CURRICULUM - OpenChain€¢ The patent owner has the right to stop anybody from exercising that...
Transcript of CURRICULUM - OpenChain€¢ The patent owner has the right to stop anybody from exercising that...
These slides do not contain legal advice
CURRICULUMFOSSTrainingReferenceDeck,Version2FINALDRAFTDesignedfortheOpenChainSpecification1.0
ReleasedundertheCreativeCommonsCC01.0Universal license.
TheseslidesfollowUSlaw.Differentlegaljurisdictionsmayhavedifferentlegalrequirements.Thisshouldbetakenintoaccountwhenusingtheseslidesaspartofacompliancetrainingprogram.
Contents1. What is Intellectual Property?2. Introduction to FOSS
Licenses3. Introduction to FOSS
Compliance4. Key Software Concepts for
FOSS Review
5. Running a FOSS Review6. End to End Compliance
Management (Example Process)
7. Avoiding Compliance Pitfalls
FOSS Policy• <<placeholder slide to identify where the FOSS policy can be found
(OpenChain Specification 1.0, section 1.1.1)>>
CHAPTER 1What is Intellectual Property?
What is “Intellectual Property”?• Copyright: protects original works of authorship
• Protects expression (not the underlying idea) • Software, books, audiovisual materials, semiconductor masks
• Patents: useful inventions that are novel, useful, non-obvious • Limited monopoly to incentivize innovation
• Trade secrets: protects confidential and valuable information• Trademarks: protects marks (word, logos, slogans, color, etc.) that identify the
source of the product• Consumer and brand protection; avoid consumer confusion and brand dilution
This chapter will focus on copyright and patents, the areas most relevant to FOSS compliance
Copyright concepts in software• Basic rule = copyright protects creative works• Copyright generally applies to literary works, such as books, movies,
pictures, music, maps• Software is protected by copyright, not the functionality (that’s protected by
patents) but the expression (creativity in implementation details)• The copyright owner only has control over the work that he or she created,
not someone else’s independent creation
Copyright rights most relevant to software• The right to reproduce the software – making copies• The right to create "derivative works" – making modifications
• Thetermderivativeworkreferstoanewworkbaseduponanoriginalworktowhichenoughoriginalcreativeworkhasbeenaddedsothatthenewworkrepresentsanoriginalworkofauthorshipratherthanacopy(notethatthisisatermofartunderUSlaw)
• The right to distribute• Distributionisgenerallyviewedastheprovisionofacopyofapieceofsoftwareinbinaryorsourcecodeformtoanotherentity(anindividualororganizationoutsideyourcompanyororganization)
Note:Theinterpretationofwhatconstitutesa“derivativework”ora“distribution”issubjecttodebateintheFOSScommunityandwithinFOSSlegalcircles
Patent concepts in software• Patents protect functionality - this can include a method of operation, such as
a computer program• Does not protect abstract ideas, laws of nature
• The patent owner has the right to stop anybody from exercising that functionality, regardless of independent creation
• Other parties who want to use the technology may seek a patent license (which may grant rights to use, make, have made, sell, offer for sale, and import the technology)
Licenses• A "license" is the way a copyright or patent holder gives permission or
rights to someone else• The license can be limited to:
• Types of use allowed (distribution, derivative works / to make, have made, manufacture)• Exclusive or non-exclusive terms• Geographical scope• Perpetual or time limited duration
• The license can have conditions on the grants, meaning you only get the license if you comply with certain obligations• E.g, provide attribution, give a reciprocal license
• May also include contractual terms regarding warranties, indemnification, support, upgrade, maintenance
Check Your Understanding• Whattypeofmaterialdoescopyrightlawprotect?• Whatcopyrightrightsaremostimportantforsoftware?• Cansoftwarebesubjecttoapatent?• Whatrightsdoesapatentgivetothepatentowner?• Ifyouindependentlydevelopyourownsoftware,isitpossiblethatyoumightneedacopyrightlicensefromathirdpartyforthatsoftware?Apatentlicense?
CHAPTER2IntroductiontoFOSSLicenses
FOSSLicenses• FreeandFOSS Softwarelicensesgenerallymakesourcecodeavailableundertermsthatallowformodificationandredistribution
• FOSSlicensesmayhaveconditionsrelatedtoprovidingattributions,copyrightstatementpreservation,orawrittenoffertomakethesourcecodeavailable
• OnepopularsetoflicensesarethoseapprovedbytheFOSS Initiative(OSI)basedontheirFOSS Definition(OSD).AcompletelistofOSI-approvedlicensesisavailableathttp://www.opensource.org/licenses/
PermissiveFOSSLicenses• PermissiveFOSSlicense- atermusedoftentodescribeminimallyrestrictiveFOSSlicenses
• Example:BSD-3-Clause• TheBSDlicenseisanexampleofapermissive licensethatallowsunlimitedredistributionforanypurposeaslongasitscopyrightnoticesandthelicense'sdisclaimersofwarrantyaremaintained
• Thelicensecontainsaclauserestrictinguseofthenamesofcontributorsforendorsementofaderivedworkwithoutspecificpermission
• Otherexamples:MIT,Apache-2.0
LicenseReciprocity&CopyleftLicenses• Somelicensesrequirethedistributionofderivativeworks(orsoftwareinthesamefile,sameprogramorotherboundary)underthesametermsastheoriginalwork
• Thisisreferredtoasa”Copyleft","reciprocal",or"hereditary"effect• ExampleoflicensereciprocityfromtheGPLversion2.0:
"Youmustcauseanyworkthatyoudistributeorpublish,thatinwholeorinpartcontainsorisderivedfromtheProgramoranypartthereof,tobelicensed...underthetermsofthisLicense."
