论文标题
软件生态系统中的许可不兼容
License Incompatibilities in Software Ecosystems
论文作者
论文摘要
当代软件的特征是重复使用被宣布为依赖项的组件，并从包装管理人员/注册表中收到的组件，例如，NPM，PYPI，RubyGems，Maven Central等。直接和间接依赖关系通常会形成不透明的依赖网络，有时会导致这些内部的软件率互动。在本文中，我们研究了来自七个包装注册机构（货物，Maven，NPM，Nuget，Packagist，Pypi，Rubygems）的所有组件之间的许可使用和许可证不兼容，并对GNU Affero General Public License（AGPL）造成的许可不兼容性进行了仔细研究。我们发现，使用许可的相对数量在生态系统之间变化（MIT和Apache之类的允许许可是最常见的），直接许可的数量从货物中的低2.3％到PYPI的20.8％到PYPI的20.8％，而直接许可的直接量只有较低的直接许可证是由AGPLESENSE造成的。包裹违反了间接依赖性的AGPL许可。我们的结果表明，重复使用PYPI或MAVEN包的应用程序不太可能面临许可不兼容，这可能意味着必须在分发（PYPI）上开源应用程序（PYPI），或者一旦公开提供作为Web应用程序（Maven）。
Contemporary software is characterized by reuse of components that are declared as dependencies and that are received from package managers/registries, such as, NPM, PyPI, RubyGems, Maven Central, etc. Direct and indirect dependency relations often form opaque dependency networks, that sometimes lead to conflicting software licenses within these. In this paper, we study license use and license incompatibilities between all components from seven package registries (Cargo, Maven, NPM, NuGet, Packagist, PyPI, RubyGems) with a closer investigation of license incompatibilities caused by the GNU Affero General Public License (AGPL). We find that the relative amount of used licenses vary between ecosystems (permissive licenses such as MIT and Apache are most frequent), that the number of direct license incompatibilities ranges from low 2.3% in Cargo to a large 20.8% in PyPI, that only a low amount of direct license incompatibilities are caused by AGPL licenses (max. 0.04% in PyPI), but that a whopping 6.62% of Maven packages are violating the AGPL license of an indirect dependency. Our results suggest that it is not too unlikely that applications that are reusing packages from PyPI or Maven are confronted with license incompatibilities that could mean that applications would have to be open-sourced on distribution (PyPI) or as soon as they are publicly available as web-applications (Maven).
