HP Launches FOSSology Open Source Tracking Tool

cpudney writes "An article in Computerworld UK reports on a new open source analysis initiative launched by Hewlett-Packard. The FOSSology Project's mission is to 'build a community to facilitate the study of Free and Open Source Software by providing free data analysis tools.' The first such tool reports how an open source project is licensed. Rather than simply collecting a project's advertised license, the tool analyzes all of the source code for a given project and reports all of the licenses being used, based on the license declarations and tell-tale phrases that identify software licensing. A video demonstrating the tool applied to abiword is available. The FOSSology source code is licensed under GPLv2."

Re:

[gotzero]

I think these companies are trying to do anything they can to not appear openly hostile to open source... Many have not been doing so well in that department. At least it is not a step in the wrong direction!

Re:

[richardablitt]

At least their printers seem to be well supported under Linux (I've had no problems with them, anyway).

Re:

[emilper]

how about HP office scanners ?

Video Summary: 2 files not compatible with GPL

[benad]

For those that don't want to load the video, there is two files in Abiword (hash.cpp and tword.cpp) that use the original BSD license (with the "obnoxious" advertising clause) and are incompatible with the project's GPLv2 license. Oops.

not if the advertisement clause is present

[keeboo]

Please feel free to learn more about this issue [gnu.org].

Re:

[AuMatar]

Outdated- the new version of the BSD license (new meaning about a decade old, if not more) has no advertising clause. Nobody uses the old style anymore, when people say BSD you can assume they mean no advertising clause. In which case, he's absolutely right.

Re:

[Anonymous Coward]

You are an idiot. The BSD license used on the small bits of code in abiword is the old "obnoxious" one. Read the fucking article, and the posts before you reply.

Re:Video Summary: 2 files not compatible with GPL

[tlhIngan]

no, BSD software can be relicensed under the more restrictive GPL, just not the other way around. By the way, I downloaded the source for Abiword-2.4.6.tar.gz and found the hash.cpp with the full license inside but no tword.cpp file

Actually, no. Prior to the modified-BSD license (which became the official BSD license), the original BSD license is incompatible with the GPL. This is because the original BSD license had an "advertising" clause that stated the software must say it includes portions copyright the Regents of California. That very clause makes it incompatible with the GPL (because the license makes additional terms in order to use the code - something the GPL prohibits).

Even the FSF states that the original BSD license is incompatible with the GPL [gnu.org].

Now, I believe in the late 90's, the BSD folks reorganized the license and eliminated that clause, thus making BSD compatible with the GPL. They made it retroactive, I believe, but you had better be careful with code with the original terms since BSD originated code is under the new license, but the old code from a different author (but same license) may not be using the modified/revised BSD terms.

Re:

[digitig]

They made it retroactive, I believe, but you had better be careful with code with the original terms since BSD originated code is under the new license, but the old code from a different author (but same license) may not be using the modified/revised BSD terms.

Which appears to be the case with at least one of the BSD licenses used in Abiword. It's not actually the old BSD license, it's the old BSD licence with the author's name replacing references to the Regents of California. So when they made the new BSD license retroactive, the code used by Abiword was unaffected because it wasn't the Regents' to change.

Open Source competition to commercial products

[mgkimsal2]

While it doesn't seem fossology is addressing exactly the same problem space, I can see a project like this taking some marketshare away from commercial products like BlackDuck's protexIP and Palamida ipAmplifier. I work in a field where this would be a very useful tool, and have been wanting to build something like this ourselves and release as an open source project. The issue has always been determining a cost-effective way of keeping the indexes up to date. But rather than scanning code and looking for direct violations, this approach turns that on its head a bit and scans for licenses. This is more a forensic tool than something which can detect all types of violations - if I just took part of a GPL file and placed it in a BSD project (or my own project, for example), it doesn't seem fossology would be able to make that determination. At least, I didn't see that from the video I watched. In any event though, this is a welcome tool for people looking to quickly get a handle on what's in their code. Glad to see it out there.

Re:

[GarbageCollection]

I agree that this is a welcome tool. As companies continue to use increasing amounts of open source in their software, they need better ways of tracking it, to make sure that they comply with the licenses. This is particularly true for software companies, whether they are commercial or open source. I'm not sure that Fossology will take market share away from Black Duck or Palamida, however, since the functionality seems to be more limited. I'd be interested in hearing a review from someone who used the

Re:

[mgkimsal2]

I'm planning on trying it out in the next week. Visit http://www.kimsal.com/ [kimsal.com] to read a review if/when I get to it.

Also, I agree, it may not take market share away, at least for now, but if the underpinning is good, it may be a good base to build similar BD/P functionality on top of.

Re:

[tlhIngan]

While it doesn't seem fossology is addressing exactly the same problem space, I can see a project like this taking some marketshare away from commercial products like BlackDuck's protexIP and Palamida ipAmplifier.

I remember a customer doing something with our code (commercial) - they scanned our submitted code against open-source code to check for violations (making sure we weren't checking in open-source code as proprietary).

