An Exploratory Study of the Evolution of Software Licensing

Transcription

1 An Exploatoy Study of the Evolution of Softwae Licensing Massimiliano Di Penta nivesity of Sannio, Italy dipentaunisannio.it Daniel M. Geman nivesity of ictoia, Canada dmguvic.ca Yann-Gaël Guéhéneuc, Giuliano Antoniol École Polytechniue de Montéal, Canada yann-gael.gueheneucpolymtl.ca, antoniolieee.og ABSTRACT Fee and open souce softwae systems (FOSS) ae distibuted and made available to uses unde diffeent softwae licenses, mentioned in FOSS code by means of licensing statements. aious factos, such as changes in the legal landscape, commecial code licensed as FOSS, o code eused fom othe FOSS systems, lead to evolution of licensing, which may affect the way a system o pat theeof can be subseuently used. Theefoe, it is cucial to monito licensing evolution. Howeve, manually tacking the licensing evolution of thousands of files is a daunting task. Afte pesenting seveal cases of the effects of licensing evolution, we popose an appoach to automatically tack changes occuing in the licensing tems of a system. Then, we epot an empiical study of the licensing evolution of six diffeent FOSS systems. Results show that licensing undewent feuent and substantial changes. Categoies and Subject Desciptos D.2. [Softwae Engineeing]: Management Copyights Geneal Tems Legal Aspects Keywods Softwae licenses, evolution, mining softwae epositoies, open souce systems, empiical study. 1. INTRODCTION OpenBSD founde and poject leade Theo de Raadt emoved a secuity softwae package called IP- Filte [witten by Daen Reed] afte its autho changed its license. Stephen Shankland, CNET News, 2001/05/30. Pemission to make digital o had copies of all o pat of this wok fo pesonal o classoom use is ganted without fee povided that copies ae not made o distibuted fo pofit o commecial advantage and that copies bea this notice and the full citation on the fist page. To copy othewise, to epublish, to post on seves o to edistibute to lists, euies pio specific pemission and/o a fee. ICSE 10, May , Cape Town, South Afica Copyight 2010 ACM /10/05...$ As softwae systems evolve, so do licenses. Although softwae licenses have gained pominence in the media, thanks fo example to the wok of the Fee Softwae Foundation; licensing evolution has eceived little attention fom eseaches despite its many potential hamful conseuences on softwae euse. An inteesting example of such phenomena is the licensing evolution of IPFilte [20], which pevented its edistibution as pat of the OpenBSD kenel. A side-effect of this evolution was the ceation of PF by OpenBSD developes as an altenative to IPFilte 1. Licensing, copyight, and intellectual popety detemine what can and cannot be eused, and potentially impacts the achitectue of a system. A typical scenaio in which licensing evolution monitoing becomes vital is as follows. A company ceates a poduct e.g., a hand-held multimedia playe that incopoates some FOSS components/applications, e.g., a nix kenel, the playe, plus seveal codecs. The citical situation aises when thee is the need fo updating a component (e.g., a codec) but its license changed (e.g., fom BSD to GPL) and its new license pevents its distibution, thus euiing to completely e-think the way this codec is connected to the playe [10]. Conseuently, developes must caefully analyze the oveall licensing compatibility of all the included components. This compatibility analysis is usually done manually, o semi-automatically, by veifying that all bundled souce files and binaies have been eleased unde compatible licenses [1]. nfotunately, as illustated by the IPFilte case, this analysis is not a one-time activity: each modification to any bundled component may involve licensing statements and thus impact its use/integation. The hamful conseuences of licensing evolution stem fom the natue of open souce development: this method of development can be woisome fom an intellectual popety standpoint because it ceates multiple oppotunities fo contibutos to intoduce infinging code and makes it almost impossible to audit the entie code base [1]. Such conseuences will become moe pominent because (1) the nited States Cout of Appeals fo the Fedeal Cicuit uled that edistibuting softwae systems in violation of the tems of a fee softwae license constitutes a copyight infingement [1] and (2) the sizes of moden softwae systems pevent manual analysis, e.g., Mozilla gew fom 4,45 files in elease M3 (Mach 1) to 12,436 in elease (Septembe 2004). Theefoe, thee is a need fo methods and tools to (semi-) automatically audit a system fo its license and fo changes in its licensing statements acoss eleases. 1

2 The license (o licenses) unde which a file is made available is usually contained inside blocks of comments at its beginning. We efe to such comments as the licensing statement of a file. We distinguish between licenses and licensing statements because a licensing statement may eithe contain the license itself (e.g., BSD license) o the name of the license and a efeence to whee it can be found (e.g., the Eclipse Public License). In this pape, we ae inteested in changes to the licensing of souce code, i.e., the analysis of changes occuing within licensing statements, while license evolution concens the evolution of a license pe se, e.g., the evolution of the GPL fom v2 to v3. A change to the licensing statement might be a change to the name of the license (when the statement efes to its name) o a change to the license itself (when the license is in the statement). This pape fist motivates the poblem of analyzing the evolution of licensing statements by poviding seveal examples of changes in licensing and thei conseuences. Then, it suggests that the only means to avoid negative conseuences is to monito licensing evolution automatically. It poposes an appoach to automatically tack the licensing evolution of systems, identifying changes in licenses and copyight yeas. Finally, it epots an empiical study analyzing the licensing evolution of six widely-adopted FOSS systems: AgoML, Eclipse-JDT, the FeeBSD and OpenBSD kenels, the Mozilla Suite, and Samba. The study shows that licensing evolution is a feuent and elevant phenomenon in many systems and that, while FOSS developes ae concened with licensing issues, they manage, evolve, and