JP6937589B2 - License management device, license management method, and program - Google Patents

Description

The present invention relates to a license management device, a license management method, and a program.

In recent years, software development using open source software (OSS) has become active. Many OSSs come with a license that imposes certain conditions when using OSS. Therefore, when OSS is used, a great deal of man-hours are required to investigate and manage the license. Patent Document 1 discloses a system for checking the OSS license in order to reduce this great man-hours. Specifically, the system disclosed in Patent Document 1 checks the license of the OSS when the user downloads the OSS from the Internet. Then, when the user builds the software created by using the OSS, the system determines whether the software violates the license of the OSS and outputs the result.

Japanese Unexamined Patent Publication No. 2008-191889

In some OSSs, the license propagates not only to software that directly uses the OSS, but also to software that indirectly uses the OSS. For example, under the GPL (GNU General Public License), which is one of the OSS licenses, the GPL affects not only the program B using the program A having the GPL but also the program C using the program B. In the system disclosed in Patent Document 1, it is possible to determine whether or not the user modifies the OSS and whether the link to the OSS violates the license of the OSS, but for software that indirectly uses the OSS, , It is difficult to determine whether or not the OSS license is violated.

The present invention has been made in view of the above circumstances, and provides a license management device, a license management method, and a program capable of managing licenses of source codes of a plurality of programs constituting software without omission. With the goal.

In order to achieve the above object, the license management device of the present invention
A dependency determination unit that determines the dependency between the source codes of a plurality of programs constituting the software based on the build information that is a log when building the software.
For each type of license, the license identification information for identifying the license and the propagation flag indicating whether or not the license is propagated to other source code depending on the source code having the license are stored. License information storage and
When the license possessed by each of the source codes of the plurality of programs is determined by referring to the license identification information stored in the license information storage unit, and the propagation flag of the determined license is shown to be propagated. is on the basis of the dependency determination unit according to the determination result, to identify other source code that depends on the source code with the license, the license check unit for determining that also has the license to said other source code When,
A result output unit that outputs the determination result by the license investigation unit, and
To be equipped.

According to the present invention, it is possible to manage the licenses of the source codes of a plurality of programs constituting the software without omission.

The figure which shows the structural example of the license management system which concerns on embodiment of this invention. The figure which shows the structural example of the license management apparatus which concerns on embodiment of this invention. Diagram showing an example of data stored in the license information table Diagram showing an example of data stored in the survey result storage table Schematic block diagram showing an example of the functional configuration of the control unit A diagram schematically showing an example of the dependency between the source codes acquired by the dependency acquisition unit. Flowchart of license diagnosis process

Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings. The same or corresponding parts in the figure are designated by the same reference numerals.

FIG. 1 shows a configuration example of the license management system 1 according to the embodiment of the present invention. The license management system 1 includes a user terminal 100, a development environment server 200, and a license management device 300. The user terminal 100, the development environment server 200, and the license management device 300 are connected to each other so as to be able to communicate with each other via the Internet 400.

The user terminal 100 is a personal computer, a tablet terminal, or the like operated by the user. The user operates the user terminal 100 to instruct software build, license diagnosis, and the like.

The development environment server 200 is a server that executes software builds based on instructions from the user terminal 100 or the license management device 300. Note that building software means converting the source code of a plurality of programs constituting the software into an executable software product by compiling and linking them in a normal procedure. The development environment server 200 is pre-installed with a compiler, a linkage editor, a script, a build command, and the like necessary for performing a build.

The license management device 300 manages software licenses. Specifically, the license management device 300 checks the licenses of the source codes of the plurality of programs constituting the software to be diagnosed, and outputs the result.

The configuration of the license management device 300 is shown in FIG. The license management device 300 includes a control unit 310, a storage unit 320, a communication unit 330, an input unit 340, and an output unit 350. Each of these parts is connected by a bus 360.

The control unit 310 includes, for example, a CPU (Central Processing Unit), a ROM (Read Only Memory) for storing a program executed by the CPU, a RAM (Random Access Memory) for temporarily storing data generated by the CPU, and the like. It controls the entire license management device 300.

The storage unit 320 includes a hard disk drive, a flash memory, and a writable storage device such as an SSD (Solid State Drive). The storage unit 320 stores the license information table 321 and the search result storage table 322.

The license information table 321 corresponds to the license information storage unit, and is a table in which various information related to the license is registered for each type of license.

