A sentence-matching method for automatic license identification of source code files

Abstract

The reuse of free and open source software (FOSS) components is becoming more prevalent. One of the major challenges in finding the right component is finding one that has a license that is adequate for its intended use. The license of a FOSS component is determined by the licenses of its source code files. In this paper, we describe the challenges of identifying the license under which source code is made available, and propose a sentence-based matching algorithm to automatically do it. We demonstrate the feasibility of our approach by implementing a tool named Ninka.We performed an evaluation that shows that Ninka outperforms other methods of license identification in precision and speed. We also performed an empirical study on 0.8 million source code files of Debian that highlight interesting facts about the manner in which licenses are used by FOSS.

On the Detection of Licenses Violations in the Android Ecosystem

“…Even though Ninka does a great job at identifying license identification from text files [1], it relies blindly on the textual information declared in the files and in some cases fail to recognize the license of the files. More over in case where the license information is missing, Ninka reports NONE.…”

“…It includes copyright information, such as the names of contributors to a source code file, the copyright owner, warranty, and liability statements. Many tools have been proposed to identify License statements in source files or license files (e.g., README files): Ninka [1], FOSSology [9] and OSLC 1 . In the following, we discuss each of these tools in more details.…”

Identifying licensing of jar archives using a code-search approach

“…To address RQ1, we use the approach described in Section IV to retrieve, from Google Code Search, the licenses of .class files contained in jar archives. At the same time, we take the source code from which the jars were produced, and classify the licenses contained in it using the automatic license identification tool Ninka [18]. Ninka was created to identify the license of source code files only and outperforms FOSSology in both accuracy (reporting the correct license name and version in a source code file) and speed (runs an order of magnitude faster) as illustrated in Table III 12 .…”

On the Variability of the BSD and MIT Licenses

“…The Open Source Initiate 1 (OSI), responsible for the definition of open source, has approved 70 licenses 2 The Software Package Data eXchange 3 (SPDX), a consortium of non-profit and profit organizations that attempt to standardize licensing information across parties lists 306 different licenses 4 .…”

“…These licenses comprise a very large portion of open source licensed software; in a study it was found that 9.1% of Debian applications were licensed under BSD or MIT licenses [2]. Furthermore, these licenses, which are known as Academic [6] are of particular interest because they allow unlimited use the software with very few restrictions 5 .…”