update licensing statements in diffeent ways. Fo example, some systems, e.g., Mozilla and Eclipse-JDT, have moved fom moe estictive to less estictive licenses while othes have moved in the opposite diection. Copyight yeas ae updated following diffeent pattens in diffeent systems. To the best of ou knowledge, no pevious wok investigated the licensing evolution of FOSS systems. Thus, the contibutions of this pape ae as follows: We show that keeping tack of licensing changes is impotant by epoting seveal cases whee changes in open-souce licenses had majo conseuences in softwae usage and integation; We popose a method to tack licensing changes. The method is based on textual analysis of licensing statements extacted fom souce code file and on the usage of the FoSSology licensing classification tool [11]. We epot an empiical study showing the extent and feuency of licensing changes by analyzing the licensing evolution of six open souce systems: AgoML, Eclipse-JDT, the FeeBSD and OpenBSD kenels, the Mozilla Suite, and Samba. The pape is oganized as follows. Section 2 shows seveal cases in which licensing changes impacted softwae usage and integation. Section 3 descibes the licensing analysis pocess. Section 4 descibes ou study and the pocess followed to mine data fom the six chosen FOSS systems. Section 5 pesents the empiical study esults. Section 6 discusses the esults along with theats to validity. Afte a discussion of elated wok in Section, Section concludes and outlines diections fo futue wok. 2. LICENSING EOLTION A dual elation exists between license evolution and changes in licensing statements. Licensing statements ae changed to allow developes using the license that bette fits thei needs and o uses needs. Such changes occu by modifying the licensing statements of the system files to efe to a diffeent license, to a new vesion of the oiginal license, o to update the license when it is included in the licensing statements. Theefoe, licensing changes depend on the availability of fitting licenses. We fist illustate license evolution and then licensing evolution using eal-wold cases. 2.1 License Evolution License evolution is diven by many factos. On the one hand, copyight ownes want licenses to adapt to the new legal landscape and include thei specific euiements. Fo example, the Netscape Public License, the IBM Public License, and the Apple Public Licenses wee ceated to satisfy thei oganizations euiements. On the othe hand, uses want licenses to adapt to thei needs, often by becoming less estictive, e.g., the oiginal BSD license (also known as 4-clauses BSD) evolved towads its less estictive 3-clauses and 2-clauses vaiants. Some licenses evolve towads moe estictive ones, such as the changes made to the Geneal Public License (GPL) vesion 2 to avoid hadwae locks and digital ights management, which led to the GPL v3. In othe cases, licenses evolve due to extenal pessues. Fo example, the evolution of the license of Mozilla fom Netscape Public License (NPL) to Mozilla Public License (MPL) v1.1 was tiggeed by the opposition of the open-souce community to some of the tems in the NPL. This evolution eflected an inteest of the Mozilla Foundation, the copyight owne of Mozilla, to addess its uses concens. Table 1 shows some of the most commonly used FOSS licenses, the ationales fo thei evolution, and whee applicable, the othe licenses on which they ae based. With a lage numbe of available licenses, among which 65 ae cetified by the Open Souce Initiative, it is not supising that licensing statements evolve. 2.2 When Licensing Evolution affects Softwae sage: Five Cases We now epot cases in which licensing evolution was tiggeed by a specific euiement and influenced the way in which the system is used. Table 2 summaizes these cases. Case 1: OpenBSD IPFilte Replacement. In 2001, the autho of IPFilte, a fiewall package used by OpenBSD, added an exta sentence to the licensing statement of each files of IPFilte and, hence, to the IPFilte license. Accoding to the autho, this sentence was a claification to the tems of the license but developes of OpenBSD consideed this a new condition, incompatible with the license of OpenBSD. OpenBSD developes decided to eplace IPFilte with a new OpenBSD-based implementation [12]. Changing the license of FOSS system might esult in uses no longe being able to euse the softwae. Case 2: Java. ntil Novembe 2006, one of the majo poblems to include Java in Linux distibutions was its license. The license of Java JDK v1.2 included the following sentence: Except as specifically authoized in any Supplemental License Tems, you may not make copies of Softwae, othe than a single copy of Softwae fo achival puposes. This euiement disallowed the inclusion of Java in Linux distibutions. Con-

3 Table 1: Examples of how some open souce licenses have evolved ove time. Names of licenses Yeas Deived fom Types of changes with espect to its pedecessos Geneal Public (GPL) v1 1 Emacs Public Majo ewite. Genealizes the Emacs Public License GPL v2 11 GPL v1 Replaces some philosophical language with legal one. Adds two clauses: the Libety o Death clause, and allows geogaphical exclusion GPL v3 200 GPL v2 Majo ewite. Adds hadwae estictions, addesses softwae patents Libay GPL (LGPL) v2 11 Lesse GPL (LGPL) v2.1 1 LGPLv2 Replaces language with a moe legal one. Majo modifications to peamble. Allows geogaphical exclusion unde cetain cicumstances Lesse GPL (LGPL) v3 200 LGPLv3 Majo ewite. Impoves legal language. Licensed softwae unde it can only be changed to GPLv3 Mozilla Public (MPL) v1.0 1 Netscape Public (NPL) v1.0 1 MPL v1.0 Identical to the MPLv1.0 except fo the addition of an Amendments section MPL v1.1 1 MPL v1.0 Replaces language with a moe legal one, adds patent clauses. It adds the option of using dual licensing NPL v1.1 1 MPL v1.1 and NPL v.1.1 Identical to MPLv1.1 except fo the addition of an Amendments section (moves it fom end of the license to the beginning of it) IBM Public (IBMPL) v1.0 1 Common Public (CPL) v IBMPL v1.0 Claifies definitions; makes the license eusable by eplacing IBM s name with Contibuto, and declaing IBM as the stewad of the license CPL v CPL v0.5 Identical to the CPL v0.5 Eclipse Public (EPL) v CPL v1.0 Removes a clause egading patent litigation against develope, and changes the stewad