FIG. 3 shows an example of the information stored in the license information table 321. The license information table 321 shown in FIG. 3 corresponds to information representing license identification information, license type, propagation flag, publication flag, version, and URI (Uniform Resource Identifier) for each type of license. It is stored with it. Various data stored in the license information table 321 are periodically collected via the Internet 400 and updated to the latest ones.

The license identification information is information for specifying the license. The license identification information is, for example, a keyword generally described in the source code of the program having the license.
The license type represents the type of license. Specific license types are, for example, GPL, BSD (Berkeley Software Distribution License), and the like.
The propagation flag is a flag indicating whether or not a license granted to a certain source code is propagated (license propagation) to other source codes that depend on the source code. The propagation flag "1" indicates that the license is propagated. The propagation flag "0" indicates that the license is not propagated.
The public flag is a flag indicating whether or not the source code is obliged to be published. The public flag "1" indicates that the source code is obliged to be published. The public flag "0" indicates that the source code is not obliged to be published.
The URI is the address of the web page if the license is published on the web of Internet 400.

Here, the GPL needs to publish its source code to the entire software using a certain OSS. That is, the GPL is a license that propagates the influence of the OSS license. For example, when a certain OSS has the GPL, a program created by modifying the OSS, a program including a link to the OSS, and the like also have the GPL. Therefore, those programs are also obliged to publish their source code. Therefore, in the license information table 321, the GPL propagation flag is set to "1" and the public flag is set to "1".

On the other hand, the BSD license is a license with few restrictions as long as it satisfies predetermined conditions when using and redistributing the OSS having the BSD license. In addition, the OSS modified program having the BSD license can keep its source code private. Therefore, in the license information table 321 shown in FIG. 3, the propagation flag of the BSD license is set to "0" and the public flag is set to "0".

Returning to FIG. 2, the search result storage table 322 stores information indicating the result of checking the license of the source code of each program constituting the software. Specifically, as shown in FIG. 4, in the survey result storage table 322, the file name of the source code, the type of license imposed on the source code, the propagation source file name, and the file name of the source code are displayed for each source code. Information indicating that is stored. The source file name is the file name of the source code that affects the source code when the source code is affected by license propagation.

Returning to FIG. 2, the communication unit 330 is an interface for wirelessly or wired communication with the user terminal 100 and the development environment server 200 via the Internet 400.

The input unit 340 includes input devices such as buttons, a touch panel, and a keyboard. The input unit 340 receives an operation input from the user and outputs an operation input signal corresponding to the received operation input to the control unit 310.

The output unit 350 includes display devices such as a CRT (Cathode Ray Tube) and a liquid crystal display. The output unit 350 displays data such as characters and images supplied from the control unit 310.

Next, the function of the control unit 310 of the license management device 300 will be described. FIG. 5 is a schematic block diagram showing an example of the functional configuration of the control unit 310. The control unit 310 includes a program acquisition unit 311, a dependency determination unit 312, a license investigation unit 313, a result output unit 314, and an archive creation unit 315 as functional configurations.

The program acquisition unit 311 acquires the source codes of a plurality of programs constituting the software to be licensed and the build information when the software is built from the development environment server 200.

The dependency determination unit 312 determines the dependency between a plurality of programs acquired by the program acquisition unit 311 based on the build information acquired by the program acquisition unit 311. Dependencies between programs are, for example, relationships in which one program uses another program in the form of linking (using, referencing, etc.). Links include dynamic linking and static linking.

FIG. 6 is a diagram schematically showing an example of the dependency relationship between the source codes determined by the dependency relationship determination unit 312. This dependency is represented by a tree structure composed of a node representing each of the source codes of a plurality of programs acquired by the program acquisition unit 311 and an arrow line connecting the nodes representing the programs having the dependency. .. It is shown that the source code of the node connecting to the start point of the arrow line depends on the source code of the node connecting to the end point of this arrow line. For example, from FIG. 6, it can be seen that the source code "aa.c" depends on two source codes "bb.c" and "dd.c". Furthermore, it can be seen that the source code "bb.c" depends on the source code "cc.h". Therefore, it can be seen that the source code "aa.c" indirectly depends on the source code "cc.h".

In the following description, it is defined that the source code having a higher number of times of directly and indirectly depending on other source code has a higher dependency relationship. For example, in the example of FIG. 6, the source codes "cc.h", "dd.c", "ff.c", "hh.c", "ii.c", and " "JJ.c" is the source code with the lowest dependency. In addition, the source code "main.c" is the source code with the highest dependency.

Returning to FIG. 5, the license investigation unit 313 uses the license information stored in the license information table 321 and the source code of the program to be investigated based on the dependency between the source codes determined by the dependency determination unit 312. Each license is discriminated, and the discriminant result is registered in the search result storage table 322.

