flict (FOSS License Compatibility Tool) can check if the license of your software, and its dependencies, are compatible and if they are in line with your license policy. This presentation will show you how to get started with flict, check a project for license compatibility, apply a license policy, how to get a graph of the compatibility between licenses in your project and finally show how a package, and its dependencies, as built with Yocto can be checked for compatibility.

1. Flict
FOSS License
Compatibility Tool

2. I am not a lawyer

3. I am a developer

4. ... doing compliance and FOSS
related things for work
and privately

5. Let’s go

6. FOSS Licenses
●
Attribute copyright holders (most)
●
Display license/text (most)
●
Disclose source code (some)

7. FOSS Licenses
●
Accumulative MIT AND GPL-2.0-only
●
Dual MIT OR GPL-2.0-only

8. FOSS Licenses - Compliance
●
Attribute copyright holders
●
Display license/text
●
Disclose source code
●
Verify license compatibility

9. FOSS Licenses - Compatibility
The terms of all of the licenses in a combined
work must be compatible

10. License compatibility
Coding it

11. License compatibility - terms
Sounded easy

12. License compatibility - terms
Was easy

13. License compatibility - terms
Was easy … at first

14. License compatibility - graphs
1

15. License compatibility - graphs
MPL-2.0 Apache-2.0 GPL-2.0-or-later LGPL-2.1-or-later MIT BSD Python-2.0 MPL-1.1 Libpng X11 EPL-2.0
Image generated using flict and graphviz

16. License compatibility - matrix

17. Introducing flict
●
flict checks compatibility between
two licenses (at a time)
●
Handles dependencies / “linked”
software
– checks compatibility for all licenses
in the combined work

18. Introducing flict
$ flict -h
usage: flict [-h] [-gf LICENSE_GROUP_FILE] [-mf MATRIX_FILE]
[-rf RELICENSE_FILE] [-sf SCANCODE_FILE]
[-tf TRANSLATIONS_FILE] [-es] [-el] [-nr] [-o OUTPUT]
[-of OUTPUT_FORMAT] [-v] [-cc LICENSES [LICENSES ...]]
[-ol OUTBOUND_LICENSES] [-V] [-dl]
{verify,simplify,list,display-compatibility,outbound-candidate,
policy-report}

19. Introducing flict
●
Commands:
– verify
– simplify
– list
– display-compatibility
– outbound-candidate (suggestions only)
– policy-report
●
Relicense (GPL-2.0-or-later)
●
Alias/translations (GPLv2+ → GPL-2.0-or-later)

20. Introducing flict – output format
$ jq . ~/.flict.cfg
{
"output-format": "text"
}
●
JSON
●
text (partially)
●
markdown (partially)
●
dot (only for display-compatibility)

21. Introducing flict - simplify
Simplify
BSD-3-Clause or MIT or MIT and MIT

22. Introducing flict - simplify
$ flict simplify BSD-3-Clause or MIT or MIT and MIT
BSD-3-Clause OR MIT

23. Introducing flict
Display compatibility
Apache-2.0 GPL-3.0-only MIT

24. Introducing flict - compatibility
$ flict -of markdown display-compatibility Apache-2.0 GPL-3.0-only MIT
# License compatibilities
# Licenses
* GPL-3.0-only
* MIT
* Apache-2.0
# Compatibilities
GPL-3.0-only |-----> MIT
GPL-3.0-only |-----> Apache-2.0
MIT <-------| GPL-3.0-only
MIT <-------> Apache-2.0
Apache-2.0 <-------| GPL-3.0-only
Apache-2.0 <-------> MIT
… or perhaps more visually

25. Introducing flict - compatibility
$ flict -of dot display-compatibility Apache-2.0 GPL-3.0-only MIT MPL-2.0 BSD |
dot -Tpng -o compats.png

26. Introducing flict - outbound
Outbound candidates
GPL-2.0-or-later AND MIT

27. Introducing flict - outbound
$ flict outbound-candidate GPL-2.0-or-later AND MIT
GPL-2.0-or-later, GPL-3.0-or-later
# no relicensing: -nr
$ flict -nr outbound-candidate GPL-2.0-or-later AND MIT
GPL-2.0-or-later

28. Introducing flict
Verify compatibility
Apache-2.0 AND GPL-3.0-only AND MIT

29. Introducing flict - verify
$ flict verify -le Apache-2.0 AND GPL-3.0-only AND MIT
The licenses in the expression "Apache-2.0 AND GPL-3.0-only AND MIT"
are compatible.
Outbound license candidates: GPL-3.0-only
NOTE: the suggested outbound candidate licenses need to be manually
reviewed.