of the license fom IBM s to the Eclipse Public Foundation BSD 4 clauses 13 BSD 3 clauses 1 BSD 4 Removes Advetisement clause BSD 2 clauses 200 BSD 3 Removes Endosement clause, making it simila to the MIT/X11 Table 2: Effects of licensing changes. Systems Licenses Changes Effects IPFilte IPFilte-specific license Added a claification sentence IPFilte was emoved fom the OpenBSD distibution Java Java-specific License GPL v2 with CLASSPATH exception It allows modifying and updating Java Mono GPL v2 MIT/X11 It allows using Mono with systems unde any license QT FeeQT Q Public License, then GPL v2, and finally Poject Hamony, a eplacement of QT, was abandoned both LGPLv2.1 and GPLv3 MySQL LGPL v2.1 GPL v2 It pevents PHP systems to connect to MySQL seuently, fo many yeas, end-uses had to manually download and install Java. Sun Micosystems woked with the Fee Softwae Foundation (FSF) and eleased Java 5.0 unde the GPL v2 with an addendum known as the CLASSPATH exception []. This change in the licensing of Java had two majo implications: fist, Java could fom then on be modified and updated unde the GPL v2, without intefeence by Sun; and, second, Java pogams could be eleased unde any license as long as they satisfy the conditions stated in the CLASSPATH exception. Changing the license of a system can pomote and ease the distibution and euse of a softwae system. Case 3: Mono. Mono 2 is a famewok poduced by Novell to suppot the.net API (and thus Micosoft softwae systems) unde opeating systems diffeent than Micosoft Windows. Oiginally, the poject was distibuted unde the GPL v2. Accoding to Mono developes, this license ceated a potential poblem when unning.net systems because they could be consideed deivative woks of Mono and, hence, euied to be also eleased unde the GPL v2. Conseuently, Mono developes changed its license to MIT/X11, a simple FOSS license that allows its use along systems distibuted unde any commecial o FOSS license [1]. Accoding to Mono s poject leade, this change was also euied by HP as a condition fo its paticipation as a contibuto to the poject [21]. Thus,.Net systems can use Mono egadless of thei espective licenses. 2 A change to a moe pemissive license (and in paticula, allowing commecial deivative woks) may incease the size of the community of contibutos to a FOSS system. Case 4: QT. QT is a libay of GI widgets, oiginally developed by Tolltech, bought by Nokia in 200. QT was fist eleased unde a non-open souce but fee license, called the FeeQT License, and a commecial license. QT became the basis fo KDE, the desktop suite fo nix systems. Many objected to the use of a non-open souce libay as the basis of a majo open-souce system, including Richad Stallman. To addess these issues, QT v2.0 was eleased unde a new license, called the Q Public License. The Q Public License was appoved by the Open Souce Initiative but deemed incompatible with the GPL by the FSF []. Accoding to the FSF, because many application in KDE ae licensed unde the GPL, this incompatibility makes thei use of QT a violation of thei own license (the KDE poject disputed this view). Conseuently, the GNOME poject was stated as a QT-fee altenative to KDE, while the Hamony poject was stated to implement a eplacement of QT to be licensed unde the GPL. Tolltech changed the license of QT v3 to the GPL v2. The Hamony Poject was no longe necessay and abandoned [15]. When Nokia acuied Tolltech, it changed the license of QT v4.6 to a dual LGPL v2.1 and GPL v3. Changing the license of FOSS system towads a moe pemissive might cause the abandonment of a competing system. Case 5: MySQL. In 2004, MySQL AB changed the license of its client li-

4 baies fom LGPL v2.1 to GPL v2. This change was intended to pevent industial companies fom using the libaies within popietay poducts without paying fo a commecial license. nfotunately, it had also unintended conseuences: PHP systems wee no longe able to connect to MySQL because the PHP license is incompatible with the GPL v2. MySQL addessed this poblem by adding the MySQL FOSS License Exception to the GPL v2 []. Changing the license of a FOSS system might have unintended o undesiable conseuences to its legitimate uses. Lessons fom these five cases. We illustated using five cases, summaized in Table 2, that changes in licensing can have vaious conseuences (expected and unexpected). Thus, developes and thei oganizations should be awae of licensing changes and thei potential effects. FOSS development encouages the contibutions of many developes, who can willfully o inadvetently change licensing statements. Theefoe, an appoach to analyze licensing changes in souce code is needed. 3. LICENSING ANALYSIS METHOD The analysis of licensing changes takes as input souce code file evisions extacted fom vesion contol systems (such CS o SN) and the coesponding change logs. It consists of fou steps: the fist step extacts licensing statements fom files, the last thee collect data to analyze how the statements changed. Without loss of geneality, we limit ou analysis to.java files fo Java systems;.h and.c fo C systems; and,.h,.c, and.cpp files fo C++ systems. We also analyze changes occuing to copyight ownes names, as pesented in anothe pape [3]. Step 1: Extacting licensing statements. We extact the licensing statement of a file as its fist two blocks of comments, whee a block is a seuence of consecutive comments with no souce code in between. We ceated ou own comment extacto based on a comment-emoval tool adapted to expot comments instead of emoving them 3. We conside the fist two blocks of comments because licensing statements ae vey often inteleaved with #include diectives, pepocesso macos, o package declaations. Step 2: Identifying changes in licensing statements. Licensing statements ae usually English text, thus we cannot compae the licensing statements in two file evisions using a line diffeencing tool, such as diff. Theefoe, we compae licensing statements of subseuent file evisions by indexing them using Infomation Retieval ecto Space Models and by compaing thei models using the cosine similaity [6]. In this step, we ae inteested in any change, theefoe we use all alpha-numeic wods, neithe puning stop wods no pefoming stemming. 