Specifically, first, the license investigation unit 313 identifies the source code including the license identification information stored in the license information table 321 from the source codes of the plurality of programs to be investigated, and determines the type of the license. Determine. Then, the license investigation unit 313 registers the determination result in the investigation result storage table 322.

For example, the information shown in FIG. 3 is stored in the license information table 321, and the source code in which the license specific information "GNU General Public License" is described from the source codes of a plurality of programs to be investigated. When the above is specified, the license investigation unit 313 determines that the license of the source code is "GPL". Then, the license investigation unit 313 registers an entry in the investigation result storage table 322 that associates the file name of the specified source code with the determined license type. The propagation source file name of the entry registered here is "None".

Subsequently, the license investigation unit 313 determines whether or not the license propagation flag of the determined source code is "1" by referring to the license information table 321. When the propagation flag is "1", the license investigation unit 313 identifies all other source code that directly or indirectly depends on this source code based on the dependency determined by the dependency determination unit 312. Then, the license investigation unit 313 determines that the other specified source code has the same license type, and registers the determination result in the investigation result storage table 322.

For example, consider a case where there is a dependency relationship between the source codes as shown in FIG. 6, and the license of the source code "ii.c" is determined to be "GPL". From FIG. 3, since "GPL" is propagated to other source codes, the license investigation unit 313 has decided that the license type of the source code "gg.c" that depends on this source code "ii.c" is also "GPL". Determine if there is. Further, the license investigation unit 313 determines that the license type of "ee.c", which depends on the source code "gg.c", is also "GPL". Further, the license investigation unit 313 determines that the license type of "main.c", which depends on the source code "ee.c", is also "GPL". Therefore, finally, the license investigation unit 313 has three sources, "gg.c", "ee.c", and "main.c", as source codes that directly or indirectly depend on the source code "ii.c". Determine the code. Then, the license investigation unit 313 has an entry with the file name "gg.c", the license type "GPL", and the propagation source file name "ii.c", and the file name "ee.c", the license type "GPL", The entry with the propagation source file name "ii.c" and the entry with the file name "main.c", license type "GPL", and propagation source file name "ii.c" are registered in the investigation result storage table 322. do.

Returning to FIG. 5, the result output unit 314 outputs the data stored in the search result storage table 322 from the output unit 350 as the search result by the license search unit 313.

The archive creation unit 315 refers to the investigation result storage table 322, identifies the source code that is obliged to be released from the source code for which the license has been investigated, and summarizes the identified source code for each component in the archive file. Create (archive). The component means a group for each function, and which source code belongs to which component is defined in advance. The unit of the component may match the unit of the library. Further, the archive creation unit 315 may create an archive file in which all the specified source codes are put together, not for each component, and various units for creating the archive file can be adopted.

Next, the operation of the license diagnosis process performed by the control unit 310 of the license management device 300 according to the present embodiment will be described with reference to the flowchart of FIG. 7.

In the license diagnosis process, when an instruction information indicating the start of execution of the license diagnosis process is received via the input unit 340 by an operation from the user, or when the license diagnosis process is executed from the user terminal 100 via the Internet 400. It is started when the communication unit 330 receives the instruction information indicating the start. In addition, this instruction information includes information for specifying the software to be investigated and information for specifying the investigation target for specifying the source code for actually investigating the license among the source codes of a plurality of programs constituting this software. And are included. The search target specification information may specify the type of source code such as a library, header file, or script file, or may directly specify the source code to be searched for license by the file name.

First, the license investigation unit 313 deletes the data (previous investigation result) stored in the investigation result storage table 322 if it exists (step S101).

Subsequently, the program acquisition unit 311 acquires the source codes of a plurality of programs constituting the software whose license is to be managed and the build information of the software from the development environment server 200 (step S102).

Next, the dependency determination unit 312 determines the dependency between the acquired plurality of programs based on the acquired build information (step S103).

Subsequently, the license investigation unit 313 refers to the determined dependency relationship, and sets the source code specified in the investigation target designation information and the source code on which this source code directly or indirectly depends as the investigation target module. Identify (step S104).

For example, consider a case where the dependency between the source codes as shown in FIG. 6 is determined in step S103 and the source code "ee.c" is specified as the investigation target designation information. In this case, the license investigation unit 313 determines the source code "ee.c" and the source codes "ff.c" and "gg" on which the source code "ee.c" directly or indirectly depends on the module to be investigated. Identify ".c", "hh.c", "ii.c", "jj.c".

