WO2018008810A1

WO2018008810A1 - Method for inspecting conflict between open source licenses on basis of feature point

Info

Publication number: WO2018008810A1
Application number: PCT/KR2016/012980
Authority: WO
Inventors: 김민수; 조용준; 신동명; 연지영
Original assignee: 엘에스웨어(주)
Priority date: 2016-07-05
Filing date: 2016-11-11
Publication date: 2018-01-11
Also published as: KR101766859B1; JP6681519B2; JP2019520665A

Abstract

A method for inspecting a conflict between open source licenses, according to the present invention, comprises the steps of: (a) receiving an expression value for each feature point with respect to a given first license and receiving an expression value for each feature point with respect to a given second license; and (b) determining whether the first license and the second license conflict with each other by using the expression value for each feature point of the first license and the expression value for each feature point of the second license.

Description

Feature-based Open Source License Conflict Detection Method

The present invention relates to a method for detecting a conflict between open source licenses, and more particularly, to a method for detecting a conflict between open source licenses based on feature points.

Open-source embedded software is used in the development of set-top boxes and security devices, but often lacks a clear understanding of open-source licenses, which often leads to legal proceedings.

In particular, when two or more open sources are used at the same time, or when a user wants to distribute the license with a desired license, a conflict may occur between the licenses.

If two or more licenses work, a legal interpretation is needed to check for conflicts, and legal experts are currently comparing the full text of the license terms.

Open source licenses vary widely, and there are currently 78 officially certified licenses from the Open Source Initiative (OSI) and more than 120 licenses used by the Software Package Data Exchange (SPDX) group.

Therefore, it is difficult to interpret and compare a large number of open source license terms every time, and it is difficult to recommend the optimal license that a developer wants.

An object of the present invention is to provide a method for automating conflict checking between open source licenses.

In order to solve the above technical problem, an open source license collision checking method according to the present invention includes (a) receiving an expression value for each feature point for a given first license, and expressing each feature point for a given second license. Receiving a value; And (b) determining whether there is a conflict between the first license and the second license using an expression value for each feature point of the first license and an expression value for each feature point of the second license. It features.

Step (b) may include: (b1) defining a profile set, which is a set of feature point profiles defined by feature points and expression values, for the second license; (b2) a collision profile set indicating which feature point of any license has a corresponding feature point of the first license based on the expression value of each feature point of the first license, and which feature value has any representation value for each feature point; and Defining a list of conflict profile sets; And (b3) comparing each conflict profile set included in the conflict profile set list with a profile set of the second license to determine whether there is a conflict between the first license and the second license.

In the step (b3), when a conflict profile set included in the conflict profile set list belongs to the profile set of the second license, it may be determined that the first license and the second license collide with each other.

In the collision checking method, when it is determined in step (b) that the first license and the second license collide with each other, there is a feature point included only in the first license and not included in the second license. If a second license has an optional clause and all of the feature points included only in the first license are included in the optional clause of the second license, the feature is included only in the first license in the second license instead of the second license. The method may further include performing steps (a) and (b) for the license to which the corresponding selection clause is added.

In the collision checking method, when it is determined in step (b) that the first license and the second license are in conflict, if the first license allows conversion to a license other than the first license, The method may further include performing steps (a) and (b) for the other license instead of the first license.

In order to solve the above technical problem, there is provided a computer-readable recording medium having recorded thereon a program for executing a method for checking a conflict between open source licenses according to the present invention.

According to the present invention described above, collision checking between open source licenses can be automated.

1 is a flowchart of a method for checking a collision between licenses according to an embodiment of the present invention.

2 and 3 illustrate a flowchart of a method for checking a collision between licenses according to another embodiment of the present invention.

4 shows a license compatibility matrix of a result of performing a collision check according to an embodiment of the present invention.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings. In the following description and the accompanying drawings, the substantially identical components are represented by the same reference numerals, and thus redundant description will be omitted. In addition, in the following description of the present invention, if it is determined that a detailed description of a related known function or configuration may unnecessarily obscure the subject matter of the present invention, the detailed description thereof will be omitted.

In this specification, terms will be defined as follows. This definition may, however, be redefined otherwise in individual licenses.

License: A license is a contract that specifies what the user of the work to which it applies must abide.

Distributor: Distributor of the original work.

User (Licensee, Recipient): Anyone who uses any distributed work.

Use License: A license applied by a Distributor to a work you receive.

Redistribution: Redistribution is the distribution of a work (derived work, derivative works) used by a user of a work as 1) as it is, 2) modified work, or 3) as part of a work. Redistributions are referred to as redistributions.

Distribution License: The license you apply to a Redistribution when you distribute it.

Relicense: The application of a new (fixed) license instead of any license applied.