3 Ou comment extacto can be downloaded fom tuingmachine.og/~dmg/comments-1.0.ta.bz2 Step 3: Classifying licenses. As in ou pevious wok [], we detect the license(s) of each file (a licensing statement can contain multiple licenses) using the license identification tool in FoSSology [11], which detects licenses using the Binay Symbolic Alignment Matix (bsam) patten matching algoithm. Fo each file, we fist classify the license(s) in its fist evision. Then, we pefom the classification evey time the cosine between the licensing statements of two subseuent file evisions is less than 0.. We choose 0. fo two easons: fist, FoSSology is vey slow (it might take moe than a minute to analyze a souce code file even on a fast compute); second, a manual inspection of the classifications shows that, fo highe cosine values, changes did not affect the legal implications of the licensing statements. Step 4: Identifying changes in copyight yeas. We extact copyight yeas fom licenses by mining numeic seuences of two o fou digits, matching yeas between 10 and 200. Ou heuistics can detect single yeas and yea anges, e.g., , which we convet into a seies of yeas: 1, 1, 2000, and We pune yeas automatically inseted by CS and SN ($Id$ tags) o followed by time, which should not occu in copyights. 4. EMPIRICAL STDY The goal of this study is to analyze licensing evolution, with the pupose of investigating how developes change licensing statements in souce code files. The uality focus is elated to the kind of changes occuing in licensing statements. The pespective is of eseaches who want to gain insights on when and how licensing statements ae changed to undestand the elevance and impact of licensing changes. It is also of pactitiones who want to ealize the extent and impotance of licensing evolution. The context consists of the CS o SN epositoies of six FOSS systems: AgoML, Eclipse-JDT, the FeeBSD and the OpenBSD kenels, Mozilla, and Samba. The systems have diffeent sizes, ae developed with diffeent pogamming languages (C, C++, and Java), and belong to diffeent domains: AgoML is a Java-based ML modele; Eclipse- JDT an extensible development envionment in and fo Java; FeeBSD and OpenBSD ae kenels of two open nix opeating systems in C/C++; Mozilla is a suite compising a Web bowse, an client, and othe Intenet utilities in C/C++; Samba is a file and pinte sevice inte-opeating between nix and Windows opeating systems in C. Table 3 epots chaacteistics of the six systems, while Table 4 shows the distibution of the licenses in thei fist and last eleases. Only Samba licensing statements neve changed. We choose systems diffeent fom those illustated in Section 2.2 fo thee main easons. Fist, this choice gives us is the possibility of analyzing long evisions histoies, which ae not available fo systems such as MySQL o Java. Second, while the cases epoted in Section 2.2 motivated ou study by showing that licensing changes impact softwae usage, this study investigate the extent and elevancy of licensing changes, i.e., whethe they often occus duing a softwae lifetime. Thid, this choice allows us to analyze lage systems, such as the OpenBSD and FeeBSD kenels, Eclipse-JDT, and Mozilla, in which it is possible to obseve a wide vaiety of licensing changes.

5 Table 3: Main chaacteistics of the six systems. Chaacteistics AgoML Eclipse-JDT FeeBSD OpenBSD Mozilla Samba Languages Java Java C C C/C++ C Release anges M #of souce files anges 1, ,24 5 6,2 3,35-6,43 4,45-12, KLOC anges ,22 4-2,242 1,2 4, CS/SN stat dates CS/SN end dates Analyzed file evisions 32,52 12,611 15,0 110,430 46,4 2,01 # of committes Table 4: Distibutions of licenses in the fist and last eleases of each of the analyzed systems. Column f shows the numbe of files with such licenses and % the coesponding pecentages. We only show licenses coveing at least 5% of files. Licenses f % Fist AgoML Fee with copyight clause -style, C Regents fee with copyight clause -style Othes Fee with copyight clause -style, C Regents fee with copyight clause -style Othes Eclipse-JDT Fist None Eclipse Public License v Othes Fist Fist Fist Fist FeeBSD BSD CRegents -style (4-cl. BSD) None BSD CRegents -sty., CWI -sty. ( cl.bsd) Othes Cyptix -style (2-cl. BSD) INRIA-OSL -style (3-cl. BSD) 14. BSD (unknown BSD) Othes OpenBSD BSD CRegents -style None Canegie Mellon nivesity style Othes INRIA-OSL -style (3-cl. BSD) BSD (unknown BSD) None Othes Mozilla NPL None Othes MPL v1.1 -style, Dual MPL GPL Dual MPL GPL -style, MPL v style Dual MPL GPL -style, MPL Othes Samba GPL v None LGPL, LGPL v Othes 2 0. GPL v None Othes Reseach Questions RQ1: How feuently do the licensing statements of souce files change? This eseach uestion is peliminay to the following uestions. It aims at poviding oveall, uantitative data on the feuencies with which licensing statements ae modified by developes acoss file evisions. Also, it investigates whethe such a feuency significantly diffes among systems. RQ2: To what extent ae files changing thei licenses? This eseach uestion investigates whethe licensing evolution coesponds to moving to a completely diffeent license, e.g., fom BSD towads GPL, o to adding a new license to a file aleady licensed, e.g., fom BSD towads a disjunctive BSD and GPL license. RQ3: How ae copyight yeas changed in licensing statements? Specifically, we investigate whethe, when a file is changed in a given yea, its copyight statement contains such a yea. We also investigate if files epoting a paticula yea in thei copyight undego significantly moe changes duing that yea than files that do not epot it. 5. RESLTS This section epots the esults of ou empiical study to answe the pevious eseach uestions. Data fo veification and eplication ae available on-line RQ1: How feuently do the licensing statements of souce files change? Figue 1 shows the box-plots of change feuencies fo the licensing statements of the files belonging to the six systems, counted as the faction of commits that involved changes in thei licensing statements. Figue 1(a) shows the box-plots of change feuencies elated to any change occuing in the licensing statements while Figue 1(b) only consides substantial changes, changes fo which the similaity with espect to the pevious file evision is below 0.. The box-plots fo changes below 0. the theshold used to tigge FoSSology classifications in RQ2 is vey simila to Figue 1(a), thus it is not shown. To statistically compae whethe the change feuencies significantly diffe among systems, we test the null-hypothesis H 0: the aveage change feuencies among systems does not significantly diffe. Results elated to all changes, in Figue 1(a), indicate that the change-poneness significantly diffes among systems (p-value < using Kuskal-Wallis test); OpenBSD, AgoML, and FeeBSD, having a highe licensing change-poneness than the othe systems. In paticula, OpenBSD and AgoML licensing statements change 4 lic-awdata.tgz