• LicensesthatincludereciprocityorCopyleftclausesincludeallversionsoftheGPL,LGPL,AGPL,MPLandCDDL
• Copyleftlicensesmayincludesourceavailabilityobligations
ProprietaryLicenseorClosedSource• Aproprietarysoftwarelicense(orcommerciallicenseorEULA)hasrestrictionsontheusage,modificationordistributionofthesoftware
• Proprietarylicensesofteninvolvepaymentoralicensefee• Proprietarylicensesareuniquetoeachvendor- thereareasmanyvariationsofproprietarylicensesastherearevendorsandeachmustbeevaluatedindividually
• FOSSdevelopersoftenusetheterm"proprietary"todescribeacommercialnon-FOSSlicenseeventhoughbothFOSSandproprietarylicensesarebasedonintellectualpropertyandprovidealicensegranttothatproperty
OtherLicensingSituations• Freeware- softwaredistributedunderaproprietarylicenseatnoorverylowcost
• Thesourcecodemayormaynotbeavailable,andcreationofderivativeworksisusuallyrestricted• Freewaresoftwareisusuallyfully functional (no lockedfeatures)andavailableforunlimiteduse(nolockingondaysofusage)
• Freewaresoftwarelicensesusuallyimposerestrictionsinrelationtocopying, distributing, andmakingderivativeworksofthesoftware,aswellasrestrictionsonthetypeofusage(personal, commercial,academic,etc.)
• Shareware- proprietarysoftwareprovidedtousersonatrialbasis,foralimitedtime,freeofchargeandwithlimitedfunctionalitiesorfeatures• Thegoalofsharewareistogivepotentialbuyerstheopportunitytousetheprogramandjudgeitsusefulnessbeforepurchasingalicenseforthefullversionofthesoftware
• MostcompaniesareveryleeryofShareware,becauseSharewarevendorsoftenapproachcompaniesforlargelicensepaymentsafterthesoftwarehasfreelypropagatedwithintheirorganizations.
• FreewareandSharewarearenotFOSS
PublicDomain• Thetermpublicdomainreferstointellectualpropertynotprotectedbylawandthereforeusablebythepublicwithoutrequiringalicense
• Developersmayincludeapublicdomaindeclaration withtheirsoftware• E.g.,"Allofthecodeanddocumentationinthissoftwarehasbeendedicatedtothepublicdomainbytheauthors."
• ThepublicdomaindeclarationisnotthesameasaFOSSlicense
• Apublicdomaindeclarationattemptstowaiveoreliminateanyintellectualpropertyrightsthatthedevelopersmayhaveinthesoftwaretomakeitclearthatitcanbeusedwithoutrestriction,buttheenforceabilityofthesedeclarationsissubjecttodisputewithintheFOSScommunity
• Oftenthepublicdomaindeclarationisaccompaniedbyotherterms,suchaswarrantydisclaimers.Insuchcases,thesoftwaremaybeviewedasbeingunderalicenseratherthanbeinginthepublicdomain
LicenseCompatibility• Licensecompatibilityistheprocessofensuringthatlicensetermsdonotconflict.• Ifonelicenserequiresyoutodosomethingandanotherprohibitsdoingthat,thelicensesconflictandarenotcompatibleifthecombinationofthetwosoftwaremodulestriggertheobligationsunderalicense.
• OneexampleisthattheGPLv2extendsitsobligationsto"derivativeworks."• IfasecondsoftwaremoduleiscombinedwithaGPLv2licensedmodulethatisnotaderivativeworkoftheGPLv2licensedmodule,thesecondsoftwaremoduleisnotsubjecttoGPLv2.
• Thedefinitionof"derivativework"issubjecttodifferentviewsintheFOSScommunity.
NoticesNotices,suchastextincommentsinfileheaders,oftenprovideauthorshipandlicensinginformation.FOSSlicensesmayalsorequiretheplacementofnoticesinsourcecodeordocumentationtogivecredittotheauthor(anattribution)ortomakeitclearthesoftwareincludesmodifications.• Copyrightnotice- anidentifierplacedoncopiesoftheworktoinformtheworldofcopyrightownership.Example:Copyright©A.Person(2016).