30. Introducing flict - verify
$ flict verify -le Apache-2.0 AND GPL-2.0-only
The licenses in the expression "Apache-2.0 AND GPL-2.0-only" are not
compatible.
No outbound license candidate could be identified due to license
incompatibility.

31. Diving deeper in to flict
Verifying projects
fontconfig

32. flict - projects
Image generated from a Yocto build using https://github.com/vinland-technology/compliance-utils

33. flict - projects
JSON
fontconfig.json

34. flict - projects
$ flict -of json verify -pf fontconfig.json
{"meta": {"os": "Linux", "osRelease": "5.12.9-300.fc34.x86_64", "osVersion": "#1 SMP Thu Jun 3 13:51:40 UTC 2021", "machine": "x86_64", "host": "schoenberg", "user": "hesa", "start": "2021-11-06 12:10:33.583356"}, "projec
"fontconfig_libfontconfig.so.1.12.0-tree-flict.json", "project_definition": {"name": "libfontconfig.so.1.12.0", "package": "fontconfig", "subPackage": "fontconfig", "license": " MIT & MIT", "version": "2.13.1", "dependencies": [{"name
"component": "libfreetype.so.6", "version": "2.10.2", "license": " FreeType | GPLv2+", "valid": true, "dependencies": [{"name": "libpng", "component": "libpng16.so.16", "version": "1.6.37", "license": " Libpng", "valid": true, "depen
[{"name": "zlib", "component": "libz.so.1", "version": "1.2.11", "license": " Zlib", "valid": true, "dependencies": []}]}, {"name": "zlib", "component": "libz.so.1", "version": "1.2.11", "license": " Zlib", "valid": true, "dependencies": []}]},
"expat", "component": "libexpat.so.1", "version": "2.2.9", "license": " MIT", "valid": true, "dependencies": []}, {"name": "util-linux", "component": "libuuid.so.1", "version": "2.35.2", "license": " BSD-3-Clause", "valid": true, "depend
"project_pile": [{"name": "libfontconfig.so.1.12.0", "license": " MIT & MIT", "version": "2.13.1", "dependencies": [], "expanded_license": {"expanded": "MIT", "grouped": "MIT", "simplified": "MIT", "set_list": [["MIT"]]}}, {"name": "fre
"license": " FreeType | GPLv2+", "version": "2.10.2", "dependencies": [], "expanded_license": {"expanded": "FTL OR ( GPL-3.0-only OR GPL-2.0-only )", "grouped": "FTL OR ( GPL-3.0-only OR GPL-2.0-only )", "simplified": "
2.0-or-later", "set_list": [["FTL"], ["GPL-3.0-only"], ["GPL-2.0-only"]]}}, {"name": "libpng", "license": " Libpng", "version": "1.6.37", "dependencies": [], "expanded_license": {"expanded": "Libpng", "grouped": "Libpng", "simplified":
"set_list": [["Libpng"]]}}, {"name": "zlib", "license": " Zlib", "version": "1.2.11", "dependencies": [], "expanded_license": {"expanded": "Zlib", "grouped": "Zlib", "simplified": "Zlib", "set_list": [["Zlib"]]}}, {"name": "zlib", "license": " Zlib
"1.2.11", "dependencies": [], "expanded_license": {"expanded": "Zlib", "grouped": "Zlib", "simplified": "Zlib", "set_list": [["Zlib"]]}}, {"name": "expat", "license": " MIT", "version": "2.2.9", "dependencies": [], "expanded_license": {"e