6 Feuency of licensing change Feuency of licensing change AgoML Eclipse JDT FeeBSD OpenBSD Mozilla Samba System (a) All changes AgoML Eclipse JDT FeeBSD OpenBSD Mozilla Samba System (b) Cosine <0. Figue 1: Feuency of licensing changes. moe than all the othe systems (p-value < using Mann-Whitney test), while thee is no significant diffeence among them. When consideing substantial changes, see Figue 1(b), esults ae diffeent: thee is still a significant diffeence among systems (p-value < 0.001) but Mozilla has the highe licensing change-poneness. We conclude that licensing statements do change and that, theefoe, it is inteesting to study thei changes in moe details by answeing the following eseach uestions. 5.2 RQ2: To what extent ae files changing thei licenses? Table 5 shows the counts of the most feuent license changes occuing in the six systems. It shows that files that had thei licenses changed between two evisions and excludes files that have had the same license(s) since thei fist evision. Each system has diffeent changed pattens. AgoML: Table 4 shows that the licenses of AgoML files ae essentially the same in its fist and last vesion. The esults in Table 5 suppot this obsevation. Thee ae only few files that changed thei licenses fom None to the C Regents fee with copyight clause -style, which is a pemissive license that imposes vey few constaints. Eclipse-JDT: Table 4 shows that no file in its fist vesion had a license. As time pogessed, licenses have changed Table 5: Changes of license types. Licenses Tansitions # AgoML None Fee with copyight clause -style+ C Regents fee with copyight clause -style LGPL GN C Libay -style Fee with copyight clause - style+ C Regents fee with copyight clause -style Fee with copyight clause -style+ C Regents fee with copyight clause -style Fee with copyight clause -style Fee with copyight clause -style+ C Regents fee with copyight clause -style None Eclipse-JDT Common Public License v1.0 Eclipse Public License v Common Public License v0.5 Common Public License v1.0 0 None Common Public License v None Common Public License v0.5 5 nknown None 161 None Common Public License v1.0 -style 6 None Common Public License v Common Public License v0.5 Common Public License v None Eclipse Public License v Common Public License+Eclipse Public License Eclipse 20 Public License v1.0 Othes 34 FeeBSD BSD CRegents (4-cl BSD) BSD CRegents -style (4-cl 41 BSD) BSD CRegents -style (4-cl BSD) INRIA-OSL -style (3-cl 300 BSD) GPL v2 GPL v2 -style 114 INRIA-OSL -style (3-cl BSD) Cyptix -style (2-cl BSD) 6 None Cyptix -style (2-cl BSD) 6 FeeBSD -style (2-cl BSD) Cyptix -style (2-cl BSD) 4 nknown CCDL 46 CWI -style+bsd CRegents (4-cl BSD) BSD 43 CRegents -style (4-cl BSD)+ CWI -style INRIA-OSL -style (3-cl BSD) FeeBSD -style (2-cl BSD) 41 None INRIA-OSL -style (3-cl BSD) 35 Cyptix -style (2-cl BSD) BSD (nknown BSD) 34 None BSD CRegents -style (4-cl BSD) 33 None FeeBSD -style (2-cl BSD) 31 Othes 65 OpenBSD BSD CRegents -style (4-cl BSD) INRIA-OSL -style (3-cl 64 BSD) BSD CRegents (4-cl BSD) BSD CRegents -style (4-cl 414 BSD) BSD CRegents -style (4-cl BSD) FeeBSD -style (2-cl 262 BSD) BSD CRegents (4-cl BSD) INRIA-OSL -style (3-cl BSD) 210 BSD CRegents -style (4-cl BSD) None BSD CRegents -style (4-cl BSD) BSD (nknown BSD) 5 None BSD CRegents -style (4-cl BSD) 3 BSD (nknown BSD) FeeBSD -style (2-cl BSD) None INRIA-OSL -style (3-cl BSD) 43 CWI -style + BSD CRegents (4-cl BSD) CWI -style + 40 INRIA-OSL -style (3-cl BSD) BSD CRegents -style (4-cl BSD) BSD CRegents -style 3 (4-cl BSD)+BSD (nknown BSD) Othes 0 Mozilla NPL NPL v1.1 -style+gpl v2+lgpl v NPL Dual MPL GPL -style+mpl 124 Dual MPL GPL -style+mpl NPL 114 GPL v2+mpl Dual MPL GPL -style+mpl 42 MPL MPL v1.1 -style+dual MPL GPL 0 NPL MPL v1.1 -style+dual MPL GPL 543 NPL GPL v2+mpl 35 MPL Dual MPL GPL -style+ MPL v1.1 -style 361 NPL GPL v2+lgpl v2.1+npl 14 GPL+NPL MPL v1.1 -style+dual MPL GPL 14 GPL+NPL Dual MPL GPL -style+mpl 144 Othes 136 Samba None GPL v2 15 GPL v2 LGPL v2 2 GPL v2 None 1 None LGPL v2.0 -style 1 None LGPL v2 1 Public Domain+GPL None

7 !"!!# ABCBBD $!"!!# %!"!!# EBCBBD &!"!!# FBCBBD '!"!!# (!"!!# )!"!!# T R S Q P O N GBCBBD HBCBBD *!"!!# +!"!!# IBCBBD!"!!#,-./ BCBBD? > = < ; : JKLM? > = < ; : (a) AgoML (b) Eclipse-JDT (c) FeeBSD _`a``b { } ~ c`a``b } ~ p n o m l k j d`a``b Š ˆ } ~ š œ e`a``b } ~ `a``b [ W Z W W Y W X W W fghi ] \ [ Z Y X W } ~ s z y z z y y x ƒ w v u t s žÿ Ž (d) OpenBSD (e) Mozilla (f) Samba Figue 2: Pecentage of files modified duing a yea fo which the copyight yea was updated. fom None to CPL v0.5, CPL v1.0, and, finally, EPL v1.0. The gowing numbe of files updated fom one license to the next eflects the gowth in numbe of the files. This change patten is consistent with Table 4: in the last analyzed elease, almost all files wee licensed unde the EPL v1.0. FeeBSD: as epoted in [], the files of FeeBSD and Open- BSD use a vey lage numbe of licenses (albeit most of them ae vaiants of the BSD license, including the 2- and 3-clauses vaiants). This use is eflected in Table 4 and in the license changes in Table 5. We obseve that the licenses ae moving towads the less estictive 2- and 3-clauses BSD licenses. FeeBSD itself is available unde a 2-clauses BSD license. OpenBSD: OpenBSD is a fok of FeeBSD; it is not supising that its license changes ae simila to that of FeeBSD. The majo diffeence is that OpenBSD is available unde a 3-clauses BSD license while FeeBSD unde 2-clauses BSD. This diffeence is eflected in Tables 4 and 5, whee OpenBSD has moe tansitions towads 3-clauses BSD licenses while FeeBSD has moe towads 2-clauses BSD. Thee ae also many files that changed fom having a license to None. Mozilla: Mozilla has seen a natual pogession fom NPL towads the cuent disjunctive GPL v2 and MPL v It has moved fom the oiginal NPL v1.0 to