1. Management of open
source licenses...
Freddy Munoz
Antelink
freddy.munoz@antelink.com
twitter: @drfmunoz
Antelink S.A.S - 2011

2. Antelink

3. Antelink

4. Antelink
Open Source
Management

5. Antelink team of 7

6. “The world’s largest
knowledge base”
1M+ projects
500M+ files
1K+ new projects
Antepedia every day
44Tb+ data files

7. Why open source?
thousands of
enterprise-ready
open source projects

8. Why open source?
thousands of
enterprise-ready
open source projects

9. Why open source?
thousands of
enterprise-ready
open source projects

10. Why open source?
thousands of
enterprise-ready
open source projects
80% of companies
reuse open source software

11. Why caring
about license
issues?

12. Why caring
about license
issues?
Why is it hard to handle licenses?

13. 1 Respect the author’s
wishes
I want it to be
GPL… or LGPL…
or BSD

14. 2 License data may not
be reliable
Open Source Product
http://ossproduct.com Google
Open Source Product
LGPL
License
Agreement
Product
Product
Open Source Product shipped with the EPL
license
GPL V2

15. Licenses change over time

16. Licenses change over time

17. License data
may be
http://jwebmail.sourceforge.net/news.html
inconsistent
http://jwebmail.sourceforge.net/about.html
http://sourceforge.net/projects/jwebmail/

18. License data
may be
http://jwebmail.sourceforge.net/news.html
inconsistent
http://jwebmail.sourceforge.net/about.html
http://sourceforge.net/projects/jwebmail/

19. License data
may be
http://jwebmail.sourceforge.net/news.html
inconsistent
http://jwebmail.sourceforge.net/about.html
http://sourceforge.net/projects/jwebmail/

20. License data
may be
http://jwebmail.sourceforge.net/news.html
inconsistent
http://jwebmail.sourceforge.net/about.html
http://sourceforge.net/projects/jwebmail/

21. 3 Non compliance =
Serious implications
Material loss
IP violation
Lawsuits
Devaluation Injunctions

22. The BusyBox case

23. BusyBox included in
the firmware
GPLv2
Firmware BusyBox

24. Westinghouse includes
BusyBox into its HDTV
firmware
HDTV

25. BusyBox fills a lawsuit
against Westinghouse
v/s
December 14th 2009

26. Settlement: Westinghouse
assessed damages,
lost revenue,and lost
inventory
August 3rd 2010 - Settlement: Westinghouse assessed $150.000 in damages , lost
revenue, and millions of dollars of inventory lost (all HDTV were donated to charity)

27. How to
handle this
(issue)?

28. Three approaches
Tool based proactive
Tool based reactive
Manual

29. Manual
Approach

30. Keep track of components
Product

31. Keep track of components
Product

32. Maintain a list of licenses...
check it manually
Product

33. Maintain a list of licenses...
check it manually
Product
Components Checklist

34. The Problem:
too time consuming
Work
Tracking
licenses

35. Tool
Approach :
Reactive

36. You build your software
Heuristics
specs
Developer

37. You build your software
Heuristics
specs
Product
Developer Software factory Final product

38. Someone
audits your software
Product
$$

39. Someone
audits your software
Product
component A …………… GPL
component B…………….BSD
$$

40. License issue = re-develop
$$
Heuristics
specs
Product
Developer Software factory Final product

41. License issue = re-develop
$$
component A …………… GPL
component B…………….BSD
Product
Heuristics
specs
Product
Developer Software factory Final product

42. The problem:
you already
built the
software...

43. Tool
Approach :
Proactive

44. You build your software
Heuristics
specs
Product
Developer Software factory Final product

45. Iteratively detect license
data
Heuristics
specs
Developer

46. Iteratively detect license
data
Heuristics
specs
Developer
Open Source report

47. Iteratively detect license
data
Heuristics
specs
Developer Software factory
Open Source report

48. Iteratively detect license
data
Heuristics
specs
Developer Software factory
Open Source report Open Source report

49. Iteratively detect license
data
Heuristics
specs
Product
Developer Software factory Final product
Open Source report Open Source report

50. Iteratively detect license
data
Heuristics
specs
Product
Developer Software factory Final product
Open Source report Open Source report Open Source report

51. For example.... in your
Git repo
Heuristics
specs
Developer

52. For example.... in your
Git repo
Heuristics
specs
Developer

53. For example.... in your
Git repo
Heuristics
specs
Developer

54. For example.... in your
Git repo
Heuristics
specs
Developer
Open Source report

55. For example.... on your
IDE
Filename License Version Project
antlr-3.jar BSD 3.0 Antlr
commons-logging.jar Apache License 2.0 1.3 Commons Logging
TestCase.java CPL 1.0 - Junit
new_wizard_back.gif CPL 1.0 - EPIC

56. This empowers
everyone to
comply with licenses

57. It’s like bug detection...
early is better
license orvulnerability issue
Remediation cost of a
cost $
Deploy
Deliver
Code Test & Build Package
Lifecycle phase
Heuristics
specs
Product
Developer Software factory Final product Production environment

58. Prevention
instead of
correction

59. Tools
Antepedia Heuristics
specs
GoogleCode
Debian
CodePlex
55%
Maven Central 4%
Eclipse 5%
Apache Arch
Product
Other
JBoss
SourceForge
31%

60. ?