"grouped": "MIT", "simplified": "MIT", "set_list": [["MIT"]]}}, {"name": "util-linux", "license": " BSD-3-Clause", "version": "2.35.2", "dependencies": [], "expanded_license": {"expanded": "BSD-3-Clause", "grouped": "BSD-3-Clause
"BSD-3-Clause", "set_list": [["BSD-3-Clause"]]}}]}, "compatibility_report": {"license": " MIT & MIT", "license_pile": ["GPL-3.0-only", "Zlib", "FTL", "BSD-3-Clause", "MIT", "GPL-2.0-only", "Libpng"], "compatibilities": {"license_com
[{"outbound": "GPL-3.0-only", "combinations": [{"combination": [{"name": "libfontconfig.so.1.12.0", "license": ["MIT"], "version": "2.13.1"}, {"name": "freetype", "license": ["FTL"], "version": "2.10.2"}, {"name": "libpng", "license": ["
"version": "1.6.37"}, {"name": "zlib", "license": ["Zlib"], "version": "1.2.11"}, {"name": "zlib", "license": ["Zlib"], "version": "1.2.11"}, {"name": "expat", "license": ["MIT"], "version": "2.2.9"}, {"name": "util-linux", "license": ["BSD-3-Cla
"2.35.2"}], "compatibility_fails": [], "compatibility_status": true}, {"combination": [{"name": "libfontconfig.so.1.12.0", "license": ["MIT"], "version": "2.13.1"}, {"name": "freetype", "license": ["GPL-3.0-only"], "version": "2.10.2"}, {"na
"license": ["Libpng"], "version": "1.6.37"}, {"name": "zlib", "license": ["Zlib"], "version": "1.2.11"}, {"name": "zlib", "license": ["Zlib"], "version": "1.2.11"}, {"name": "expat", "license": ["MIT"], "version": "2.2.9"}, {"name": "util-linux", "
3-Clause"], "version": "2.35.2"}], "compatibility_fails": [], "compatibility_status": true}, {"combination": [{"name": "libfontconfig.so.1.12.0", "license": ["MIT"], "version": "2.13.1"}, {"name": "freetype", "license": ["GPL-2.0-only"], "ve
{"name": "libpng", "license": ["Libpng"], "version": "1.6.37"}, {"name": "zlib", "license": ["Zlib"], "version": "1.2.11"}, {"name": "zlib", "license": ["Zlib"], "version": "1.2.11"}, {"name": "expat", "license": ["MIT"], "version": "2.2.9"}, {"n
"license": ["BSD-3-Clause"], "version": "2.35.2"}], "compatibility_fails": [], "compatibility_status": true}], "compatibility_status": true}, {"outbound": "Zlib", "combinations": [{"combination": [{"name": "libfontconfig.so.1.12.0", "licens
"version": "2.13.1"}, {"name": "freetype", "license": ["FTL"], "version": "2.10.2"}, {"name": "libpng", "license": ["Libpng"], "version": "1.6.37"}, {"name": "zlib", "license": ["Zlib"], "version": "1.2.11"}, {"name": "zlib", "license": ["Zlib"]
"1.2.11"}, {"name": "expat", "license": ["MIT"], "version": "2.2.9"}, {"name": "util-linux", "license": ["BSD-3-Clause"], "version": "2.35.2"}], "compatibility_fails": [], "compatibility_status": true}, {"combination": [{"name": "libfontconfi
"license": ["MIT"], "version": "2.13.1"}, {"name": "freetype", "license": ["GPL-3.0-only"], "version": "2.10.2"}, {"name": "libpng", "license": ["Libpng"], "version": "1.6.37"}, {"name": "zlib", "license": ["Zlib"], "version": "1.2.11"}, {"nam