Optional Clause: A clause that is disabled in the default state of the license, but may be activated if the Distributor explicitly adds it.

In the embodiment of the present invention, a method for checking a conflict between two licenses when a user of any work to which an open source license is applied intends to redistribute to a license different from the license applied to the original work. That is, for convenience of description, a method of checking a conflict between a use license and a distribution license will be described as an example. However, the embodiment of the present invention may be applied to a method for checking a conflict between any two licenses, in which case the 'use license' may be generalized to 'first license' and the distribution license may be generalized to 'second license'.

If a work is distributed under any use license, the user of the original work must comply with the terms of that use license. In addition, if you intend to redistribute a work distributed under any use license under any distribution license, the user of the redistributed work must follow the distribution license you applied instead of the use license of the original work. The work that is distributed, in particular the licenses that apply to the FOSS software, generally sets forth the rights to grant the use of the work, the prohibitions, and the matters to be observed at the time of redistribution. In particular, if any use license imposes any restrictions on redistribution, you must select a distribution license under that restriction. This restriction refers to any restriction that is directly or indirectly related to redistribution.

For this reason, if you wish to redistribute any distribution license for redistribution, you must ensure that there is no conflict between the distribution license and the use license.

In the embodiment of the present invention, the license compatibility problem may be defined as follows. The set of licenses is L ₁ = {l ₁ , l ₂ , ...}, the set of feature points is FP = {fp ₁ , fp ₂ , ...}, and the set of representation values for the feature points is ET = {NoMention, Positive , Negative}, and the set of compatibility decision values may be CS = {Compatible, Suspicious, Incompatible}. Here, the feature points refer to respective provisions or provisions indicating a connection relationship, distribution obligations, modifications, rights to patents, private use, license maintenance, trademark use rights, and the like, in any license.

Each license l _i is the representation of all feature points FP.

Can be defined by assigning from the contents of the license. The expression values for the feature points can be defined by analyzing the contents of the license manually or automatically.

According to the above definition, the feature point profile fpp _x can be defined as follows.

From which the license l _i for each feature point feature points of the profile of the set of profiles set of feature point profile for a license l _i

Can be defined as In particular, redistribution issues between licenses consist of a use license l _o (original license) and a distribution license l _t (target license) ({l _o , l _t } ⊂ L).

In the embodiment of the present invention, through the comprehensive analysis of 78 FOSS licenses, 23 feature points were selected as the representative feature points required for compatibility verification of the FOSS license. However, these feature points are only examples, and the feature points may be modified, deleted, or added as much as possible.

1. (1) No further restriction

Restrictions on sublicenses (such as sublicense, relicense, etc.) that limit the rights of the user (recipient) in addition to those expressly provided in such license

2. (2) Keep the same license (Copyleft)

When receiving, redistributing or redistributing source code distributed under a specific license, the redistribution under the same license as that applied to the source code at the time of receipt is required.

3. (3) No license fee, Royalty free

No royalty fee for copyright use of source code

· The minimum deployment charges for distribution do not apply.

· Service charges do not apply.

· It is distinguished from No license fee and Royalty free for patent.

4. Source Code related

(4) Code disclosure

Source Code Disclosure (Original Source Code or Original + Modified Source Code)

A clause exists that specifies that source code can be received (for example, to receive the complete machine-readable source code).

(5) Code provided

Specify how to provide the source code (post it on the web or via USB)

Provide source code agreement

Specify the source code warranty period

· Non-billable charges for distribution of source code (usually the minimum charges for distribution, so if a claim is not possible, show the clause in the matrix)

5. Notice maintenance

(6) Copyright notices maintenance

· Maintain copyright and copyright notices;

(7) Maintaining Author Attribution: Enter Contributor Information

(8) Legal notices: prepare and maintain notices on intellectual property reserved for the author or contributor

6. (9) Amendment Notice

When modifying the source code, specify the matters related to the modification (e.g. modification date and time, modification file name, modification scope, etc.)

7. Patent

(10) Patent implementation permission: To explicitly provide permission to use patent rights for source code, etc.

(11) Patent retaliation clause: expressly stipulates permission to use patent rights for source code, etc.

(12) Prohibition of discriminatory license: Prohibition of discrimination in granting patent license (Granting patent license to A, X to B)

8. Trademark related

(13) Ban on advertising purposes

(14) No Use of Trade Names, Trademarks or Service Marks

Do not use trade names, trademarks, or service marks

· Don't use names of contributors and copyright holders

· Specify 'name' specifically and prohibit the use of 'name'

9. Warranty related

(15) Disclaimer of Warranties: Optionally providing an obligation of guarantee through a contract between two parties is not applicable.

(16) Disclaimer: The provision of an obligation of liability selectively through a contract between two parties is not applicable.

