HP Launches FOSSology Open Source Tracking Tool

cpudney writes "An article in Computerworld UK reports on a new open source analysis initiative launched by Hewlett-Packard. The FOSSology Project's mission is to 'build a community to facilitate the study of Free and Open Source Software by providing free data analysis tools.' The first such tool reports how an open source project is licensed. Rather than simply collecting a project's advertised license, the tool analyzes all of the source code for a given project and reports all of the licenses being used, based on the license declarations and tell-tale phrases that identify software licensing. A video demonstrating the tool applied to abiword is available. The FOSSology source code is licensed under GPLv2."

Comments

Video Summary: 2 files not compatible with GPL

[benad]

For those that don't want to load the video, there is two files in Abiword (hash.cpp and tword.cpp) that use the original BSD license (with the "obnoxious" advertising clause) and are incompatible with the project's GPLv2 license. Oops.

Re:Video Summary: 2 files not compatible with GPL

[tlhIngan]

no, BSD software can be relicensed under the more restrictive GPL, just not the other way around. By the way, I downloaded the source for Abiword-2.4.6.tar.gz and found the hash.cpp with the full license inside but no tword.cpp file

Actually, no. Prior to the modified-BSD license (which became the official BSD license), the original BSD license is incompatible with the GPL. This is because the original BSD license had an "advertising" clause that stated the software must say it includes portions copyright the Regents of California. That very clause makes it incompatible with the GPL (because the license makes additional terms in order to use the code - something the GPL prohibits).

Even the FSF states that the original BSD license is incompatible with the GPL.

Now, I believe in the late 90's, the BSD folks reorganized the license and eliminated that clause, thus making BSD compatible with the GPL. They made it retroactive, I believe, but you had better be careful with code with the original terms since BSD originated code is under the new license, but the old code from a different author (but same license) may not be using the modified/revised BSD terms.

Open Source competition to commercial products

[mgkimsal2]

While it doesn't seem fossology is addressing exactly the same problem space, I can see a project like this taking some marketshare away from commercial products like BlackDuck's protexIP and Palamida ipAmplifier. I work in a field where this would be a very useful tool, and have been wanting to build something like this ourselves and release as an open source project. The issue has always been determining a cost-effective way of keeping the indexes up to date. But rather than scanning code and looking for direct violations, this approach turns that on its head a bit and scans for licenses. This is more a forensic tool than something which can detect all types of violations - if I just took part of a GPL file and placed it in a BSD project (or my own project, for example), it doesn't seem fossology would be able to make that determination. At least, I didn't see that from the video I watched. In any event though, this is a welcome tool for people looking to quickly get a handle on what's in their code. Glad to see it out there.

This has already been around for years

[LS]

A friend of mine in SF started a company a few years back called Palamida that provides a very similar service. I don't think their code is GPLed though.

LS

Re:FOSS that solves problems created by FOSS?

[iggymanz]

typewriters solved a problem too, and companies had typewriter repair departments. Parcel delivery companies solve problems and my company has a shipping and receiving department. gee, what's up what that?

No point defeated, FOSS exists because of copyright law and software that helps ensure licensing is proper is a great way for the movement(s) to self-police.

how... meta.

[sootman]

So, it's an open-source tool that evaluates how open-source open-source software is? Wow. If ever there was an app that demanded a recursive acronym, this is it. Any suggestions?

Re:how... meta.

[dozer]

yaossfsck?

Re:how... meta.

[Anonymous Coward]

If they had just called it "FOSS" (which is taken, I know. Bear with me...) then it could be "FOSS is an Open Source Scanner"

*shrug*

Re:how... meta.

[jd]

• TOSTOSTOS: The Open Sourceness Testing Open Source Tool for Openable Source Tarballs
• ROSCROSC: ROSCROSC Open Source Checker Recursively Open Source Checks
• YIARAFARACOSL: YIARAFARACOSL Is A Recursive Acronym For A Recursive Application Checking Open Source Licenses

P.S. SCO changed their copy. If the filename starts with linux-2.6, it prints "Owned By SCO" 250 times. I hear they plan to use their version when they appeal.

Don't Let SCO see this.

[WallyDrinkBeer]

This could be a disaster.

SCO will run Linux through this tool and find out all the stuff in their that has /* Copyright 1982 SCO */ in the headers.

Arghh.

not if the advertisement clause is present

[keeboo]

Please feel free to learn more about this issue.

Re:not if the advertisement clause is present

[AuMatar]

Outdated- the new version of the BSD license (new meaning about a decade old, if not more) has no advertising clause. Nobody uses the old style anymore, when people say BSD you can assume they mean no advertising clause. In which case, he's absolutely right.

GPLv2?

[dacut]

The FOSSology source code is licensed under GPLv2 Does it just say GPLv2 in their license file, or did they properly analyze the source to determine it was GPLv2?

rename it to Ono

[Gary W. Longsine]

In light of the BSD tidbit above, it could be renamed: OhNO! ... ONO's Not militantly Open enough! (where the "militantly" and "enough" are silent.)

Ummmm....

[vlad_petric]

SCO who?