"license": ["Zlib"], "version": "1.2.11"}, {"name": "expat", "license": ["MIT"], "version": "2.2.9"}, {"name": "util-linux", "license": ["BSD-3-Clause"], "version": "2.35.2"}], "compatibility_fails": [], "compatibility_status": true}, {"combina
"libfontconfig.so.1.12.0", "license": ["MIT"], "version": "2.13.1"}, {"name": "freetype", "license": ["GPL-2.0-only"], "version": "2.10.2"}, {"name": "libpng", "license": ["Libpng"], "version": "1.6.37"}, {"name": "zlib", "license": ["Zlib"],
"1.2.11"}, {"name": "zlib", "license": ["Zlib"], "version": "1.2.11"}, {"name": "expat", "license": ["MIT"], "version": "2.2.9"}, {"name": "util-linux", "license": ["BSD-3-Clause"], "version": "2.35.2"}], "compatibility_fails": [], "compatibility
"compatibility_status": true}, {"outbound": "FTL", "combinations": [{"combination": [{"name": "libfontconfig.so.1.12.0", "license": ["MIT"], "version": "2.13.1"}, {"name": "freetype", "license": ["FTL"], "version": "2.10.2"}, {"name": "l
["Libpng"], "version": "1.6.37"}, {"name": "zlib", "license": ["Zlib"], "version": "1.2.11"}, {"name": "zlib", "license": ["Zlib"], "version": "1.2.11"}, {"name": "expat", "license": ["MIT"], "version": "2.2.9"}, {"name": "util-linux", "license": [
Clause"], "version": "2.35.2"}], "compatibility_fails": [], "compatibility_status": true}, {"combination": [{"name": "libfontconfig.so.1.12.0", "license": ["MIT"], "version": "2.13.1"}, {"name": "freetype", "license": ["GPL-3.0-only"], "vers
{"name": "libpng", "license": ["Libpng"], "version": "1.6.37"}, {"name": "zlib", "license": ["Zlib"], "version": "1.2.11"}, {"name": "zlib", "license": ["Zlib"], "version": "1.2.11"}, {"name": "expat", "license": ["MIT"], "version": "2.2.9"}, {"n
"license": ["BSD-3-Clause"], "version": "2.35.2"}], "compatibility_fails": [], "compatibility_status": true}, {"combination": [{"name": "libfontconfig.so.1.12.0", "license": ["MIT"], "version": "2.13.1"}, {"name": "freetype", "license": ["G
"version": "2.10.2"}, {"name": "libpng", "license": ["Libpng"], "version": "1.6.37"}, {"name": "zlib", "license": ["Zlib"], "version": "1.2.11"}, {"name": "zlib", "license": ["Zlib"], "version": "1.2.11"}, {"name": "expat", "license": ["MIT"], "v
{"name": "util-linux", "license": ["BSD-3-Clause"], "version": "2.35.2"}], "compatibility_fails": [], "compatibility_status": true}], "compatibility_status": true}, {"outbound": "BSD-3-Clause", "combinations": [{"combination": [{"name":
"libfontconfig.so.1.12.0", "license": ["MIT"], "version": "2.13.1"}, {"name": "freetype", "license": ["FTL"], "version": "2.10.2"}, {"name": "libpng", "license": ["Libpng"], "version": "1.6.37"}, {"name": "zlib", "license": ["Zlib"], "version"
{"name": "zlib", "license": ["Zlib"], "version": "1.2.11"}, {"name": "expat", "license": ["MIT"], "version": "2.2.9"}, {"name": "util-linux", "license": ["BSD-3-Clause"], "version": "2.35.2"}], "compatibility_fails": [], "compatibility_status":

