Empirical Study on Dependency-related License Violation in the JavaScript Package Ecosystem

DOI Web Site 1 References Open Access
  • Qiu Shi
    Graduate School of Information Science and Technology, Osaka University
  • German Daniel M.
    Department of Computer Science, University of Victoria
  • Inoue Katsuro
    Graduate School of Information Science and Technology, Osaka University

Abstract

<p>Open source software (OSS) is software whose source code can be reused under some particular terms and conditions. These terms and conditions are usually described by one or more software licenses written in the header part of the source files. A license may violate another one according to the terms and conditions. Making software by reusing OSS as dependency may cause dependency-related license violation if the developers overlook the license of the dependency. In this paper, we first conduct an empirical study on npm - a JavaScript-based software ecosystem - to study the prevalence of dependency-related license violation. The result suggests that only a few packages (0.644%) in npm have dependency-related license violations. However, we also observe that including the packages licensed under copyleft licenses in the dependency network potentially causes a high dependency-related license violation. We then conduct a preliminary questionnaire on the authors of packages detected as having dependency-related license violations to study the developers' attitudes. The results reveal: 1) the developers' overlooking and misunderstanding of the dependency-related license violations; 2) the difficulties in managing dependency-related license violations and the developers' demands for help.</p>

Journal

References(1)*help

See more

Related Projects

See more

Keywords

Details 詳細情報について

Report a problem

Back to top