Inversiones

The Linux Foundation and FOSSBazaar recently released a new specification to ease the pain of license compliance for open source software. The Software Package Data Exchange (SPDX) is a data exchangespecification that tracks license information in a standardized way and allows it to travel across the software supply chain. Since open source software is by its nature collaborative, any newproject often includes bits and pieces of other open source software projects, each covered by a different license. By the time a project lands in the hands of an enterprise that wants to use it, andpos-sibly modify it, IT profession-als may not even know all the different license provisions attached to the code. Companies want to do the right thing with licenses, and they want to know about anyli-censing restrictions before they adopt a project. That’s not easy to do with more than 2,000 licenses in existence for freely available software on the In-ternet, from crazy licenses like the Free Beerlicense (which asks you to send beer to the programmer instead of money) to the GPL family of licenses to platform-specific licenses such as Apache and Eclipse. Each license carries within it thedeveloper’s definition of how the software can be used and distributed. Permissive li-censes like BSD and MIT allow software to be redistributed and developers can modify code without the requirement ofmaking changes publicly available. Reciprocal licenses, on the other hand, place vary-ing restrictions on reuse and redistribution. Several companies offer tools or services to audit the code in use byan organization, discover its license, and ensure that an enterprise or devel-oper is in compliance. These include Black Duck Software, OpenLogic, HP’s FOSSology, and Pathology. But even if a companyunderwent such an audit, and then every contribu-tor to a project thoughtfully documented the license and copyright information for each piece of software modified, there was no standard way to...