10. (17) Permission of Reverse engineering

11. (18) DRM Prohibited

Reference: Article 3 of GPL 3.0 (Prohibition of Bypass on Technical Means)

12. (19) Provide Installation Information

Provide all information necessary to compile and install the provided code. Responsibilities of providing files, scripts, etc. for the recipient to modify the source code are not applicable.

13. (20) Governing Law

· Specify applicable law

· Court of jurisdiction

· Interpret the license in accordance with the definition of specific law

14. Relicensing Licenses

(21) 'Relicensing' to specific licenses

Specify the name of a specific license (e.g. convertible to GPL 2.0, etc.)

· Can be used in conjunction with a 'specific license' (e.g. GPL 3.0 and AGPL 3.0)

(22) Allow conversion to future license

15. (23) Optional provisions apply

Optionally add license terms as needed (features)

In step 110, an expression value for each feature point is input for a given use license l _o , and an expression value for each feature point is input for a given distribution license l _t .

In step 120, for the distribution license l _t , a profile set that is a set of feature point profiles defined by feature points and expression values

Define.

In the 130 step, the use license l _o, each based on the expression values of the feature point, a random distribution which feature point is set conflicts profile indicating conflicts with the feature point in the use license if it has any expression value (conflict of licenses for each feature point of the profile set) Defines the list of ps _i and the collision profile set cpsl (l _o , fp _x ). The list of conflict profile sets is determined by what representation the license has for each feature.

In general, you only need to consider expressions for homogeneous features when examining whether two licenses are compatible. For example, Code offerings and disclaimers are independent of each other, and No license fee, Royalty free, and license copies are independent of each other. In this case, the compatibility can be determined by checking only the identity of the feature point profile of the use license and the distribution license. In this case, the collision profile set for each feature point is sufficient if one element is the 'collision profile'.

However, compatibility of feature points, such as additional restriction prohibitions or equal licensing requirements, must take into account the expression values of other feature points as well as their own expression values. Due to this problem, 'collision profile set' is defined for each feature point instead of 'collision profile'. For example, the collision profile set for the i th feature point may include only the feature profile for the i th feature point (if there is only one element of the collision profile set), or the other j th feature point with the feature profile for the i th feature point. It may also include a feature point profile for the case (if more than one element of the collision profile set).

In step 140, it is determined whether the use license and the distribution license collide by comparing each conflict profile set ps _i included in the list of conflict profile sets cpsl (l _o , fp _x ) with the profile set ps (l _t ) of the distribution license. do. Where a conflicting profile set ps _i ⊂ cpsl (l _o , fp _x ) is ps _i ⊂ ps (l _t ), that is, a conflicting profile set ps _i belongs to the distribution license's profile set ps (l _t ) Use licenses and distribution licenses can be considered conflicting.

In the same manner as above, a judgment set profile and a judgment profile indicating whether to reserve a judgment on whether or not to collide with a set of profiles for judgment reservations, i. You can define a list of sets hpsl (l _o , fp _x ) and determine that there is a 'probable' conflict between the use license and the distribution license if any of the reserved profile sets are part of the distribution license's profile set ps (l _t ). have. In this case, the user may be notified of matters related to the corresponding feature point and left to the user's judgment.

2 and 3 illustrate a flowchart of a method for checking a collision between licenses according to another embodiment of the present invention. This embodiment is a recursive collision checking method considering the license selection clause and the conversion clause, and is composed of Routine 1 (FIG. 2) and Routine 2 (FIG. 3).

The optional provisions are invalid in the default state of the license, but are restrictions and permissions that may be valid at the discretion of the distributor. Even if the restrictions in the use license are not included in the distribution license by default, the use license and the distribution license can be compatible by deploying the user with the corresponding selection in the distribution license.

In addition, if a use license contains a translation clause, that is, a provision for redistribution of a work distributed under a use license to another license specified by the conversion clause, the use license and distribution license are indirectly provided that the specified license and distribution license are compatible. It is compatible.

Referring to FIG. 2, in step 100, a collision checking method between the use license and the distribution license is checked through the collision checking method described above with reference to FIG. 1.

In step 210, if it is determined to be compatible, the process proceeds to step 250 to determine compatibility.

In step 210, if it is determined that there is a conflict, the process proceeds to step 220, in which it is determined whether the distribution license has a selection clause or the use license has a conversion clause, that is, whether to allow conversion to another license.

If the distribution license does not have an optional clause in step 220 and the use license does not have a conversion clause, the process proceeds to step 260 to determine a conflict (incompatibility).

If the distribution license has an optional clause at step 220 or the use license has a conversion clause, the process proceeds to step 230 and the license is checked again according to the flowchart shown in FIG. 3 (call Routine 2).

If it is determined in step 240 that the retest according to Routine 2 is compatible, the process proceeds to step 250 to determine compatibility.

