OPEN SOURCE SCANNER SOFTWARE SOFTWARE
OPEN SOURCE SCANNER SOFTWARE LICENSE

FOSSology is an open source scanning tool maintained by the Linux Foundation, but it doesnвЂ™t come with a pre-populated library of open source code or software repository, which you would need to build on your own. For example, Black Duck, WhiteSource, and FOSSA are well-known vendors that offer scanning tools on a subscription basis. There are many scanning tools and vendors to choose from. Alternatively, if you use a tool such as FOSSA, it will automatically scan new code as you build, integrating compliance into your development processes. You can perform scans periodically (e.g., on a quarterly or monthly basis) or at certain compliance checkpoints (e.g., each time prior to release of a new update). In other words, scanning tools alert you when incompatibly licensed OSS code slips through your other compliance checkpoints undetected.

OPEN SOURCE SCANNER SOFTWARE LICENSE

Source code scanning tools prevent these types of nightmare scenarios by comparing your programвЂ™s source code to code in publicly available repositories, identifying potential matches, and notifying you of what license terms apply to these matches. How Source Code Scanning Tools Help You Manage This Risk As you can imagine, this was potentially disastrous for companies whose business and monetization strategies depended on their ability to distribute downstream works on a proprietary closed source basis. Due to inclusion of the GPL-licensed file, these corporate users now had an obligation, under the terms of the GPL, to make the source code of their downstream works available under the terms of the GPL.

Many corporate adopters had already combined this OSS program, which they had believed was permissively licensed, with their own proprietary code and distributed it outside their organizations.

Because the GPL applied to the original file and all downstream works, its inclusion resulted in my clientвЂ™s entire OSS program becoming subject to the GPLвЂ™s copyleft license terms. Project leadership accepted the contribution, relying on its permissive source file header. A developer had taken a copyleft-licensed component from another OSS project, modified it, added a permissive license header, and contributed it to my clientвЂ™s OSS project. Open Source Projects and Contributors Sometimes Make Licensing MistakesД®ven for projects that require all inbound contributions to be licensed under the same overarching project license, there is still a risk that a contributor might make a well-intentioned mistake and contribute incompatibly licensed code that could end up in your companyвЂ™s downstream work with disastrous consequences.ДЇor example, I previously worked with a software project that discovered that its permissively licensed program had, for several release cycles, included a file licensed under the GNU GPL v.3 (GPL), a copyleft license. Thus, the overarching project license might not apply to the particular piece of code that you incorporate into your own programs. Many projects will accept contributions under OSS licenses that are different from the project license, either because the project does not vet licenses of incoming contributions at all, or because the projectвЂ™s leadership has decided to allow contributions under different but compatible licenses to enable sharing and collaboration with other OSS projects. This is because OSS projects evolve as a result of hundreds or thousands of contributions over time from many different sources. However, this project license doesnвЂ™t necessarily apply to each individual file within the project, or even to each line code within a single file. Most open source projects have an overarching license that applies to the project as a whole. Why the Official Project or License Is Rarely the Only License software composition analysis software) is essential to any open source compliance program. This is why regular use of source code scanning tools (a.k.a. Any OSS component could be subject to a myriad of OSS licenses that you might be unable to identify without performing a source code audit and scan. (For an explanation of the difference between copyleft and permissive OSS licenses, and why copyleft-licensed code cannot be used in proprietary applications, please see this blog post about OSS license types). This is true even if the only OSS code your company consumes comes from software projects with permissive rather than copyleft licenses. When you incorporate open source (OSS) code into larger programs, it is risky to assume that the official license for the project is the only license you need to comply with. By guest blogger Joanna Lee, Technology and Intellectual Property attorney, Partner at Gesmer Updegrove LLP

Open source scanner software