• Licensenotice - anoticethatacknowledgesthelicensetermsandconditionsoftheFOSSincludedintheproduct.
• Attributionnotice- anoticeincludedintheproductreleasethatacknowledgestheidentityoftheoriginalauthorsoftheFOSSincludedintheproduct.
• Modificationnotice– anoticethatyouhavemademodificationstothesourcecodeofafile,suchasaddingyourcopyrightnoticetothetopofthefile.
Multi-Licensing• Multi-licensingreferstothepracticeofdistributingsoftwareundertwoormoredifferentsetsoftermsandconditions• E.g.,whensoftwareis“duallicensed,”recipientscanchoosetouseordistributethesoftwareunderachoiceoftwolicenses
• Note:Thisshouldnotbeconfusedforsituationsinwhichalicensorimposesmorethanonelicense,andyoumustcomplywithallofthem
CheckYourUnderstanding• WhatisaFOSSlicense?• WhataretypicalobligationsofapermissiveFOSSlicense?• NamesomepermissiveFOSSlicenses.• Whatdoeslicensereciprocitymean?• Namesomecopyleft-stylelicenses.• Whatneedstobedistributedforcodeusedunderacopyleftlicense?• AreFreewareandSharewaresoftwareconsideredFOSS?• Whatisamulti-license?• Whatinformationmayyoufind inFOSSNotices,andhowmaythenoticesbeused?
CHAPTER 3Introduction to FOSS Compliance
FOSSComplianceGoals• Knowyourobligations(detectandtrackuseofFOSS).Youshouldhaveaprocessforidentifying,trackingandarchivingalistofallFOSScomponents(andtheirrespectiveidentifiedlicenses)fromwhichyoursoftwareiscomprised.
• SatisfyallthelicenseobligationsfortheFOSSthatisused.YourprogramshouldidentifyandhandletypicalFOSSusecasesthatresultfromyourorganization’sbusinesspractices.
WhatComplianceObligationsMustBeSatisfied?Dependingonthelicense(s)involved,obligationscouldconsistof:• AttributionandNotices. Inclusionofcopyrightandlicensetextinthesourcecodeand/orproductdocumentationoruserinterface,sothatdownstreamusersknowtheoriginofthesoftwareandtheirrightsunderthelicenses
• Sourcecodeavailability.Providingsourcecodefororiginalwork,forcombinedworkormodifications,aswellasbuildscripts(scriptsthatcontrolthebuildprocess)
Theseobligationsmaytriggeruponkeyevents,suchas:• Externaldistribution• Whetheryouhavemademodifications
FOSS Conditions & RestrictionsDepending on the FOSS license used, you may need to comply with one or more of the following types of conditions and restrictions:• Retain copyright (and other) notices• Provide a copy of the license• Provide notice of modifications• Modified versions must have a different name to avoid confusion• Provide access to source code (whether you modified it or not)• Maintain modified versions (derivative works) under the same license• Provide attribution• Do not use the project or copyright holder name or trademark • Do not restrict others of the rights granted under the original license• Termination clauses (if you breach, you lose license)
FOSS Compliance Triggers: Distribution• Dissemination of material to an outside entity
• Applications downloaded to a user’s machine or mobile device• JavaScript, web client, or other code that is downloaded to the user’s machine
• For some FOSS licenses, access via a computer network can be a “trigger event.” The trigger is"users interacting with it remotely through a computer network."• Some licenses define the trigger event to include permitting access to software running
on a server (e.g., all versions of the Affero GPL if the software is modified)
FOSS Compliance Triggers: Modification• Changes to the existing program (e.g., additions, deletions of code in a file,
combining components together)• Modifications may constitute a derivative work, and FOSS authors may limit or
place obligations on modifications• Modifications may trigger FOSS obligations, such as:
• Notice of modification• Providing accompanying source code
FOSSComplianceProgramOrganizationsthathavebeensuccessfulatFOSScompliancehavecreatedtheirownFOSSCompliancePrograms (consistingofpolicies,processes,trainingandtools)to:1. FacilitateeffectiveusageofFOSSincommercialproducts2. RespectFOSSdeveloperrightsandcomplywithlicenseobligations3. Contributeandparticipateinopencommunities
ImplementingCompliancePracticesPreparebusinessprocessesandsufficientstafftohandle:• IdentificationoftheoriginandlicenseofFOSSsoftware• TrackingFOSSsoftwarewithinthedevelopmentprocess• PerformingFOSSreviewandidentifyinglicenseobligations• Fulfillmentoflicenseobligationswhenproductships• OversightforFOSSComplianceProgram,creationofpolicy,andcompliancedecisions• Training
ComplianceBenefitsBenefitsofarobustFOSSComplianceprograminclude:
• IncreasedunderstandingofthebenefitsofFOSSandhowitimpactsyourorganization
• IncreasedunderstandingofthecostsandrisksassociatedwithusingFOSS
• BetterrelationswiththeFOSScommunityandFOSSorganizations
• IncreasedknowledgeofavailableFOSSsolutions
CheckYourUnderstanding• WhatdoesFOSScompliancemean?