Returning to FIG. 7, the license investigation unit 313 then selects one source code having the lowest dependency determined in step S103 from the unselected source codes included in the determined investigation target module (). Step S105).

Then, the license investigation unit 313 determines whether or not the source code is licensed and, if it has a license, the type of the source code by searching the source code for which the license specific information in the license information table 321 is selected as a keyword. The result is registered in the investigation result storage table 322 (step S106).

Subsequently, the license investigation unit 313 refers to the propagation flag of the license information table 321 to determine whether or not the license of the source code determined in step S106 is propagated to other source codes that use this source code. Determine (step S107). If it is determined that the propagation does not occur (step S107; No), the process proceeds to step S109.

On the other hand, when it is determined that the license of the source code is propagated (step S107; Yes), the license investigation unit 313 determines that the source code is directly or indirectly dependent on another source based on the dependency determined in step S103. Determine the code. Then, the license investigation unit 313 determines that the other source code determined has the same license as that determined in step S106, and registers the determination result in the investigation result storage table 322 (step S108).

Subsequently, the license investigation unit 313 determines whether or not all the source codes included in the investigation target module have been selected in step S105 (step S109). If there is unselected source code (step S109; No), the process returns to step S105.

When all the source codes are selected (step S109; Yes), the result output unit 314 outputs the license search result. Specifically, the result output unit 314 outputs (displays) the data stored in the survey result storage table 322 to the output unit (step S110). When the license diagnosis process is started by the instruction from the user terminal 100, the result output unit 314 transmits the data stored in the survey result storage table 322 to the user terminal 100, and the user. The survey result may be output to a display unit (not shown) of the terminal 100.

Subsequently, the archive creation unit 315 identifies the source code that is obliged to be released from the source code for which the license has been investigated. For example, the license investigation unit 313 may refer to the investigation result storage table 322 and specify a source code having a license (for example, GPL) in which the public flag of the license information table 321 is "1". Then, the license investigation unit 313 creates (archives) an archive file that summarizes the specified source code that is obliged to be published for each component (step S111). This completes the license diagnosis process.

As described above, the license management device 300 of the present embodiment has a dependency relationship between the source codes of a plurality of programs constituting the software to be license-managed based on the build information which is a log when the software is built. To determine. Then, the license management device 300 determines the source code having a predetermined license by using the license identification information. Then, when the determined license is propagated, the license management device 300 identifies other source code that depends on this source code based on the determined dependency, and the same license is applied to the specified other source code. Is determined to have. Therefore, the license management device 300 can investigate the license of the source code of the program in consideration of the license propagation, and can manage the license without omission.

Although the embodiments of the present invention have been described above, the present invention is not limited to the present embodiments.

For example, in the above embodiment, the license of the source code included in the module to be investigated is investigated, but the license may be investigated for the source code of all the programs constituting the software.

For example, in addition to the build command that executes the build, a wrapper command that wraps the build command is prepared in the development environment server 200. This wrapper command is different from a normal build, and is a command for executing a pseudo build for the purpose of outputting a build log (build information) without generating a software product. Then, the license management device 300 acquires the log information when the pseudo build is executed by using this wrapper command from the development environment server 200, and determines the dependency between the source codes by using the acquired log information (Fig.). Step S103) of 7 may be performed. In the pseudo build, the build information is output in a shorter time than the normal build without generating the software generation unit, so that the execution speed of the license diagnosis process can be improved. In addition, the build information output at the time of pseudo build is output with more detailed contents than the build information output at the time of normal build, and the build information is output in a format that makes it easy to determine the dependency between source codes. You may do it.

For example, the license management device 300 has acquired build information from the development environment server 200, but builds an environment in which the license management device 300 can execute a build or a pseudo build, and executes a build or a pseudo build in the license management device 300. You may get the build information.

Further, each step of the license diagnosis process may be shared and executed by a plurality of devices. For example, the steps up to the determination of the dependency (steps S101 to S103) are executed by the user terminal 100 or the development environment server 200, the result is transmitted to the license management device 300, and the subsequent steps S104 to S111 are performed by the license management device 300. May be executed.

Further, in the above embodiment, the dependency determination unit 312 of the license management device 300 uses the build information to determine the dependency between the source codes, but other information may be used to determine the dependency. For example, the dependency determination unit 312 may acquire the software product generated by the build from the development environment server 200, analyze the contents of the software product, and determine the dependency between the source codes. Further, the dependency determination unit 312 may determine static links among the dependencies using build information and dynamic links using software products.