In step 240, if it is determined that the collision results from the retest according to Routine 2, the process proceeds to step 260 to determine a collision (incompatibility).

Referring to FIG. 3, in step 310, it is determined whether a feature point that is not included in the distribution license but included only in the use license exists. These feature points correspond to feature points whose expression value is 'NoMention' in the case of a distribution license and 'Positive' or 'Negative' in the case of a use license.

If there are no feature points included in the use license and not included in the distribution license, the process proceeds to step 350 and, if present, the process proceeds to step 320.

In step 320, it is determined whether all of the feature points included in the use license are included in the selection clause of the distribution license. If the feature points included only in the use license are not included in the selection clause of the distribution license, the process proceeds to step 350, and if all are included, the process proceeds to step 330.

In step 330, instead of the distribution license, the license in which the selection clause is added to the distribution license is checked according to the flowchart of FIG. 2 (call Routine 1).

In step 340, if it is determined that the result of the routine 1 is compatible, the process proceeds to step 370 to determine compatibility.

In step 340, if it is determined that the collision results from the execution of Routine 1, the flow proceeds to step 350.

In step 350, instead of the use license, the license is checked for a license conflict according to the flowchart of FIG. 2 with respect to another license to which the use license allows conversion (call Routine 1).

In step 360, if it is determined that any of the other licenses for which the use license is allowed to be converted is compatible with the distribution license, the process proceeds to step 370 to determine compatibility.

If it is determined in step 360 that all of the other licenses for which the use license permits conversion conflict with the distribution license, the process proceeds to step 380 to determine a conflict (incompatibility).

As mentioned earlier, 23 feature points were selected from 78 FOSS licenses and 10 licenses (GPL 2.0, GPL 3.0, BSD-3, MIT, Apache 2.0, MPL 2.0, MS-RL, CDDL 1.0, EPL 1.0, and CeCILL). For 2.1) a collision test was performed according to an embodiment of the present invention. 4 shows the license compatibility matrix accordingly.

Referring to FIG. 4, GPL 2.0 is not compatible with GPL 3.0 on its own but is compatible with GPL 3.0 through another license that allows conversion. Similarly, CeCILL 2.1 is not compatible with GPL 2.0 or GPL 3.0 on its own, but is compatible with GPL 2.0 and GPL 3.0 through another license that allows conversion.

Meanwhile, the above-described embodiments of the present invention can be written as a program that can be executed in a computer, and can be implemented in a general-purpose digital computer that operates the program using a computer-readable recording medium. The computer-readable recording medium may include a storage medium such as a magnetic storage medium (eg, a ROM, a floppy disk, a hard disk, etc.) and an optical reading medium (eg, a CD-ROM, a DVD, etc.).

So far I looked at the center of the preferred embodiment for the present invention. Those skilled in the art will appreciate that the present invention can be implemented in a modified form without departing from the essential features of the present invention. Therefore, the disclosed embodiments should be considered in descriptive sense only and not for purposes of limitation. The scope of the present invention is shown in the claims rather than the foregoing description, and all differences within the scope will be construed as being included in the present invention.

The present invention can be used in the field of software development for license checking of open source software.

Claims

In the method of checking for conflicts between open source licenses,

(a) receiving an expression value for each feature point for a given first license and receiving an expression value for each feature point for a given second license; And

(b) determining whether a collision between the first license and the second license is made using an expression value for each feature point of the first license and an expression value for each feature point of the second license. Collision detection method.
The method of claim 1,

In step (b),

(b1) defining, for the second license, a profile set that is a set of feature point profiles defined by feature points and expression values;

(b2) a collision profile set indicating which feature point of any license has a corresponding feature point of the first license based on the expression value of each feature point of the first license, and which feature value has any representation value for each feature point; and Defining a list of conflict profile sets; And

(b3) comparing each conflict profile set included in the conflict profile set list with a profile set of the second license to determine whether the first license and the second license collide with each other. Collision checking method.
The method of claim 2,

Step (b3),

And determining that the first license and the second license are in conflict when any conflict profile set included in the conflict profile set belongs to the profile set of the second license.
The method of claim 3,

If it is determined in step (b) that the first license and the second license are in conflict, there is a feature point included only in the first license and not included in the second license, and the second license is an optional clause. If all of the feature points included only in the first license are included in the selection clause of the second license,

And performing the steps (a) and (b) for a license in which an optional clause corresponding to a feature point included only in the first license is added to the second license instead of the second license. Crash detection method.
The method of claim 3,

If it is determined in step (b) that the first license and the second license are in conflict, if the first license allows conversion to a license other than the first license,

And performing the steps (a) and (b) for the other license instead of the first license.
A computer-readable recording medium having recorded thereon a program for executing a method for checking a conflict between open source licenses according to any one of claims 1 to 5.