• WhataretwomaingoalsofaFOSSComplianceProgram?
• ListanddescribeimportantbusinesspracticesofaFOSSComplianceProgram.
• WhataresomebenefitsofaFOSSComplianceProgram?
CHAPTER 4Key Software Concepts for FOSS Review
How do you want to use to the component?Common scenarios include:• Incorporation• Linking• Modification• Translation
IncorporationA developer may copy portions of a FOSS component into your software product.
Relevant terms include:• Integrating• Merging• Pasting• Adapting• Inserting
LinkingA developer may link or join a FOSS component with your software product.
Relevant terms include:• Static/Dynamic Linking• Pairing• Combining• Utilizing• Packaging• Creating interdependency
ModificationA developer may make changes to a FOSS component, including:
• Adding/injecting new code into the FOSS component
• Fixing, optimizing or making changes to the FOSS component
• Deleting or removing code
Fixing OptimizingChanging
AddingInjecting
Deleting
TranslationA developer may transform the code from one state to another.
Examples include:• Translating Chinese to English • Converting C++ to Java • Compiling VHDL in a mask or net list• Compiling into binary
Development ToolsDevelopment tools may perform some of these operations behind the scenes.
For example, a tool may inject portions of its own code into output of the tool.
Inject material
Modify the material
Translate the material
How is the FOSS component distributed?• Who receives the software?
• Customer/Partner• Community project
• What format for delivery?• Source code delivery• Binary delivery• Pre-loaded onto hardware
Check Your Understanding• Whatisincorporation?• Whatislinking?• Whatismodification?• Whatistranslation?• Whatfactorsareimportantinassessingadistribution?
CHAPTER 5Running a FOSS Review
FOSSReview• AkeyelementtoaFOSSComplianceProgramisaFOSSReviewprocess,throughwhichacompanycananalyzeanddetermineitsFOSSobligations
• TheFOSSReviewprocessincludesthefollowingsteps:• Gatherrelevantinformation• Analyzeanddeterminelicenseobligations• Provideguidanceinlightofcompanypolicyandbusinessobjectives
InitiatingaFOSSReview
TheFOSSReviewprocessshouldbeaccessibletoProgram/ProductManagers,EngineersandotherswhomaybeworkingwithFOSS.Note:ThisprocessmayalsostartwhenreceivingFOSS-basedsoftware fromoutsidevendors.
Initiate a FOSS Review
Product Manager
Program Manager
Engineer
Whatinformationdoyouneedtogather?WhenanalyzingFOSSusage,collectinformationabouttheidentityoftheFOSScomponent,itsorigin,andhowtheFOSScomponentwillbeused.Thismayinclude:
• Packagename• Version
• OriginaldownloadURL• LicenseandLicenseURL
• Description• Descriptionofmodifications
• Listofdependencies• Intendeduseinyourproduct
• Firstproductreleasethatwillincludethepackage
• Availabilityofsourcecode• Wherethesourcecodewillbemaintained
• Whetherthepackagehadpreviouslybeenapprovedforuseinanothercontext
• Inclusionoftechnologysubjecttoexportcontrol• Iffromanexternalvendor:
• Developmentteam'spointofcontact• Copyrightnotices,attribution,sourcecodeforvendormodificationsifneededtosatisfylicenseobligations
FOSSReviewTeam
AFOSSReviewalertsandengagesthevarioussupportgroupsthatworktogethertosupport,guide,coordinateandreviewtheuseofFOSS.Thisteammayinclude:
• Legalteamtoidentifyandevaluatelicenseobligations
• ScanningandtoolingsupportteamtohelpidentifyandtrackFOSSusage
• Specialistsworkingwithbusinessinterests,commerciallicensing,exportcompliance,etc.,whomaybeimpactedbyFOSSusage
Initiate a FOSS Review
Product Manager
Program Manager
EngineerLegal ScanningSpecialists
AnalyzingProposedFOSSUsage
TheFOSSReviewteamshouldassesstheinformationithasgatheredbeforeprovidingguidance,includingforissuessuchas:• Completeness,consistency,accuracy(codescanningtoolsmaybeusedtoscanforundisclosed FOSSusage)• Doesthedeclaredlicensematchwhatisinthecodefiles?• Doesthelicensetrulypermittheproposeduseofthesoftware?
Legal Scanning Specialists
WorkingthroughtheFOSSReview
WorkingthroughtheFOSSReviewprocessisinteractive.Theworkcrossesdisciplines,includingengineering,businessandlegalteams,andmayrequireinfollow-updiscussionsothatallpartiesunderstandtheunderlyingissues.Ultimately,theprocessshouldresultinclearguidanceonFOSSusage.
