2019-01-01 至 2020-12-31
• 项目状态: 已结题
• 来源: https://www.nserc-crsng.gc.ca/ase-oro/Details-Detailles_eng.asp?id=687137
• 关键词: Improving; License; Compliance; Software; Development

Free and Open Source Software (FOSS) is widely reused in industry. Broadly speaking, FOSS is software under a license that allows for its reuse and the creation of derivative works under a set of conditions. While reusing FOSS usually involves no monetary transaction, the organization reusing the software must comply with the conditions set by its license in order to have the right to reuse and redistribute the software.***Current licensing analysis assumes a one-size-fits-all model. It presumes that the legal constraints of building a system are universal and only need to be considered once. However, this is usually not the case due to a variety of legal and technical reasons: (a) the law regarding software varies across jurisdictions; (b) the legal constraints regarding software development are often ambiguous or untested and subject to interpretation; (c) many FOSS packages offer the ability to configure the build process in order to customize what parts of the systems are builtas a consequence, different "builds" of the same source code might have different legal constraints; and (d) FOSS provenance information is difficult to determineFOSS is often copied, renamed, moved, and it is not always easy to see where code originated, who the true copyright owner is, and when and how the code was copied into another system. ****The goal of this proposed research is to address these issues and create models and tools to assist developers and legal teams with license compliance. In particular, this grant will support the following research goals:***1. Perform empirical studies to understand the challenges of organizations wanting to reuse licensed components.***2. Develop a model and method that formalizes the evaluation of licensing compliance for software and a prototype to demonstrate its feasibility.***3. Develop methods and techniques to improve the discovery, traceability and management of the provenance of software artifacts, as well as build tools that implement them. *The management of license requirements of reusable components is a critical problem of industry for which there is a lack of research. The studies, models, methods and tools we propose will address this problem and will help industry improve its productivity by reducing the cost of the reuse of licensed components.**

自由开放源码软件(FOSS)在工业界得到了广泛的重用。一般而言，自由/开源软件是一种许可软件，允许其在一系列条件下重复使用和创建衍生作品。虽然重新使用自由/开源软件通常不涉及金钱交易，但重新使用软件的组织必须遵守其许可证设置的条件，才有权重新使用和重新分发软件。*当前的许可证分析假定是一刀切的模型。它假定，建立一个系统的法律约束是普遍存在的，只需考虑一次。然而，由于各种法律和技术原因，情况通常并非如此：(A)关于软件的法律因法域而异；(B)关于软件开发的法律约束往往含糊不清或未经测试，并受解释的影响；(C)许多自由和开放源码软件包提供了配置构建过程的能力，以便定制构建系统的哪些部分；因此，同一源代码的不同“构建”可能有不同的法律约束；以及(D)很难确定自由/开源软件的出处信息FOSS经常被复制、重命名、移动，而且并不总是很容易看出代码的来源，谁是真正的版权所有者，以及代码何时和如何被复制到另一个系统。*这项拟议研究的目标是解决这些问题，并创建模型和工具来帮助开发人员和法律团队遵守许可证。特别是，这笔赠款将支持以下研究目标：*1.进行实证研究，以了解希望重用许可组件的组织所面临的挑战。*2.开发正式评估软件许可符合性的模型和方法，以及演示其可行性的原型。*3.开发方法和技术，以改进软件构件的发现、可追溯性和来源管理，以及构建实现它们的工具。*可重复使用组件的许可要求管理是一个关键的行业问题，对此缺乏研究。我们提出的研究、模型、方法和工具将解决这一问题，并将通过降低许可组件的重复使用成本来帮助行业提高生产率。**