the v1.1 (euivalent to the MPL v1.1) plus the GPL. We wee supised to also obseve a change in the opposite diection: on Jan 1, 2001, 1,111 files wee changed fom GPL/MPL to NPL. This change was eveted few hous late. The coesponding defect (#0) states that thee was a bug in the scipt esponsible fo changing the license. Samba: Table 4 shows that Samba has had almost no changes in its licenses; it has always been eleased unde 5 Mozilla is cuently licensed unde a disjunctive license consisting of the GPL v2, the MPL v1.0, and the LGPL v2.1; FoSSology is not able to detect the LGPL in this case. Table 6: Relationship between file changes and copyight yea updates. Changes to Changes to files with files with Systems outdated outdated p- Eff. copyight copyight values sizes yea yea MeanMedian σ MeanMedian σ AgoML < Eclipse-JDT < FeeBSD < OpenBSD < Mozilla < Samba < the GPL v2 6. Compaed to othe pojects, Samba had significantly fewe files that changed license. These changes ae likely files that wee oiginally inseted without a license and late fixed. 5.3 RQ3: How ae copyight yeas changed in licensing statements? Figue 2 epots the pecentages of file evisions, fo each systems, whee the files that undewent at least one change in a paticula yea also had a copyight yea added o modified in thei licensing statements. AgoML and Eclipse-JDT the two analyzed Java systems stated with a (elatively) low pecentages of files with yeas updated, about 0% fo AgoML and above 50% fo Eclipse-JDT. Then, the pecentages inceased towads 0% fo Eclipse-JDT and close to 100% fo AgoML. FeeBSD and OpenBSD, oveall, exhibit a lowe upda- 6 Samba has ecently changed to GPL v3 but we etieved its histoy befoe this change.

8 ting of copyight yeas than the two Java systems, with a elatively highe numbe of update in the fist yea, above 50% fo FeeBSD, below 40% fo OpenBSD. Mozilla is simila to FeeBSD and OpenBSD but with a lowe pecentages of updates, stating fom 20% in the fist yea and then deceasing towads 10%. Samba has pecentages of changes of copyight yeas highe in the fist thee yeas, above 50%, then lowe in the subseuent yeas, below 40%. We also assess whethe files containing a yea in the copyight undewent a highe numbe of changes in that yea than othe files. We test the null hypothesis: H 0: the numbe of changes, duing one yea, fo files epoting such a yea in thei copyight does not significantly diffe fom the numbe of changes occuing to othe files. Table 6 shows desciptive statistics fo the two goups of files, p-values esulting fom the Mann-Whitney, two-tailed test used fo the compaison, and the Cohen d effect size [2], indicating the magnitude of the diffeence. The effect size is defined, fo independent samples, as the diffeence between the means, M 1 and M 2, divided by the pooled standad deviation σ of both goups σ = p (σ1 2 + σ2 2 )/2, i.e., d = (M 1 M 2)/σ. It is consideed small fo d 0.2, medium fo d 0.5 and lage fo d 0.. Results indicate that the diffeence is always statistically significant (p-value < 0.01), i.e., files exhibiting a change in thei copyight yea undewent significantly highe numbe of changes duing that yea. The effect size is always small o even negligible, but fo OpenBSD whee it is medium. This analysis was epeated by counting lines added/emoved instead of the commits and consistent esults wee found. 6. DISCSSION Changes to licensing statements account fo a lage popotion of the changes occuing to souce code files. Ou esults show that, fo thee of the six systems (AgoML, FeeBSD, and OpenBSD), licensing statements changed in about 60% of the file evisions (median value), while fo the othe systems (Eclipse-JDT, Mozilla, and Samba), the median feuency is between 20% and 40%. Howeve, small changes ae most feuent and moe substantial changes only occu on a small pecentage of file evisions below 20%. Yet, in some cases, we found that even elatively small changes meant a tansition towads a diffeent license (e.g., a change fom a CPL 1.0 to EPL 1.0 euies a change in only two wods: Common to Eclipse and cpl to epl). By elating what we discussed in Section 2 about license evolution with esults shown in Table 5, we can obseve that some of the analyzed systems have changed thei licenses in ways simila to which these licenses have evolved. The IBM Public License evolved into the CPL v0.5, the CPL v1.0, and, finally, the EPL v1.0. Ou esults show how the licensing of Eclipse-JDT followed that evolution. The diffeences between the oiginal IBM Public License and the EPL ae mino and pimaily divided in two aeas: fist, IBM has elinuished contol of these licenses to the Eclipse Foundation; and, second, claifications ae made egading patents and the ways in which the Eclipse Foundation accepts souce code contibutions [4]. Similaly, Mozilla has seen its licenses changing fom the oiginal NPL to a combination of MPL and the GPL. The NPL guaanteed to Netscape the ight to distibute the souce code unde any condition and license, egadless of who contibuted to the souce code. This license allowed to elease Netscape 6 as a popietay system. The MPL emoved this asymmety between Netscape and othe contibutos, allowing to e-distibute the souce code if it emained unde the MPL. Mozilla s most ecent changes highlight anothe impotant fact: the Mozilla Foundation is awae of the constaints imposed by incompatible softwae licenses. In an attempt to deal with this poblem, they have licensed Mozilla souce code unde any of thee licenses: the MPL v1.1, the GPL v2+, and the LGPL v2.1+. The use can select the license that best fits he pupose. In both Eclipse-JDT and Mozilla, licensing changes igoously followed the evolution of the licenses. This is not supising: the CPL and the EPL wee ceated fo the Eclipse Foundations s pojects; the NPL and MPL fo Mozilla Foundation s pojects. In both cases, the actual changes to the license ae mino and answe concens of the communities of each of the Foundations. FeeBSD and OpenBSD ae moe eclectic in thei license changes. This is pobably the esult of a vey heteogeneous community of contibutos, and the esult of code that is feuently impoted fom extenal souces (as we epoted in []). Nonetheless, we can see a clea patten moving fom the old BSD-4 clauses license to the moe pemissive BSD-3 and BSD-2 licenses. Some othe systems such as AgoML and Samba