Initiate a FOSS Review
Product Manager
Program Manager
EngineerLegal ScanningSpecialists
Work
Guidance
FOSSReviewOversight
TheFOSSReviewprocessshouldhavesufficientoversightincasesofdisagreementbetweenanyofthepartiesinvolved,orwhenadecisionisparticularlyimportant.
Initiate a FOSS Review
Product Manager
Program Manager
EngineerLegal ScanningSpecialists
Work
Guidance
Executive Review Committee
CheckYourUnderstanding• WhatisthepurposeofaFOSSReview?• WhatisthefirstactionyoushouldtakeifyouwanttouseFOSScomponents?• WhatshouldyoudoifyouhaveaquestionaboutusingFOSS?• WhatkindsofinformationmightyoucollectforaFOSSreview?• Whatinformationhelpsidentifywhoislicensingthesoftware?• WhatadditionalinformationisimportantwhenreviewingaFOSScomponentfromanoutsidevendor?
• Whatstepscanbetakentoassess thequalityofinformationcollectedinaFOSSReview?
CHAPTER 6End to End Compliance Management (Example Process)
Introduction• CompliancemanagementconsistsofasetofactionsthatcontrolstheintakeanddistributionofFOSSusedinproducts(or"SuppliedSoftware"intheOpenChainspecification)
• TheresultofcomplianceduediligenceisanidentificationofallFOSSusedintheSuppliedSoftware.ItconfirmsthatallFOSSlicenseobligationshavebeenorwillbemet
• Smallcompaniesmayjustuseachecklistwhilelargerenterpriseswillhaveadetailedprocess.Thischapterprovidesanexampleofanenterpriseprocess.
Incoming FOSS
FOSS identified;FOSS obligations
metComplianceProcess
Incoming Software
Iden
tific
atio
n
Audi
t
Reso
lve
Issu
es
Revi
ews
Appr
oval
s
Regi
stra
tion
Notic
es
Verif
icat
ions
Dist
ribut
ion
Verif
icat
ions
ProprietarySoftware
3rd PartySoftware
FOSS
Outgoing Software
Notices & Attributions
Written Offer
Scan or audit source code – and –
Confirm origin andlicense of source
code
Resolve any audit issues in line withcompany FOSS policies
Identify FOSS components for
review
Verify source code packages for distribution
– and –Verify appropriate
notices are provided
Record approvedsoftware/versionin inventory per product and per
release
Publish source code,notices and provide
written offer
Review and approve compliance record of
FOSS software components
Compile noticesfor publication
Post publicationverifications
Example of Compliance Management End-to-End Process
Process Overview
• Pre-requisites:Theprocessmaybeginwithoneoftheseevents:- ThedevelopmentteamrequeststhereviewofaFOSScomponentoranoutgoingrelease
- DiscoveryofFOSSbeingusedwithoutproperauthorization
- DiscoveryofFOSSbeingusedaspartofthirdpartysoftware
• Outcome:• Acompliancerecordiscreated(orupdated)fortheFOSS
• Anauditisrequestedtoscanorreviewthesourcecode
Incoming:FOSS
Outgoing:FOSS +Mods
Iden
tific
atio
n
Audit
Resolve
Issue
s
Review
s
Approvals
Registratio
n
Notic
es
Verification
s
Distrib
ution
Verification
s
• Steps:• Incomingrequestsarerecorded• Scansofentireplatformmaybe
performed• Duediligenceonany3rd party
providedsoftware• RecognizeandreviewanyFOSS
components addedtoarepositorywithout anincomingrequest
IdentifyandbegintrackingFOSSfromallsources
Identify and Track FOSS Usage
Incoming:FOSS
Outgoing:FOSS +ModsAu
dit
iden
tification
Resolve
Issue
s
Review
s
Approvals
Registratio
n
Notic
es
Verifications
Distrib
ution
Verifications
• Pre-requisites:• Developmentteamprovidesa
compliancerecordwithinformationabouttheFOSSusage
• Incaseswherenorecordisprovidedbythedevelopmentteam,arecordcanbecreatedwhentheFOSScomponent isdiscovered
• Outcome:Anauditreportidentifyingtheoriginsandlicensesofthesourcecode
• Steps:• Sourcecodefortheauditisidentified• Sourcemaybescannedbyasoftware
tool• “Hits”fromtheauditorscanare
reviewedandverifiedastotheproperoriginofthecode
• Auditsorscansareperformediterativelybasedonthesoftwaredevelopmentandreleaselifecycles
IdentifyFOSScomponentsandtheiroriginandlicenses
Auditing Source Code
Incoming:FOSS
Outgoing:FOSS +Mods
Reso
lvin
g Is
sues
