Towards a comprehensive framework for verifying open-source software license compatibility
摘要
Open-source software forms the backbone of most contemporary software. Using and distributing open-source software requires compliance with the rights and obligations specified in its associated licenses. The software supply chains pose substantial challenges in maintaining license compliance due to complex code reuse and distribution patterns. While previous research has acknowledged the prevalence of license conflicts and conducted detailed studies on specific languages, a comprehensive approach for license compatibility analysis is still lacking. The implications of various scenarios, including interpreted and compiled languages, single and multi-licensing, license condition compatibility, and copyleft license, are yet to be fully understood. Moreover, creating an automated tool for accurately assessing the compatibility of the software supply chain remains a challenging task. To bridge this gap, we conducted an extensive empirical study on numerous licenses and open-source projects. Our research revealed that the impact of usage scenarios on license compatibility is widespread. We found that compatibility can significantly vary depending on the specific usage scenario, even within the same programming language. Moreover, such variations in compatibility are even more pronounced when comparing different programming languages. Based on these insights, we propose a unified framework for license compatibility analysis across various scenarios, focusing on the passive license propagation mechanism within binary distribution. Leveraging this framework, we developed the LiScopeLens-Plus tool, which can resolve license propagation issues in any dependency construction graph and subsequently perform accurate license compatibility analysis on the propagation results of each node in the graph. Our extensive real-world verifications on OpenHarmony have uncovered numerous previously unidentified license conflicts.