开源许可证合规性研究

随着开源概念的逐步深入,开源软件成为软件发展的潮流.同时,开源软件的使用受各类开源许可证约束.开源参与者在开发过程中该如何为自己的开源软件选择合适的许可证,确保高效合理地使用社区群体智慧劳动成果,仍是一个亟需解决的问题.为此,首先分析和解读了开放源代码促进会认证的常用开源许可证,通过对许可证条款内容和结构的研究,得到开源许可证框架及许可证兼容性推导模型,并将该模型应用于对我国自主研发的木兰宽松许可证的分析和解读.最后,基于上述工作研发了开源许可证选择工具,为开源开发者对许可证的理解和合规使用提供了参考和决策支持.     

开源许可证的选择:挑战和影响因素

开发者通常会为其开源代码选择不同的开源许可证来约束其使用条件,以期能有效地保护知识产权和维持软件的长远发展.然而,现有的开源许可证种类繁杂,开发者难以了解不同开源许可证间的差异,并且难以通过现有的开源许可证选择工具做出合适的选择——其使用要求开发者了解开源许可证相关条款并明确自己的业务需求.学术界虽然对开源许可证已有研...     

Service licensing: conceptualization, formalization, and expression

Service licensing enables a broader usage of services and a means for designing business strategies and relationships. A service license describes the terms and conditions that permit the use of and access to a service, in a machine interpretable way, which services can understand. The distribution of services spanning across organizational boundaries raises problems related to intellectual value that are less explored in service-oriented research. Being a way to manage the rights between service consumers and service providers, licenses become significant in services. As the nature of services differs significantly from traditional software and components, services prevent the direct adoption of software and component licenses. The concept of preserving certain rights of owner and presenting certain rights to consumer, addressed by service licensing, is incipient in the field of service-oriented computing. We propose a formalization of licensing clauses for an unambiguous definition of a service license. We extend the Open Digital Rights Language to implement the clauses of service licensing, in a machine interpretable way. We illustrate the concepts of service licensing based on a case study of service license compliance verification in a real world scenario.     

Open source software licenses: Strong-copyleft, non-copyleft, or somewhere in between?

Studies on open source software (OSS) have shown that the license under which an OSS is released has an impact on the success or failure of the software. In this paper, we model the relationship between an OSS developer's utility, the effort that goes into developing an OSS, his attitude towards the freedom to choose an OSS license, and the choice of OSS license. We find that the larger the effort to develop OSS, the more is the likelihood that the OSS license would be free from restrictions. Interestingly, the result holds even when all OSS developers prefer restrictive licenses or less-restrictive license. The results suggest that least-restrictive or non-copyleft license will dominate other types of OSS license when a large effort is required to develop derivative software. On the other hand, most-restrictive or strong-copyleft licenses will be the dominant license when minimal effort is required to develop the original OSS and the derivative software.     

开源软件供应链安全问题研究

当前,开源已经成为软件开发的重要模式之一。由于开源开发模式具有代码来源多样、依赖关系复杂等特点,使得开源软件面临代码漏洞风险、供应链攻击风险、知识产权风险、可持续维护风险等供应链安全问题,且问题呈现出快速增长态势。本文基于对开源软件供应链中的安全风险分析,提出从开源软件安全漏洞检测、软件成分分析、许可证冲突检测、开源生态可持续治理四个方面进行安全治理的方法,指出构建安全软件供应链面临依赖关系复杂、结构脆弱等挑战,对软件成分分析、供应链构建等未来研究方向进行了展望。     

Analysis of license inconsistency in large collections of open source projects

Free and open source software (FOSS) plays an important role in source code reuse practice. They usually come with one or more software licenses written in the header part of source files, stating the requirements and conditions which should be followed when been reused. Removing or modifying the license statement by re-distributors will result in the inconsistency of license with its ancestor, and may potentially cause license infringement. In this paper, we describe and categorize different types of license inconsistencies and propose a method to detect them. Then we applied this method to Debian 7.5 and a collection of 10,514 Java projects on GitHub and present the license inconsistency cases found in these systems. With a manual analysis, we summarized various reasons behind these license inconsistency cases, some of which imply potential license infringement and require attention from the developers. This analysis also exposes the difficulty to discover license infringements, highlighting the usefulness of finding and maintaining source code provenance.     