iden
tification
Audit
Review
s
Approvals
Registratio
n
Notic
es
Verifications
Distrib
ution
Verifications
• Pre-requisites:• Asourcecodeauditorscanhasbeen
completed• Anauditreportidentifiestheoriginsand
licensesofthesourcecodeandflagsfilesthatneedfurtherinvestigation
• Outcome:Aresolutionforeachoftheflaggedfilesinthereportandaresolutionforanyflaggedlicenseconflict
• Steps:• Providefeedbacktotheappropriate
engineerstoresolveissuesintheauditreportthatconflictwithyourFOSSpolicy
• Followupwithengineerstoconfirmthatthe issuesareresolved
Resolveallissuesidentifiedintheaudit
Resolving Issues
Incoming:FOSS
Outgoing:FOSS+Mods
Rev
iew
s
identification
Audit
ResolveIssues
Approvals
Registratio
n
Notices
Verifications
Distribution
Verifications
Pre-requisites:
• Sourcecodehasbeenaudited
• Allidentifiedissueshavebeenresolved
Outcome:• Ensurethesoftwareintheaudit
reportconformswithFOSSpolicies
• Preserveauditreportfindingsandmarkresolvedissuesasreadyforthenextstep(i.e.Approval)
Steps:• Includeappropriateauthority levelsin
reviewstaff
• ConductFOSSReviewsonauditedsourcecode,reviewsoftwarearchitectureandFOSSusage(seenextslidefortemplate)
• IdentifyobligationsunderFOSSlicenses
Reviewtheauditreportandconfirmanydiscoveredissuesareresolved
Performing Reviews
Proprietary
Legend
3rd PartyCommercial
GPL
LGPL
FOSSPermissive
FunctioncallSocketinterface
(fc)
(si)
Systemcall(sc)
Sharedheaders(sh)
UserSpace
KernelSpace
Hardware
[InsertComponents]
[InsertComponents]
[InsertComponents]
[Insertinteraction method]
[Insertinteraction method]
Architecture Review (Example Template)
• Basedontheresultsofthesoftwareauditandreviewinprevioussteps,
softwaremayormaynotbeapprovedforuse
• TheapprovalshouldspecifyversionsofapprovedFOSScomponents,the
approvedusagemodelforthecomponent,andanyotherapplicable
obligationsundertheFOSSlicense
• Approvalsshouldbemadeatappropriateauthoritylevels
Incoming:FOSS
Outgoing:FOSS +Mods
Appr
oval
s
iden
tification
Audit
Resolve
Issue
s
Review
s
Registratio
n
Notic
es
Verifications
Distrib
ution
Verifications
Approvals
• OnceaFOSScomponenthasbeenapprovedforusage inaproduct,it
shouldbeaddedtothesoftwareinventoryforthatproduct
• Theapprovalanditsconditionsshouldberegisteredinatrackingsystem
• Thetrackingsystemshouldmakeitclearthatanewapprovalisneededfora
newversionofaFOSScomponentorifanewusagemodelisproposed
Incoming:FOSS
Outgoing:FOSS +Mods
Regi
stra
tion
iden
tification
Audit
Resolve
Issue
s
Review
s
Approvals
Notic
es
Verifications
Distrib
ution
Verifications
Registration / Approval Tracking
• PrepareappropriatenoticesforanyFOSSusedinaproductrelease:- Acknowledge theuseofFOSSbyproviding fullcopyrightandattributionnotices- InformtheenduseroftheirproductonhowtoobtainacopyoftheFOSSsourcecode(whenapplicable,forexampleinthecaseofGPLandLGPL)
- ReproducetheentiretextofthelicenseagreementsfortheFOSScodeincluded intheproductasneeded
Incoming:FOSS
Outgoing:FOSS +ModsNo
tices
iden
tification
Audit
Resolve
Issue
s
Review
s
Approvals
Registratio
n
Verifications
Distrib
ution
Verifications
Notices
Incoming:FOSS
Outgoing:FOSS +Mods
Verif
icat
ions
iden
tification
Audit
Resolve
Issue
s
Review
s
Approvals
Registratio
n
Notic
es
Distrib
ution
Verifications
• Pre-requisites:• FOSScomponent hasbeenapprovedfor
usage• FOSScomponent hasbeenregisteredin
thesoftwareinventoryfortherelease• Appropriatenoticeshavebeen
prepared
• Outcome:• Thedistributionpackagecontainsonly
softwarethathasbeenreviewedandapproved
• "DistributedComplianceArtifacts"(asdefinedintheOpenChainspecification),includingappropriatenoticefilesareincludedinthedistributionpackageorotherdeliverymethod
• Steps:• VerifyFOSSpackagesdestined for
distributionhavebeen identifiedandapproved
• Verifythereviewedsourcecodematchesthebinaryequivalentsshippingintheproduct