Further, in the above embodiment, in the license diagnosis process, the licenses are determined by sequentially selecting the unselected source codes included in the investigation target module with lower dependencies (steps S105 and S106 in FIG. 7). , The order in which the source code is selected is arbitrary. For example, one may be randomly selected from the unselected source codes included in the module to be investigated.

For example, in the above embodiment, the result output unit 314 outputs the data stored in the search result storage table 322 as the license search result (step S110 in FIG. 7), but outputs other data. May be good. For example, the result output unit 314 has a license problem in the entire software when some of the source code for which the license has been investigated has a license that is obliged to be released or a deprecated license. A warning message may be output to the output unit 350.

Further, for example, the result output unit 314 may acquire the determined license text via the Internet 400 and output it together with the license result as additional information. Further, the result output unit 314 may output a file in which the provisions of the license acquired in a predetermined format (PDF format, HTML format, XML format, etc.) are put together.

Further, in the above embodiment, an example in which the license management device 300, the user terminal 100, and the development environment server 200 are realized by separate devices is described, but the above-mentioned function of each device is one. It may be realized by a device such as a personal computer or a server.

For example, by applying an operation program that defines the operation of the license management device 300 according to the present embodiment to an existing personal computer, information terminal device, or the like, the personal computer or the like functions as the license management device 300 according to the present invention. It is also possible.

The distribution method of such a program is arbitrary, and for example, a computer-readable CD-ROM (Compact Disk Read-Only Memory), DVD (Digital Versatile Disk), MO (Magneto Optical Disk), memory card, etc. can be read. It may be stored in a recording medium and distributed, or may be distributed via a communication network such as the Internet 400.

1 License management system, 100 user terminals, 200 development environment server, 300 license management device, 400 Internet, 310 control unit, 320 storage unit, 321 license information table, 322 survey result storage table, 330 communication unit, 340 input unit, 350 output unit, 360 bus, 311 program acquisition unit, 312 dependency determination unit, 313 license investigation unit, 314 result output unit, 315 archive creation unit

Claims (7)

A dependency determination unit that determines the dependency between the source codes of a plurality of programs constituting the software based on the build information that is a log when building the software.
For each type of license, the license identification information for identifying the license and the propagation flag indicating whether or not the license is propagated to other source code depending on the source code having the license are stored. License information storage and
When the license possessed by each of the source codes of the plurality of programs is determined by referring to the license identification information stored in the license information storage unit, and the propagation flag of the determined license is shown to be propagated. is on the basis of the dependency determination unit according to the determination result, to identify other source code that depends on the source code with the license, the license check unit for determining that also has the license to said other source code When,
A result output unit that outputs the determination result by the license investigation unit, and
License management device. The dependency determination unit is
Based on the build information, the static dependency between the source code of the plurality of programs is determined.
Determining the dynamic dependencies between the source code of the plurality of programs based on the software products generated by building the software.
The license management device according to claim 1. The build information is a log when a pseudo build, which is a build that does not generate software products, is executed.
The license management device according to claim 1 or 2. When the predetermined license is a license that obliges the disclosure of the source code, an archive creation unit for creating an archive of the source code having the predetermined license determined by the license investigation unit is further provided.
The license management device according to any one of claims 1 to 3. The result output unit outputs a list of license texts determined by the license investigation unit.
The license management device according to any one of claims 1 to 4. The computer
A dependency determination step for determining the dependency between the source codes of a plurality of programs constituting the software based on the build information which is a log when the software is built, and a dependency determination step.
For each type of license, the license identification information for identifying the license and the propagation flag indicating whether or not the license is propagated to other source code depending on the source code having the license are stored. License information storage step and
When the license possessed by each of the source codes of the plurality of programs is determined by referring to the license identification information and the propagation flag of the determined license is indicated to be propagated, the dependency determination step is performed. based on the determination result, to identify other source code that depends on the source code with the license, and the license investigation step of determining to have the license against said other source code,
License management method to execute. Computer,
Dependency determination unit that determines the dependency between the source codes of a plurality of programs that make up the software based on the build information that is the log when building the software.
For each type of license, the license identification information for identifying the license and the propagation flag indicating whether or not the license is propagated to other source code depending on the source code having the license are stored. License information storage,
When the license possessed by each of the source codes of the plurality of programs is determined by referring to the license identification information stored in the license information storage unit, and the propagation flag of the determined license is shown to be propagated. is on the basis of the dependency determination unit according to the determination result, to identify other source code that depends on the source code with the license, the license check unit for determining that also has the license to said other source code ,
A program that functions as.

Images