Open source movements as a model for organising

Open source software such as the operating system Linux has in a few years created much attention as an alternative way to develop and distribute software. Open source is to let anyone have access to the source code, so that they can modify it. Open source can be seen as a movement, where communities of highly skilled programmers collectively develop software, often of a quality that outperforms commercial proprietary software. These movements are based on virtual networking on the Internet and the web. They are loosely coupled communities kept together by strong common values related to hacker culture. Work seems to be totally distributed, delegated and loosely coupled. The highly skilled members contribute to the collective effort of free software development. In this paper the open source phenomenon is investigated from different perspectives. It is claimed that the open source movement is one key to the understanding of future forms of organizations, information work and business.     

Don't judge a software license by its cover

Software licenses are of vital concern to vendors and users. Software vendors use contracts, called licenses, to make sure that their products are used in a way that will benefit them. Users want to know the conditions that licenses impose on software so they can buy software that meets their needs. Beyond this, however, licenses and their enforceability are not always a straightforward matter. Are you bound by the conditions of a license even if the license is inside a container of shrinkwrap software, and you can't see its terms until after you buy the product? What if you can't see the license until you load your software into your computer and its terms appear on the monitor? This is particularly an issue with software sold by phone or mail, or over the Internet. In some of these cases, buyers purchase only a serial number or security code that activates publicly accessible software. In many cases, buyers don't even receive a solid product. They receive only a stream of electrons that contains data, an application program, instructions, and license conditions. The thorny legal issues that these situations raise recently confronted the US Court of Appeals for the Seventh Circuit, which hears appeals of cases from US District Courts in Illinois, Indiana, and Wisconsin. The changing nature of the software business has raised questions about the enforceability of shrinkwrap licenses     

开放源码软件综述

开放源码不仅提出了一种新型的软件开发模式,同时也倡导了一种新型的软件商务理念,成为软件业关注的焦点.侧重从政府、公司、开放源码三者相互作用和影响的角度,归纳了开放源码软件发展的历史,给出了开放源码软件的定义,介绍了开放源码的许可证制度和理论模型,分析了公司和政府的开放源码运动,最后总结了开放源码亟需解决的问题和发展趋势.     

机群环境中软件许可证管理的研究

研究了在机群环境下作业管理系统中软件许可征管理的办法，该方法将软件许可证视为资源管理系统中的一类资源对象进行管理。提出了在机群环境下，组织多个用户作业共享有限软件许可证模型PBSLM，并闸述了该模型的原理和实现方法。     

化学信息学与开源软件

化学信息学研究需要性能强大而又能随时修订的、开放性的软件工具。通过回顾自由软件到开源软件的发展历史,展示开源式程序开发的丰富成就,包括操作系统如Linux、社区如SourceForge和我国的共创软件联盟等,澄清与copyright针锋相对的copyleft式版权概念,介绍并比较多种软件许可证,对开源软件的发展机制进行简要分析,认为开源软件是满足化学信息学要求的最佳选择。     

并行计算机中基于令牌的许可证管理

提出一种适用于并行计算机系统的基于令牌的许可证管理模型。该模型将软件许可证的使用显式分开为申请与检出两步,许可证的释放分开为检入和回收两步,并由资源管理系统代理软件进行许可证资源的申请和回收。在此模型中,软件许可证的使用将由资源管理系统完全控制与调度,避免了现有模型中存在的资源管理系统外作业使用许可证、作业错误指定许可证信息、应用进程残留等情景下,出现用户作业因许可证不可用而造成的运行失败或资源浪费。设计了两种在现存遗留应用软件和许可证管理软件上实现基于令牌的许可证管理模型的方法,充分表明了此模型的现实意义。     

Determining the Proper Number and Price of Software Licenses

Software houses sell their products by transferring usage licenses of various software components to the customers. Depending on the kind of software, there are several different license types that allow controlled access of services. The two most popular types are the fixed license, which gives access rights for an identified workstation, and the floating license, which restricts the number of simultaneous users to a certain bound. The latter of these types is advantageous when the users do not demand full-time services and occasional lack of access is bearable. The problem of deciding the number of floating licenses is studied in the present paper. Based on the expected usage profile of the software, we calculate the minimal number of licenses that guarantees that the customers get service better than a given lower bound. The problem is studied by using certain queuing models, known as the Erlang toss system, the Erlang delay system, and the Engset model. None of these analytic models consider, however, the transient period that we analyze by means of simulation and by the so-called modified offered load approximation. We also give simple formulas presenting how the number of software licenses needed to keep the probability of nonaccess below a given blocking level grows as a function of the offered load, which is the proportion of the time used in the case that all requests were successful. Results of the study may be used for setting license prices and for determining the proper number of licenses.     