• Verifyallappropriatenoticeshavebeenincluded toinformend-usersoftheirrighttorequestsourcecodeforidentifiedFOSS
• Verifycompliancewithotheridentifiedobligations
Verifythatdistributedsoftwarehasbeenreviewedandapproved
Pre-Distribution Verifications
Incoming:FOSS
Outgoing:FOSS +Mods
Dist
ribut
ion
iden
tification
Audit
Resolve
Issue
s
Review
s
Registratio
n
Notic
es
Verifications
Approvals
Verifications
• Pre-requisites:• Allpre-distributionverificationhasbeen
completedandnoissueisdiscovered
• Outcome:• Obligationstoprovideaccompanying
sourcecodearemet
• Steps:• Provideaccompanyingsourcecode
alongwithanyassociatedbuildtoolsanddocumentation(e.g.,byuploadingtoadistributionwebsiteorincludinginthedistributionpackage)
• Accompanyingsourcecodeisidentifiedwithlabelsastowhichproductandversiontowhichitcorresponds
Provideaccompanyingsourcecodeasrequired
Accompanying Source Code Distribution
Incoming:FOSS
Outgoing:FOSS +Mods
Verif
icat
ions
iden
tification
Audit
Resolve
Issue
s
Review
s
Approvals
Notic
es
Verifications
Distrib
ution
Registratio
n
• Pre-requisites:• Accompanyingsourcecodeisprovided
asmayberequired• Appropriatenoticeshavebeen
prepared
• Outcome:• VerifiedDistributedCompliance
Artifactsareappropriatelyprovided
• Steps:• Verifyaccompanyingsourcecode(if
any)hasbeenuploadedordistributedcorrectly
• Verifyuploadedordistributedsourcecodecorrespondstothesameversionthatwasapproved
• Verifynoticeshavebeenproperlypublishedandmadeavailable
• Verify other identifiedobligationsaremet
Validatecompliancewithlicenseobligations
Final Verifications
Check Your Understanding• Whatisinvolvedincomplianceduediligence(forourexampleprocess,describethestepsatahighlevel)?• Identification• Auditsourcecode• Resolvingissues• Performingreviews• Approvals• Registration/approvaltracking• Notices• Pre-distributionverifications• Accompanyingsourcecodedistribution• Verification
• Whatdoesanarchitecturereviewlookfor?
CHAPTER 7Avoiding Compliance Pitfalls
CompliancePitfallsThischapterwilldescribesomepotentialpitfallstoavoidinthecomplianceprocess:1. IntellectualProperty(IP)pitfalls2. LicenseCompliancepitfalls3. ComplianceProcesspitfalls
IntellectualPropertyPitfallsType&Description Discovery Avoidance
UnplannedinclusionofcopyleftFOSSintoproprietaryor3rdpartycode:
Thistypeoffailureoccursduringthedevelopmentprocesswhenengineersadd(orcutandpaste)FOSScodeintosourcecodethatisproprietary(toyoutoyouortoathirdparty)inconflictwithyourFOSSpolicies.
Thistypeoffailurecanbediscoveredbyscanningorauditingthe
sourcecodeforpossiblematcheswith:• FOSSsourcecode• Copyrightnotices
Automatedsourcecodescanningtoolsmaybeusedforthispurpose
Thistypeoffailurecanbeavoidedby:• Offeringtrainingtoengineeringstaff
tobringawarenesstocomplianceissuesandtothedifferenttypesandcategoriesofFOSSlicensesandtheimplicationsofincludingFOSSsourcecodeinproprietarysourcecode
• Conductingregularsourcecodescansorauditsforallthesourcecodeinthebuildenvironment(proprietary,3rd partyandFOSS)
IntellectualPropertyPitfallsType&Description Discovery Avoidance
UnplannedlinkingofcopyleftFOSSintoproprietarysourcecodeincertaincases(orviceversa):
Thistypeoffailureoccursasaresultoflinkingsoftware(FOSS,proprietary,3rd party)withconflictingorincompatiblelicenses.ThelegaleffectoflinkingissubjecttodebateintheFOSScommunity.
Thistypeoffailurecanbediscoveredusingthedependency trackingtoolthatallowsyoutodiscoverlinkagesbetweendifferentsoftwarecomponents.
Thistypeoffailurecanbeavoidedby:1. Offeringtrainingtoengineering
stafftoavoidlinkingsoftwarecomponentswithlicensesthatconflictwithyouFOSSpolicieswhichwilltakeapositiononthese legalrisks
2. Continuously runningthedependency trackingtooloveryourbuildenvironment
InclusionofproprietarycodeintocopyleftFOSSthroughsourcecodemodifications
ThistypeoffailurecanbediscoveredusingtheauditsorscanstoidentifyandanalyzethesourcecodeyouintroducedtotheFOSScomponent.