have kept the same licenses ove the entie analyzed time span. In the few cases in which the licensing statement of files changed in these systems, licensing statements wee added to the files, i.e., a change fom None to the usual license. The implications of the changes in licenses fo each of the pojects is diffeent. In AgoML, the change is fom None to a simple license. We pesume that at some point its authos ealized the impotance of including a license. The numbes of times that systems have changed thei licenses vaies. We obseved that Eclipse-JDT has used fou diffeent licenses and Mozilla two. These numbes show the willingness of the Eclipse and Mozilla Foundations to adapt the licensing statement of thei systems to thei uses needs. Changes in copyight yeas followed diffeent pattens in diffeent systems: in AgoML and Eclipse-JDT, yeas wee almost always updated, with inceasing updating pecentages, eaching values above 0%. We found lowe and deceasing pecentages in the othe systems: the pecentages ae highe duing the fist yea when the files ae ceated with licensing statements. Also, we found that files fo which the copyight yeas wee updated undewent highe numbes of changes: when developes pefom substantial changes to a file, they also update copyight yeas. Copyight egulations (and in paticula, the copyight egulations of the SA) euie the copyight notice to include the yea of the publication of new code. Although this euiement is not mandatoy to gant copyight potection, failing to popely update the copyight yea when substantial changes occu would allow an infinge to claim innocent infingement. In some systems, Eclipse-JDT fo example, it is possible to notice commits explicitly tageted to copyight yeas updates. Fo example, the commit done on , 12:22:01 by dmeget says pdated copyights, o the commit done on , 15:4:41 by jlanneluc says pdated copyights to 2004.

9 6.1 Theats to alidity This section discusses the main theats to the validity of ou study. Constuct validity theats concen the elation between the teatment and the outcome. They can be due to ou measuements, i.e., the way we extacted licenses, classify them, and identify thei changes. We extacted licenses using an aleady-existing appoach [, 10]. We have consideed the fist two blocks of consecutive comments in a file as its licensing statement to educe the isk of missing a license. It can be theefoe possible that we included in ou study comments not belonging to a license. Howeve, such a measuement eo would only affect RQ1. It would not affect the esults of the othe uestions, because the classification of the license is unlikely to be affected by moe text than the license itself. As epoted in [11], the license classification pefomed by FoSSology has some impecision, paticulaly in complex licensing statements, e.g., it did not detect the LGPL in the disjunctive license of Mozilla. Nevetheless, fom the inspections we made, such an impecision is mostly limited to discen among vaiants of licenses embedded in the licensing statement, e.g., among BSD licenses. We have added new licenses [] and submitted defect epots to FoSSology to impove its classification. Ou expeience with FoSSology is positive but needs to be empiically evaluated to popely assess its accuacy. We could not find cases whee a license damatically changed due to small textual changes: a manual validation shows that that any change in the license types even the tansition fom CPL to EPL yields a textual similaity between the pevious and the new licensing statement lowe than the theshold of 0.. Theats to intenal validity do not affect this study, being an exploatoy study [22]. Fo the same eason, theats to conclusion validity ae also not impotant, although we used statistical tests whee appopiate and made sue that the conditions fo thei applicability held. Theats to extenal validity ae elated to the genealizability of ou findings. Ou study concens a easonably lage vaiety of six systems, developed in diffeent pogamming languages, belonging to diffeent domains, and expeiencing diffeent kinds of evolutions, e.g., systems developed fom scatch (AgoML and Samba) and othes that oiginated in industy (Eclipse-JDT and Mozilla). Yet, it is necessay to eplicate this study on othe systems, in paticula industial systems, to confim its genealizability and to study the use of FOSS code in industial systems. Regading eliability validity, i.e., the possibility of eplicating this study, we have detailed the data extaction pocess and the souce code and changes fo the six systems ae available fom thei CS/SN epositoies. Futhemoe, we made available the extacted data and tools used in this study.. RELATED WORK To the best of ou knowledge, only few ecent woks specifically dealt with licensing evolution. This section discusses elated wok concening the analysis of licenses and the evolution of souce code comments, because licensing statements ae a paticula kind of comments. Licenses impose constaints and thus can be defined as logical fomulae constaining what can and cannot be done with a system. Softwae licensing pattens have been ecently studied by Geman et al. [10] using such a fomalization of licenses. They intoduced seveal legal pattens, along with examples of occuences of these pattens. In a pevious wok [], we pesented a study of the influence of softwae licenses on code migation between the FeeBSD, Linux, and OpenBSD kenels. Ou findings suppot the hypothesis of a pefeential code flow induced by pemissive licenses fom FeeBSD and OpenBSD towads Linux. Because licenses ae contained in licensing statements, the analysis of licensing evolution o of comment evolution ae simila in thei appoaches and tools. Flui et al. [5] investigated comments and code co-evolution by analyzing thee FOSS systems (AgoML, Eclipse-JDT, and Azueus). They found that (i) new code is not much commented, (ii) most of the comments efe to class and method declaations, and (iii) comments ae consistently updated with thei associated code. Jiang and Hassan [14] examined the evolution of comments in PostgeSQL consideing comment additions and deletions. They found that, on aveage, the pecentage of commented functions emain constant except fo some vaiations due to developes commenting style. Lawie et al. [16] measued the uality of identifies by measuing