一句话:LiResolver 通过许可证语义抽取与依赖分析,推荐官方许可证或生成自定义许可证,解决开源软件许可证不兼容问题。
开源软件许可证规定了代码复用、分发和修改的条件,但一个项目引入多个带许可证的第三方组件时,许可证之间可能冲突,导致许可证不兼容。修复此类问题需要理解许可证语义并处理复杂的包依赖,成本很高。本文提出 LiResolver,一个细粒度、可扩展且灵活的工具:首先通过细粒度实体抽取和关系抽取理解许可证语义;然后检测不兼容问题,并优先推荐官方许可证来消解冲突;当没有官方许可证满足约束时,生成自定义许可证作为替代方案。实验表明,LiResolver 在问题定位上达到 4.09% 假阳性率和 0.02% 假阴性率,并在 230 个真实不兼容项目中成功解决 62.61%。作者还讨论了 OSS 开发者反馈及经验教训,并公开数据集与复现包。
Open source software (OSS) licenses regulate the conditions under which OSS can be legally reused, distributed, and modified. However, a common issue arises when incorporating third-party OSS accompanied with licenses, i.e., license incompatibility, which occurs when multiple licenses exist in one project and there are conflicts between them. Despite being problematic, fixing license incompatibility issues requires substantial efforts due to the lack of license understanding and complex package dependency. In this paper, we propose LiResolver, a fine-grained, scalable, and flexible tool to resolve license incompatibility issues for open source software. Specifically, it first understands the semantics of licenses through fine-grained entity extraction and relation extraction. Then, it detects and resolves license incompatibility issues by recommending official licenses in priority. When no official licenses can satisfy the constraints, it generates a custom license as an alternative solution. Comprehensive experiments demonstrate the effectiveness of LiResolver, with 4.09% false positive (FP) rate and 0.02% false negative (FN) rate for incompatibility issue localization, and 62.61% of 230 real-world incompatible projects resolved by LiResolver. We discuss the feedback from OSS developers and the lessons learned from this work. All the datasets and the replication package of LiResolver have been made publicly available to facilitate follow-up research.
DOI 原文 · arXiv · PDF(开放获取) · DBLP
@inproceedings{XuGFLCL23,
title = {LiResolver: License Incompatibility Resolution for Open Source Software},
author = {Sihan Xu and Ya Gao and Lingling Fan and Linyu Li and Xiangrui Cai and Zheli Liu},
booktitle = {ISSTA},
year = {2023},
doi = {10.1145/3597926.3598085}
}