This document discusses using build systems to uncover license compliance inconsistencies. It describes how build systems can be traced to construct dependency graphs and annotate components with license information. An empirical study found the approach accurately discovered inconsistencies with 88-100% precision and 98-100% recall. The technique prompted code changes in two systems within a few days to resolve license issues uncovered.

1. Tracing Software Build
Processes to Uncover License
Compliance Inconsistencies
Shane
McIntosh
Sander van
der Burg
Eelco
Dolstra
Julius
Davies
Daniel M.
Germán
Armijn
Hemel
Tjaldur
Software Governance
Solutions
@shane_mcintosh

2. Source
code
What is a build system?

3. Source
code
Deliverable
What is a build system?

4. .tex
.c
.cc
.o
.o
.dvi
.a
.exe
.pdf
.deb
Build systems describe how sources are
translated into deliverables
3

5. Continuous Integration:
Enabled by the
build system
4
.c .mk

6. Continuous Integration:
Enabled by the
build system
Commit
4
Commit
9719cf0
.c .mk

7. Continuous Integration:
Enabled by the
build system
Commit
4
Build
Commit
9719cf0
.c .mk

8. Continuous Integration:
Enabled by the
build system
Commit
4
Build
Test
Commit
9719cf0
.c .mk

9. Continuous Integration:
Enabled by the
build system
Commit
4
Build
Test
Report
Commit
9719cf0 wassuccessfullyintegrated
Commit
9719cf0
.c .mk

10. Continuous Integration:
Enabled by the
build system
Commit
4
Build
Test
Report
Commit
9719cf0 wassuccessfullyintegrated
Commit
9719cf0
.c .mk

11. 5
There [is] no
such thing as
a free lunch
“ ”

12. 5
There [is] no
such thing as
a free lunch
“ ” An Empirical Study of
Build Maintenance
Effort
S. McIntosh, B. Adams,
T. H. D. Nguyen,
Y. Kamei, A. E. Hassan
[ICSE 2011]
Up to 27% of
source changes
are accompanied
by build changes

13. 6
Maintenance overhead

14. 6
Maintenance overhead
.c .mk?
Source-build
co-change

15. 6
Maintenance overhead
Build technology
and maintenance
.c .mk?
Source-build
co-change

16. 6
Maintenance overhead
Build logic
cloning
Build technology
and maintenance
.c .mk?
Source-build
co-change

17. 6
Execution overhead
Maintenance overhead
Build logic
cloning
Build technology
and maintenance
.c .mk?
Source-build
co-change

18. 6
Execution overhead
Maintenance overhead
Build logic
cloning
Build technology
and maintenance
.c .mk?
Source-build
co-change
Build hotspot
detection

19. 6
Execution overhead
Maintenance overhead
Build logic
cloning
Build technology
and maintenance
.c .mk?
Source-build
co-change
Powerful hotspot
indicators
Build hotspot
detection

20. 6
Execution overhead
Maintenance overhead
Build logic
cloning
Build technology
and maintenance
.c .mk?
Source-build
co-change
Powerful hotspot
indicators
Build hotspot
detection
Build systems also contain
useful information!

21. Reusable components are released
under different license terms
7

22. Reusable components are released
under different license terms
7
Apache Public
License

23. Failure to comply with license terms
can lead to costly legal issues
8

24. Failure to comply with license terms
can lead to costly legal issues
8

25. Failure to comply with license terms
can lead to costly legal issues
8

26. 9
Which source
files are enabled?
Ensuring license compliance with
reused components
.c.c.c.c

27. 9
Which source
files are enabled?
Ensuring license compliance with
reused components
.c.c.c
.c

28. 9
Which source
files are enabled?
Which components
are used?
Ensuring license compliance with
reused components
.c.c.c
.c

29. 9
Which source
files are enabled?
Which components
are used?
How are they
combined?
Ensuring license compliance with
reused components
.c.c.c
.c
Static
link
Dynamic
link

30. 9
Which source
files are enabled?
Which components
are used?
How are they
combined?
Ensuring license compliance with
reused components
.c.c.c
.c
Static
link
Dynamic
link
The build system can
answer these questions!

31. We use system tracing to
discover build dependencies
Build process
10
Trace
log

32. OS kernel
open()
We use system tracing to
discover build dependencies
Build process
10
read()
write()
close()
Trace
log

33. Trace
log
We mine build traces to construct a
concrete build dependency graph
patchelf.ccelf.h
patchelf.o
patchelf
/usr/bin/patchelf
libstdc++
11

34. Trace
log
We mine build traces to construct a
concrete build dependency graph
patchelf.ccelf.h
patchelf.o
patchelf
/usr/bin/patchelf
g++
libstdc++
g++
install
11

35. patchelf.ccelf.h
patchelf.o
patchelf
/usr/bin/patchelf
g++
libstdc++
g++
install
Annotate build graph nodes with
license information using Ninka
12

36. patchelf.ccelf.h
patchelf.o
patchelf
/usr/bin/patchelf
g++
libstdc++
g++
install
Annotate build graph nodes with
license information using Ninka
12

37. Inconsistency
introduced!
patchelf.ccelf.h
patchelf.o
patchelf
/usr/bin/patchelf
g++
libstdc++
g++
install
Annotate build graph nodes with
license information using Ninka
12

38. 13

39. Empirical study
13

40. Empirical study
(RQ1)
Accuracy
13

41. Empirical study
(RQ1)
Accuracy
(RQ2)
Practicality
13

42. 14
Measuring the accuracy
of our CBDG approach
Included .c.c.c.c
Excluded

43. 14
Measuring the accuracy
of our CBDG approach
Included .c.c.c
.cExcluded

44. 14
Measuring the accuracy
of our CBDG approach
Included .c.c .c
.cExcluded
Delete

45. 14
Measuring the accuracy
of our CBDG approach
Included .c.c .c
.cExcluded
Delete
Execute
build

46. 14
Broken means
true positive
Measuring the accuracy
of our CBDG approach
Included .c.c .c
.cExcluded
Delete
Execute
build

47. 14
Clean means
false positive
Broken means
true positive
Measuring the accuracy
of our CBDG approach
Included .c.c .c
.cExcluded
Delete
Execute
build

48. 14
Clean means
false positive
Broken means
true positive
Measuring the accuracy
of our CBDG approach
Included .c.c .c
.cExcluded
Delete
Execute
build
.c

49. 14
Clean means
false positive
Broken means
true positive
Measuring the accuracy
of our CBDG approach
Included .c.c .c
.cExcluded
Delete
Execute
build
Execute
build
.c

50. 14
Clean means
false positive
Broken means
true positive
Measuring the accuracy
of our CBDG approach
Included .c.c .c
.cExcluded
Delete
Execute
build
Broken means
false negative
Execute
build
.c

51. 14
Clean means
false positive
Broken means
true positive
Measuring the accuracy
of our CBDG approach
Included .c.c .c
.cExcluded
Delete
Execute
build
Clean means
true negative
Broken means
false negative
Execute
build
.c

52. Empirical study
(RQ1)
Accuracy
Precision:
88%-100%
Recall:
98%-100%
(RQ2)
Practicality
15

53. Bugs filed using our approach
on multi-licensed packages
FFmpeg
License
was updated
within 3 days
+
16

54. Bugs filed using our approach
on multi-licensed packages
FFmpeg
License
was updated
within 3 days
+
CUPS
+
Offending files
were removed
within 2 days
16

55. Empirical study
(RQ1)
Accuracy
Precision:
88%-100%
Recall:
98%-100%
(RQ2)
Practicality
Prompted
quick code
changes in
two systems
17