软件生态系统中的许可证不兼容性
License Incompatibilities in Software Ecosystems
摘要：
当代软件的特点是重用组件，这些组件被声明为依赖关系，并从包管理器/注册中心接收，如NPM，PyPI，RubyGems，Maven Central等。在本文中，我们研究了来自七个软件包注册表（Cargo，Maven，NPM，NuGet，Packagist，PyPI，RubyGems）的所有组件之间的许可证使用和许可证不兼容性，并对GNU Affero通用公共许可证（AGPL）引起的许可证不兼容性进行了更深入的调查。我们发现，不同生态系统之间使用的许可证的相对数量不同（MIT和Apache等许可证最常见），直接许可证不兼容的数量从Cargo的2.3%到PyPI的20.8%不等，只有少量的直接许可证不兼容是由AGPL许可证引起的（最大值）。PyPI中为0.04%），但高达6.62%的Maven包违反了间接依赖的AGPL许可证。我们的研究结果表明，重用PyPI或Maven软件包的应用程序面临许可证不兼容的可能性并不太大，这可能意味着应用程序必须在分发时开源（PyPI），或者一旦它们作为Web应用程序公开（Maven）。
英文摘要：
Contemporary software is characterized by reuse of components that are declared as dependencies and that are received from package managers/registries, such as, NPM, PyPI, RubyGems, Maven Central, etc. Direct and indirect dependency relations often form opaque dependency networks, that sometimes lead to conflicting software licenses within these. In this paper, we study license use and license incompatibilities between all components from seven package registries (Cargo, Maven, NPM, NuGet, Packagist, PyPI, RubyGems) with a closer investigation of license incompatibilities caused by the GNU Affero General Public License (AGPL). We find that the relative amount of used licenses vary between ecosystems (permissive licenses such as MIT and Apache are most frequent), that the number of direct license incompatibilities ranges from low 2.3% in Cargo to a large 20.8% in PyPI, that only a low amount of direct license incompatibilities are caused by AGPL licenses (max. 0.04% in PyPI), but that a whopping 6.62% of Maven packages are violating the AGPL license of an indirect dependency. Our results suggest that it is not too unlikely that applications that are reusing packages from PyPI or Maven are confronted with license incompatibilities that could mean that applications would have to be open-sourced on distribution (PyPI) or as soon as they are publicly available as web-applications (Maven).
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