Understanding the role of licenses and evolution in open architecture software ecosystems

The role of software ecosystems in the development and evolution of open architecture systems whose components are subject to different licenses has received insufficient consideration. Such systems are composed of components potentially under two or more licenses, open source or proprietary or both, in an architecture in which evolution can occur by evolving existing components, replacing them, or refactoring. The software licenses of the components both facilitate and constrain the system's ecosystem and its evolution, and the licenses’ rights and obligations are crucial in producing an acceptable system. Consequently, software component licenses and the architectural composition of a system help to better define the software ecosystem niche in which a given system lies. Understanding and describing software ecosystem niches for open architecture systems is a key contribution of this work. An example open architecture software system that articulates different niches is employed to this end. We examine how the architecture and software component licenses of a composed system at design time, build time, and run time help determine the system's software ecosystem niche and provide insight and guidance for identifying and selecting potential evolutionary paths of system, architecture, and niches.     

OpenStack开源社区中商业组织的参与模式

2000年以来,开源软件取得了显著进展,展示出一种以用户创新为驱动且低成本高质量的新型软件开发方式.越来越多的商业组织参与到开源项目中,期望利用开源软件及其优势实现自身的商业目标.由于开源软件开发方式与传统的软件工程方法存在显著差异,为了加入开源社区,商业组织必须要对自身原有的软件开发方式、业务模式等做出调整.在这种情况下,一个亟待解决的问题是商业组织应当采取怎样的参与模式才能有效融入开源社区.为此,本文进行了如下三个方面的研究：1.采用雪球采样方法对OpenStack相关的文本数据进行收集,为定性分析提供数据基础;2.借鉴扎根理论,通过对所收集数据的过滤和归纳,总结出不同商业组织参与OpenStack的模式;3.在此基础上,提炼出四种更具一般性的参与模式,为商业组织参与开源项目提供经验参考与决策支持.     

Enhancing Open Source Software in Alignment with CMMI-DEV

To provide comprehensive, low-cost tool support for project monitoring and control for small organizations in particular, the authors compare the most popular free/open source Web-based project management applications against their compliance to CMMI-DEV. Based on this analysis, they implement a set of enhancements to dotProject, including Earned Value Management, and evaluate the resulting application with respect to its CMMI-compliance. Their initial experiences applying the tool in an R&D organization indicate that it helps establish a systematic project monitoring and control process by supporting or automating tasks. In this way, it presents an open, flexible, and free tool-integration solution for project management, illustrating that open-source tools might be appealing, especially for small organizations.     

The 2012 free and open source GIS software map – A guide to facilitate research,development, and adoption

Over the last decade an increasing number of free and open source software projects have been founded that concentrate on developing several types of software for geographic data collection, storage, analysis and visualization. We first identify the drivers of such software projects and identify different types of geographic information software, e.g. desktop GIS, remote sensing software, server GIS etc. We then list the major projects for each software category. Afterwards we discuss the points that should be considered if free and open source software is to be selected for use in business and research, such as software functionality, license types and their restrictions, developer and user community characteristics, etc. Finally possible future developments are addressed.     

Open source: the Russian experience (legislation and practice)

The emergence of so-called free or open-source software and the growth of its economic importance in various industries make questions regarding the legal status of free/open-source licenses especially important. In December 2010, new draft amendments to the Civil Code were published, introducing new concepts in order to reflect the ideas pursued by these types of licenses. This article analyzes existing problems with the legal status of free/open-source licenses, whether proposed amendments may solve them, and what risks they may create. Since Russia is among the first countries trying to include provisions on free/open-source licenses in its legislation, such analysis may be of interest to foreign lawmakers since the concept of open source is universal all over the world.