GPL compliance

An important barrier to the broader adoption of open source software by vendors is the complex of issues surrounding intellectual property, compliance with open source licensing terms and the whole-product ramifications of these. And I'm not just referring to the SCO bullshit. This issue will become increasingly important as traditionally proprietary software increasingly intersects with the world of open source and as systems vendors increasingly incorporate open source software components into their products. Look at Linksys as an example - their WiFi AP runs on a Linux platform. Note also that as offshoring/outsourcing increases, these monitoring and compliance costs directly increase.

This Infoworld article references a software startup that recognizes some of these issues and is attempting to address them. Black Duck Software is developing a software package that allows companies to manage and mitigate intellectual property risks associated with reusing software code. It appears to integrate into the product development cycle and allows the vendor to manage compliance with open source licenses in situations where open source components are used.

Black Duck Software develops software solutions that manage and mitigate the intellectual property risks of reusing software code. Black Duck tools automatically detect proprietary and Open Source code, provide OSS license validation and management and ease the software auditing process.

Black Duck Enterprise Edition is an essential tool for Software IP Risk Management. Geared towards multifunctional teams, the Enterprise Edition integrates into the software development cycle from conceptualization, through code development and review, to publishing or distribution, and when software is audited.

Here are some of the challenges and complexity encountered by companies thinking about integrating open source software into their product:
* various different OSS licenses exist (BSD, GPL, etc.), each with unique requirements
* the implications of using or integrating OSS code are not necessarily obvious to software managers or to developers (for instance, if you create a loadable kernel module for Linux from scratch, are you required to contribute it back to the kernel? I've heard differing opinions on this one)
* intellectual property issues around integration of open source and proprietary software
* when development is outsourced (as a lot of it is these days), it becomes harder to monitor or detect whether open source software has crept into the product and what this might imply
* risk of non-compliance. For instance, there was a lot of (negative) online buzz about Linksys and whether they had fully released all their Linux kernel modifications back to the OSS community. Here's more on the Linksys flap:

"This is not really Cisco's fault," Perens explained. "The GPL violation did not originate at Cisco, or Linksys. An off-shore subcontractor supplied Linux as part of the device."... According to Perens, the problem originated with a subcontractor who designed a Linux-based product for Linksys, which was subsequently acquired by Cisco. "Subcontractors in general are not doing enough to inform clients about their obligations under the GPL," Perens said, noting that the problem can be exacerbated when the subcontractor is small, or based off-shore.

Perens says embedded system developers can be especially susceptible to GPL violations. "Often, engineers at smaller companies are left to interpret the GPL, since they may not have lawyers who are conversant with software law as it is excercised in the United States. Contractors will think 'this is embedded, no one can change the source -- so the GPL must not really apply to us.'"

Black Duck just launched and they're going to be at LinuxWorld next week. The management team looks pretty credible and my guess would be that they're going to try to raise venture money. It would be interesting to see how they do. Also, in a similar vein, check out the following (based on some limited googling): MetroWerks' GPL Compliance Toolset.

It occurs to me that what is also missing is a central certification body that a vendor can turn to to certify compliance with various OSS licenses. For WiFi compliance you have the WiFi Alliance, for 802.16 certification you have the WiMax body, for FIPS (Federal Information Product Security) compliance you have a number of certification agencies that will conduct product audits and assessments. I understand FSF does some GPL enforcement but I'm unaware of any structure or organization that assesses and certifies compliance with OSS licenses such as GPL. Anyone have any info on this subject?