the extent of thei elations to wods occuing in comments. They found that, in geneal, full identifies ensue bette compehension than abbeviation, although thee ae exceptions. Ying et al. [23] studied the use of comments as a means of communication among Eclipse developes. They discoveed that comments ae not only used to help undestanding the code but also to communicate tasks, activities, and to assign tasks to othe team membes. Hindle et al. [13] discoveed that many of the lagest commits coespond to changes to the licenses o copyight ownes of files. We shae with these pevious woks the heuistics used to identify comments and to compae them using infomation etieval methods, although we specifically focus on comments elated to licenses, i.e., on licensing evolution and changes to copyight yeas. Finally, a elated pape by Di Penta and Geman [3] studied changes occuing to copyight ownes names and found that explicit contibutos and copyight ownes ae often added to licensing statement duing lage changes, although the numbe of changes they pefomed is not highe than that of othe committes.. CONCLSION As seveal cases occuing in the open-souce wold suggest, licensing changes can have an impact on the softwae lifetime, o even on othe, competito, softwae systems. This pape poposed a method to tack the evolution of softwae licensing and investigated the elevance of licensing evolution on six FOSS systems. Most noticeably, we obseved license changes, fom one license to anothe, license additions, e.g., files without license wee updated with a license, and license modifications. Fo lage systems like Eclipse-JDT, Mozilla, o the BSD kenels, the amount and feuency of licensing changes would make difficult thei manual analysis, thus highlighting the usefulness of an automatic analysis method. Finally, we investigated changes occuing to copyight yeas and found that they ae updated to potect new code when substantial changes ae made to a souce code file. We conseuently bought evidence on the evolution of softwae licensing, which suggests that this field of analysis should be futhe studied to bette undestand its impact and ationale. Futue woks will be devoted to study the licensing evolu-

10 tion in entie softwae distibutions, with the aim of elating changes in licensing of some components/poducts with thei emoval in subseuent vesions of the distibution, and with the adoption of altenative poducts (as in the cases of IP- Filte o QT). We will also investigate on a vey lage sample of FOSS systems the evolution of thei licensing statements, i.e., how diffeent kinds of FOSS licenses ae adapted ove the time to cope with weaknesses o limitations of olde licenses, and to chaacteize licensing evolution pattens in diffeent categoies of softwae systems.. ACKNOWLEDGEMENTS We would like to thank Chis Nadan fo valuable comments on ealy vesions of this pape and on the impact of copyight yea changes. This wok has been patly funded by the NSERC Reseach Chais in Softwae Change and Evolution and in Softwae Pattens and Pattens of Softwae. The wok of D.M.Geman has been funded by Hewlett-Packad to suppot the FOSSology Poject. 10. REFERENCES [1] Ameican Ba Association. An oveview of open souce softwae licenses. Accessed Sept [2] J. Cohen. Statistical powe analysis fo the behavioal sciences (2nd ed.). Lawence Ealbaum Associates, Hillsdale, NJ, 1. [3] M. Di Penta and D. M. Gemán. Who ae souce code contibutos and how do they change? In 16th Woking Confeence on Revese Engineeing, WCRE 200, Octobe 200, Lille, Fance, pages IEEE Compute Society, 200. [4] Eclipse Foundation. Eclipse Public License (EPL) Feuently Asked Questions, 200. Accessed Dec [5] B. Flui, M. Wüsch, and H. Gall. Do code and comments co-evolve? on the elation between souce code and comment changes. In 14th Woking Confeence on Revese Engineeing (WCRE 200), pages 0, 200. [6] W. B. Fakes and R. Baeza-Yates. Infomation Retieval: Data Stuctues and Algoithms. Pentice-Hall, Englewood Cliffs, NJ, 12. [] Fee Softwae Foundation. aious Licenses and Comments about Them [] D. M. Gemán, M. Di Penta, Y.-G. Guéhéneuc, and G. Antoniol. Code siblings: Technical and legal implications. In Poc. of the 200 Woking Confeence on Mining Softwae Repositoies, MSR 200, pages 1 0, 200. [] D. M. Gemán and J. M. González-Baahona. An empiical study of the euse of softwae licensed unde the GN Geneal Public License. In Poceedings of the Intenational Open Souce Systems Confeence (OSS 0), pages Spinge, 200. [10] D. M. Gemán and A. E. Hassan. License integation pattens: Addessing license mismatches in component-based development. In 31st Intenational Confeence on Softwae Engineeing, ICSE 200, May 16-24, 200, ancouve, Canada, Poceedings, pages 1 1. IEEE, 200. [11] R. Gobeille. The FOSSology poject. In In Poc. Fith Intenational Wokshop on Mining Softwae Repositoies, pages 4 50, 200. [12] D. Hatmeie. Design and Pefomance of the OpenBSD Stateful Packet Filte. Accessed Sept [13] A. Hindle, D. M. Gemán, and R. Holt. What do lage commits tell us? a taxonomical study of lage commits. In MSR 0: Poceedings of the 200 intenational woking confeence on Mining softwae epositoies, pages 10, May 200. [14] Z. M. Jiang and A. E. Hassan. Examining the evolution of code comments in PostgeSQL. In Poceedings of the 2006 Intenational Wokshop on Mining Softwae Repositoies, MSR 2006, pages 1 10, [15] C. Knudsen. Toll Tech s QPL. Linux J., (61es):10, May 1. [16] D. Lawie, C. Moell, H. Feild, and D. Binkley. What s in a name? a study of identifies. In 14th Intl. Confeence on Pogam Compehension (ICPC 2006), pages 3 12, [1] T. B. Lee. Cout: violating copyleft = copyight infingement. Accessed Sept [1] Novell Inc. FAQ: Licensing [1] L. Rosen. Open Souce Licensing: Softwae Feedom and Intellectual Popety Law. Pentice Hall, [20] S. Shankland. CNET News: Open-souce spat spus softwae change. Accessed Sept [21] S. Shankland. CNET News: Ximian changes open-souce license html. Accessed Sept [22] R. K. Yin. Case Study Reseach: Design and Methods - Thid Edition. SAGE Publications, London, [23] A. T. T. Ying, J. L. Wight, and S. Abams. Souce code that talks: an exploation of Eclipse task comments and thei implication to epositoy mining. In Poceedings of the 2005 Intenational Wokshop on Mining Softwae Repositoies, MSR 2005, Saint Louis, Missoui, SA, May 1, ACM, 2005.