SEKE 2012 Proceedings - Knowledge Systems Institute

Choosing licenses in free open source software
Ioannis E. Foukarakis
Department of Telecommunications
Science and Technology
University of Peloponnese
Tripolis, Greece
Georgia M. Kapitsaki
Department of Computer Science
University of Cyprus
Nicosia, Cyprus
Nikolaos D. Tselikas
Department of Telecommunications
Science and Technology
University of Peloponnese
Tripolis, Greece
Abstract—Free/Libre/Open Source Software (FLOSS) has been
lately on the focus of the software community in the attempt to
provide wide access to software resources and promote their
distribution. Open software resources may be linked directly or
indirectly with more than one open source licenses. Due to license
heterogeneity, incompatibilities may arise in such dependencies.
For this reason, adequate support for decision making in license
use is an important issue. Such systems can assist in determining
the right licenses and avoid potential violations. We tackle the
above aspects by giving an overview of the areas of license
extraction from software resources, license information storing
and license-related reasoning activities. We discuss about several
attempts in these areas and present an initial prototype assistance
system employing such techniques.
Keywords- data dependencies; licensing; open source software
I. INTRODUCTION
Free/Libre/Open Source Software (FLOSS) [1] has
influenced modern software engineering processes, allowing
individuals to use software for free and software engineers to
incorporate third party software libraries in their software
products and implementations. The terms, under which the
software has become available and is provided for use to the
community, are captured in the licenses that accompany open
source software. Licenses correspond to the characteristics of
the intellectual property and usually express the rights and the
obligations of the copyright owner and the one using the
license (referred to as the licensee). Many different licenses
have appeared: GNU General Public License (GPL), Apache
License, BSD License, MIT License to name a few. Licenses
fall into three main categories: permissive, weak copyleft or
strong copyleft, showing different degrees of freedom in
FLOSS use. The first category of permissive licenses states that
licensed software can be adopted even in commercial software
that is not distributed as open so urce. On the contrary, weak
copyleft licenses demand that any changes in the licenses
source code should be made available as open source software
itself, whereas strong copyleft licenses mandate that any kind
of further distribution be under open source principles.
Each license may have multiple versions making it difficult
for developers to cope with incompatibilities that might exist
due to the use of software libraries based on different licenses.
Especially during the development phase, it is often the case
that engineers include additional, and often redundant,
dependencies in their code light-hearted, without examining
possible licensing incompatibilities. As the number of
components increases, so does the complexity of deciding
which licenses can be applied to the final system, or of
checking if violations exist among the terms defined in the
licenses, leading to license incompatibility. Lindberg [2]
describes license compatibility as a sim ilar approach with
blood type compatibility: “two blood types are compatible if
donations from two different people can be used together.” In
the same way, licenses are compatible if software distributed
under two different licenses can be used together in the same
software product. Although no mature software for supporting
decisions in license issues is available, many research activities
and commercial efforts have recently appeared.
The current paper provides an overview of the aspects of
license decisions by presenting the process of license
compatibility detection that can be divided into the areas of
license extraction information from software resources, license
information storing, as well as modeling and reasoning actions.
Some techniques are applied on the implementation of a
prototype system extending a popular build tool. The rest of the
paper is structured as follows. Section II briefly presents the
steps of the license compatibilities process. Section III
discusses works on extracting license information from existing
components, whereas section IV is dedicated to the
presentation of repository-based approaches. In section V ways
for discovering licenses are presented. An initial prototype
implementation of the compatibility detection is demonstrated
in section VI. Finally, section VII concludes the paper.
II. THE LICENSE COMPATIBILITY PROCESS
Each software system is comprised of individual artifacts
that may include source code, compiled programs, software
libraries or other file types (i.e., images, multimedia files and
data in general). An abstract model of the software includes the
distinct artifacts and the way these are connected through the
development process. For instance, a source code file may hold
references to other source code files or libraries. In turn, the
compiled version of the source code may have static or
dynamic references to software libraries and so on.
The generic approach that can be followed for detecting
license incompatibilities is depicted in Fig. 1. The first step
towards making a decision for possible open source licenses is
to identify the individual components of the software system.
Afterwards, different license extraction techniques may be
applied to detect the license of each artifact, varying from text
matching to querying license repositories. In fact, the same
200