35. flict - projects
$ flict verify -pf fontconfig.json | jq -r .licensing
{
"outbound_candidates": [
"BSD-3-Clause",
"FTL",
"GPL-2.0-only",
"GPL-3.0-only",
"Libpng",
"MIT",
"Zlib"
]
}

36. … a bit deeper
Applying policy
●
allow
●
avoid
●
deny

37. flict - policy
# example policy - flict-policy.json
{
"policy": {
"avoidlist": [
"Libpng"
],
"denylist": [
"FTL", "GPL-3.0-or-later"
]
}
}

38. flict - projects
JSON
fontconfig.json
JSON
fontconfig-report.json
flict verify
JSON
flict-policy.json
JSON
flict policy-report

39. flict - policy
# verify, store report
$ flict -o fontconfig-report.json verify -pf fontconfig.json
# apply policy (to the report)
$ flict policy-report -crf fontconfig-report.json -lpf flict-policy.json

40. flict - policy
$ flict policy-report -crf fontconfig-report.json -lpf flict-policy.json | jq .policy_outbounds
{
"allowed": [
"Zlib",
"BSD-3-Clause",
"MIT",
"GPL-2.0-only",
"GPL-3.0-only"
],
"avoid": [
"Libpng"
]
"denied": [
"FTL"
],
"policy_result": 0
}
0 – compatible, with allowed licenses
Suggested outbound licenses,
allowed by policy
0 – compatible, with allowed licenses
Suggested outbound licenses,
avoided by policy
Suggested outbound licenses,
denied by policy

41. flict – bigger projects
●
Epiphany
– Plain Yocto + Epiphany
– Build and analyse epiphany to identify
dependencies

43. flict – bigger projects
Dependency tree has 1145 OR (|) statements
●
2^1145 combinations
●
47790880853786773025025307593129474069637354487063124257965154352281
01390319684243889598745168591546274675352099492894261285860027737199
26955731381954770513172378695089692359789920181226687143746969162594
85803064131342014120963827022693853247109392847578001538964659274706
87703399660312352581695982025565426761424466315198692552978000735706
80832 combinations

44. flict – bigger projects
●
Dependency tree has 1145 OR (|) statements
– 2^1145 combinations
– 47790880853786773025025307593129474069637354487063124257965154352281
01390319684243889598745168591546274675352099492894261285860027737199
26955731381954770513172378695089692359789920181226687143746969162594
85803064131342014120963827022693853247109392847578001538964659274706
87703399660312352581695982025565426761424466315198692552978000735706
80832 combinations
●
Flatten the dependency tree
●
75 deps 9 combinations

45. flict
Yocto build
●
identify packages
●
for each package
– identify dependencies
– (c)
– License
– create flict project files
– check compatibility
“Can we use this and
that software?”

46. flict – SBoM (SPDX)
Verify SBoM (SPDX 2.2, JSON) with
dependencies (relationships)
Not straight out of the box,
but with spdx-validator

47. flict – SBoM (SPDX)
$ spdx-validator -r freetype-2.9.spdx.json -pp -f flict -pn libfreetype > freetype-
flict.json
$ flict verify -pf freetype-flict.json | jq -r .licensing
{
"outbound_candidates": [
"FTL",
"GPL-2.0-only",
"GPL-3.0-only",
"Libpng",
"Zlib"
]
}

48. flict – in the making
●
One more attempt at codifying the terms – possibly starting with OSADL’s work
●
Looking at defining classifications (groups) and using Scancode’s license database
– e.g. “Permissive”
$ flict -of text -es list | grep Permissive | wc -l
731
●
Possible integration with other tools :)
●
Verify RPM
rpm2flict.sh cairo | jq ….
GPL-2.0-or-later
GPL-3.0-or-later

49. Problems with licenses
●
a project license is not always correct on the
homepage or in the LICENSE file - you need to
check for yourself
●
a project can consist of many packages (e.g
Cairo has libcairo2, libcairo-gobject2 ...) not
always under the same license
●
dependencies not always easy to find - may need
to be identified during build

50. Attributions
(c) 2021 Jens Reuterberg
https://github.com/hesa/flict-graphics/blob/master/flict-logo.svg
GPL-3.0-or-later
Edvard Munch - WebMuseum at ibiblioPage: http://www.ibiblio.org/wm/paint/auth/munch/Image
URL: http://www.ibiblio.org/wm/paint/auth/munch/munch.scream.jpg,
Public Domain, https://commons.wikimedia.org/w/index.php?curid=37610298
1
Copyright © 2007, 2008, 2010, 2013, 2014 Free Software Foundation, Inc.
https://www.gnu.org/licenses/quick-guide-gplv3.html
Creative Commons Attribution-NoDerivs 3.0 United States License.
Copyright David A. Wheeler
https://dwheeler.com/essays/floss-license-slide.html
Creative Commons “Attribution-Share Alike 3.0 License”; the GNU Free Documentation License;
or the GNU GPL (version 2 or later)
(c) Henrik Sandklef
https://www.flickr.com/photos/63114905@N06/50530717602/
Attribution-ShareAlike 2.0 Generic (CC BY-SA 2.0)

51. download / contribute
●
https://github.com/vinland-technology/flict
●
contributions welcome (via Pull requests)