08-30-2018, 04:12 PM
Solving License Compliance at the Source: Adding SPDX License IDs
<div style="margin: 5px 5% 10px 5%;"><img src="http://www.sickgaming.net/blog/wp-content/uploads/2018/08/solving-license-compliance-at-the-source-adding-spdx-license-ids.jpg" width="1874" height="1140" title="" alt="" /></div><div><div><img src="http://www.sickgaming.net/blog/wp-content/uploads/2018/08/solving-license-compliance-at-the-source-adding-spdx-license-ids.jpg" class="ff-og-image-inserted" /></div>
<p>Accurately identifying the license for open source software is important for license compliance. However, determining the license can sometimes be difficult due to a lack of information or ambiguous information. Even when there is some licensing information present, a lack of consistent ways of expressing the license can make automating the task of license detection very difficult, thus requiring significant amounts of manual human effort. There are some commercial tools applying machine learning to this problem to reduce the false positives, and train the license scanners, but a better solution is to fix the problem at the upstream source.</p>
<p>In 2013, the <a href="https://git.denx.de/?p=u-boot.git;a=commit;h=eca3aeb352c964bdb28b8e191d6326370245e03f">U-boot project decided to use the SPDX license identifiers</a> in each source file instead of the GPL v2.0 or later header boilerplate that had been used up to that point. The initial commit message had an eloquent explanation of reasons behind this transition.</p>
<p>Read more at <a href="https://www.linuxfoundation.org/blog/2018/08/solving-license-compliance-at-the-source-adding-spdx-license-ids/">The Linux Foundation</a></p>
</div>
<div style="margin: 5px 5% 10px 5%;"><img src="http://www.sickgaming.net/blog/wp-content/uploads/2018/08/solving-license-compliance-at-the-source-adding-spdx-license-ids.jpg" width="1874" height="1140" title="" alt="" /></div><div><div><img src="http://www.sickgaming.net/blog/wp-content/uploads/2018/08/solving-license-compliance-at-the-source-adding-spdx-license-ids.jpg" class="ff-og-image-inserted" /></div>
<p>Accurately identifying the license for open source software is important for license compliance. However, determining the license can sometimes be difficult due to a lack of information or ambiguous information. Even when there is some licensing information present, a lack of consistent ways of expressing the license can make automating the task of license detection very difficult, thus requiring significant amounts of manual human effort. There are some commercial tools applying machine learning to this problem to reduce the false positives, and train the license scanners, but a better solution is to fix the problem at the upstream source.</p>
<p>In 2013, the <a href="https://git.denx.de/?p=u-boot.git;a=commit;h=eca3aeb352c964bdb28b8e191d6326370245e03f">U-boot project decided to use the SPDX license identifiers</a> in each source file instead of the GPL v2.0 or later header boilerplate that had been used up to that point. The initial commit message had an eloquent explanation of reasons behind this transition.</p>
<p>Read more at <a href="https://www.linuxfoundation.org/blog/2018/08/solving-license-compliance-at-the-source-adding-spdx-license-ids/">The Linux Foundation</a></p>
</div>