Thistypeoffailurescanbeavoidedby:1. Offeringtrainingtoengineering
staff2. Conductingregularcodeaudits
LicenseCompliancePitfallsType&Description Avoidance
FailuretoProvideAccompanyingSourceCode
Thistypeoffailurecanbeavoidedbymakingsourcecodecaptureandpublishingachecklistitemintheproductreleasecyclebeforetheproductbecomesavailableinthemarketplace.
ProvidingtheIncorrectVersionofAccompanyingSourceCode
Thistypeoffailurecanbeavoidedbyaddingaverificationstepintothecomplianceprocesstoensurethattheaccompanyingsourcecodeforthebinaryversionisbeingpublished.
FailuretoPublishAccompanyingSourceCodeforFOSSComponentModifications
Thistypeoffailurecanbeavoidedbyaddingaverificationstepintothecomplianceprocesstoensurethatsourcecodeformodificationsarepublished,ratherthanonlytheoriginalsourcecodefortheFOSScomponent
LicenseCompliancePitfalls
LicenseCompliancePitfallsType&Description Avoidance
FailuretomarkFOSSSourceCodeModifications:
FailuretomarkFOSSsourcecodethathasbeenchangedasrequiredbytheFOSSlicense
Thistypeoffailurecanbeavoidedby:1. Addingsourcecodemodificationmarkingasaverificationstepbefore
releasingthesourcecode2. Offeringtrainingtoengineeringstafftoensuretheyupdatecopyright
markingsorlicenseinformationofallFOSSorproprietarysoftwarethatisgoingtobereleasedtothepublic
ComplianceProcessFailuresDescription Avoidance Prevention
FailurebydeveloperstoseekapprovaltouseFOSS
ThistypeoffailurecanbeavoidedbyofferingtrainingtoEngineeringstaffonthecompany’sFOSSpoliciesandprocesses.
Thistypeoffailurecanbepreventedby:1. Conductingperiodicfullscanforthe
softwareplatformtodetectany“undeclared” FOSS usage
2. Offeringtrainingtoengineeringstaffonthecompany'sFOSSpoliciesandprocesses
3. Includingcomplianceintheemployeesperformancereview
FailuretotaketheFOSStraining
ThistypeoffailurecanbeavoidedbyensuringthatthecompletionoftheFOSStrainingispartoftheemployee’sprofessionaldevelopmentplananditismonitoredforcompletionaspartoftheperformancereview
ThistypeoffailurecanbepreventedbymandatingengineeringstafftotaketheFOSStrainingbyaspecificdate
ComplianceProcessFailuresDescription Avoidance Prevention
Failuretoauditthesourcecode
Thistypeoffailurecanbeavoidedby:1. Conductingperiodicsourcecodescans/audits2. Ensuringthatauditingisamilestoneinthe
iterativedevelopmentprocess
Thistypeoffailurecanbepreventedby:1. Providingproperstaffingastonot
fallbehindinschedule2. Enforcingperiodicaudits
Failuretoresolvetheauditfindings(analyzingthe"hits"reportedbyascantooloraudit)
Thistypeoffailurecanbeavoidedbynotallowingacompliancetickettoberesolved(i.e.closed)iftheauditreportisnotfinalized.
Thistypeoffailurecanbepreventedbyimplementingblocks in
approvalsintheFOSScomplianceprocess
FailuretoseekreviewofFOSSinatimelymanner
ThistypeoffailurecanbeavoidedbyinitiatingFOSSReviewrequestsearlyevenifengineeringdidnotyetdecideontheadoptionoftheFOSSsourcecode
Thistypeoffailurecanbepreventedthrougheducation
EnsureCompliancePriortoProductShipment• Companiesmustmakecomplianceaprioritybeforeanyproduct(inwhateverform)ships
• Prioritizingcompliancepromotes:• MoreeffectiveuseofFOSSwithinyourorganization• BetterrelationswiththeFOSScommunityandFOSSorganizations
Establishing Community RelationshipsAsacompanythatusesFOSSincommercialproduct,itisbesttocreateandmaintainagoodrelationshipwiththeFOSScommunity,inparticular,thespecificcommunitiesrelatedtotheFOSSprojectsyouuseanddeployinyourcommercialproduct.
Inaddition,goodrelationshipswithFOSSorganizationscanbeveryhelpfulinadvisingonbestwaytobecompliantandalsohelpoutifyouexperienceacomplianceissue.
Goodrelationshipswiththesoftwarecommunitiesmayalsobehelpfulfortwo-waycommunication:upstreamingimprovementsandgettingsupportfromthesoftwaredevelopers.
CheckYourUnderstanding• WhattypesofpitfallscanoccurinFOSScompliance?• Giveanexampleofanintellectualpropertyfailure.• Giveanexampleofalicensecompliancefailure.• Giveanexampleofancomplianceprocessfailure.• Whatarethebenefitsofprioritizingcompliance?• Whatarethebenefitsofmaintainingagoodcommunityrelationship?