Tracing software build processes to uncover license compliance inconsistencies
Abstract
Open Source Software (OSS) components form the basis for many software systems. While the use of OSS components accelerates development, client systems must comply with the license terms of the OSS components that they use. Failure to do so exposes client system distributors to possible litigation from copyright holders. Yet despite the importance of license compliance, tool support for license compliance assessment is lacking. In this paper, we propose an approach to construct and analyze the Concrete Build Dependency Graph (CBDG) of a software system by tracing system calls that occur at build-time. Through a case study of seven open source systems, we show that the constructed CBDGs: (1) accurately classify sources as included in or excluded from deliverables with 88%-100% precision and 98%-100% recall, and (2) can uncover license compliance inconsistencies in real software systems -- two of which prompted code fixes in the CUPS and FFmpeg systems.
BibTeX
@inproceedings{vanderBurg-al:ASE14,
author = {Sander van der Burg and
Eelco Dolstra and
Shane McIntosh and
Julius Davies and
Daniel M. Germ{\'{a}}n and
Armijn Hemel},
title = {Tracing software build processes to uncover license compliance inconsistencies},
booktitle = {ASE},
pages = {731--742},
publisher = {{ACM}},
year = {2014},
}