We didn't, but the output it got back was pretty enlightening. We still had to def

Re:FOSS that solves problems created by FOSS?

[iggymanz]

typewriters solved a problem too, and companies had typewriter repair departments. Parcel delivery companies solve problems and my company has a shipping and receiving department. gee, what's up what that?

No point defeated, FOSS exists because of copyright law and software that helps ensure licensing is proper is a great way for the movement(s) to self-police.

This has already been around for years

[LS]

A friend of mine in SF started a company a few years back called Palamida [palamida.com] that provides a very similar service. I don't think their code is GPLed though.

LS

how... meta.

[sootman]

So, it's an open-source tool that evaluates how open-source open-source software is? Wow. If ever there was an app that demanded a recursive acronym, this is it. Any suggestions?

Re:

[dozer]

yaossfsck?

Re:

[Anonymous Coward]

If they had just called it "FOSS" (which is taken, I know. Bear with me...) then it could be "FOSS is an Open Source Scanner"

*shrug*

Re:

[Urza9814]

There are still plenty of alternatives....the first letter could be anything:

LOSS causes profit loss
Toss that TOSS
Doss with DOSS

Re:

[LarsG]

.  <- the concept of recursive acronyms

O  <- you

Re:

[Urza9814]

Well, those sentences I listed weren't the actual acronyms, if that's what you're thinking...I was just giving examples of what you could say if you used them. The actual acronym would be (L/T/D)OSS is an Open Source Scanner. I shoulda been more clear on that.

rename it to Ono

[Gary W. Longsine]

In light of the BSD tidbit above, it could be renamed: OhNO! ... ONO's Not militantly Open enough! (where the "militantly" and "enough" are silent.)

Re:

[jd]

• TOSTOSTOS: The Open Sourceness Testing Open Source Tool for Openable Source Tarballs
• ROSCROSC: ROSCROSC Open Source Checker Recursively Open Source Checks
• YIARAFARACOSL: YIARAFARACOSL Is A Recursive Acronym For A Recursive Application Checking Open Source Licenses

P.S. SCO changed their copy. If the filename starts with linux-2.6, it prints "Owned By SCO" 250 times. I hear they plan to use their version when they appeal.

Re:

[gr8scot]

OSSOSS
Open Source Software Openness Scanning Software

License bloat

[iminplaya]

Will this help reduce it? 13K sized programs with 50K licenses. Hey, a new game. Stenoproject. Find the hidden program inside the license. Kinda like Where's Waldo.

Why bother?

[rorted]

Off topic, but this is a pet hate of mine -- why bother sticking the logos of web standards on your page when it fails so [w3.org] thoroughly [w3.org] to comply to said standards?

Re:

[alextmqazwsx]

And one of mine, Inviting looking pages that are password protected. ("Demo - Try it!")

Don't Let SCO see this.

[WallyDrinkBeer]

This could be a disaster.

SCO will run Linux through this tool and find out all the stuff in their that has /* Copyright 1982 SCO */ in the headers.

Arghh.

Ummmm....

[vlad_petric]

SCO who?

As an HP employee...

[Anonymous Coward]

I like seeing the move to Open Source in quite a few projects, mostly Linux/HP-UX based [hp.com]. But if the internal company reorganization doesn't actually fix some problems, HP as a company is going under. (yes this is still fallout from the whole "who's leaking info to the press let's get their calling records" scandal) The only thing that is saving it from the ineptitude of the management is the talent of the onshore techs, otherwise it'd be dead already. The offshore "towers" are for the most part steaming tow

Re:

[ibsteve2u]

I tend to agree with your perspective, which is why I'm leery of HP/Compaq doing anything in the open source world.

After watching the destruction of DEC, I know they must still have a mass of those people who can take a good thing and destroy it.

Public Domain

[Besna]

If we need any sort of standard, it should be the simplest of all--public domain. Maybe an XML attribute or watermark. Certain dated materials can be automatically assigned as well.

GPLv2?

[dacut]

The FOSSology source code is licensed under GPLv2

Does it just say GPLv2 in their license file, or did they properly analyze the source to determine it was GPLv2?

About that name...

[Smallpond]

Doesn't it seem like a bad idea for HP to be using a name that sounds like "fossile".

Ohloh?

[Ptur]

Isn't this what http://www.ohloh.net/ [ohloh.net] does (and much more)?

Re:

[triso]

Isn't this what http://www.ohloh.net/ [ohloh.net] does (and much more)?

i don't think Ohloh knows what it wants to be.

Implications?

[SavvyPlayer]

If an OSS developer releases a GPL v2 project that links to several libraries that use incompatible licenses, and possibly a proprietary one, does that affect in any way the developer's rights? Could the developer be held liable to correct every violation before being allowed to sue a 3rd party for infringement of his own terms? What if one of the holders of the copyrights of the linked libraries were to ignore the infringement of the developer in question and ignore the suit and any legal correspondence --