license filtering

License compliance for open-source components is critical in software development, yet developers frequently face legal and reputational risks due to challenges in license identification, unclear understanding of downstream obligations, and inadequate tooling support. This study presents the first interdisciplinary empirical investigation jointly conducted by software engineering and legal experts. Through 58 surveys and 7 in-depth interviews with practitioners, it systematically characterizes developers’ compliance practices, core challenges, and current tool usage. The analysis yields 15 key findings—including frequent license misclassification, breakdowns in cross-role collaboration workflows, and poor comprehensibility of legal terminology—highlighting critical gaps between legal requirements and developer cognition. Based on these insights, the study proposes empirically grounded design principles for developer-centric compliance tools and actionable policy recommendations. It thus provides a foundational evidence base for building human-centered, automated, and legally integrated compliance support systems.

License identification in open-source software supply chains faces challenges of scale, heterogeneous reuse, and dynamic evolution. To address this, we introduce the first large-scale, temporally annotated, fine-grained license identification dataset. Leveraging the World of Code infrastructure, we scan files containing “license” in their paths; then apply the Winnowing algorithm combined with SPDX standards for approximate matching, identifying 5.5 million distinct license snippets. We further construct a project-to-license (P2L) temporal mapping covering the entire GitHub commit history. Our proposed scalable identification paradigm integrates path-based heuristics with text-based approximate matching. Evaluated via stratified sampling and manual validation, it achieves 92.08% accuracy and an F1-score of 91.11%. The dataset is publicly released to support compliance auditing, license evolution analysis, and tool development.

Binary artifacts in ecosystems like Maven Central often diverge from their source code, and opaque build environments introduce security risks—including untrusted CI/CD pipelines, non-reproducible builds, and undetectable dependency tampering. To address these challenges, this paper proposes an automated source-code reconstruction framework built upon an extended Macaron architecture. It integrates static analysis, GitHub Actions log parsing, and build-environment inference to automatically extract critical configuration parameters (e.g., JDK version, build commands). It introduces, for the first time in the Java context, a root-cause diagnosis mechanism for build failures and an extensible rebuild engine. Experimental evaluation demonstrates significant improvements in artifact reproducibility and verifiability across large-scale dependency graphs. The framework enables source-level software supply chain auditing and strengthens defenses against malicious builds and supply-chain contamination.

This study addresses the widespread practice of directly copying open-source code to bypass dependency management, which obscures license compliance risks. Leveraging the World of Code dataset, the authors construct a code reuse network through large-scale clone detection and quantify, for the first time at the scale of the entire open-source ecosystem, the compliance risks arising from such copy-paste reuse. Their analysis reveals that 39.4% of project compositions entail potential license conflicts, yet conventional dependency analysis tools capture only 2.43% of these instances, indicating severe under-detection. Integrating network modeling and regression analysis, the study further finds that code under permissive licenses such as MIT and Apache is reused across programming languages more frequently, whereas public-domain-licensed code exhibits comparatively lower reuse rates.

This study addresses the widespread issue of “permissive license laundering” in open-source AI ecosystems, where models, datasets, and applications labeled as compliant with permissive licenses such as MIT or Apache-2.0 often lack required license texts, copyright notices, or upstream attributions, thereby introducing legal compliance risks. For the first time, this work quantifies the problem across the entire AI supply chain by combining automated crawling, metadata analysis, and manual verification to audit 3,338 datasets, 6,664 models, and 28,516 applications on Hugging Face and GitHub. The findings reveal that 96.5% of datasets and 95.8% of models are non-compliant, with only 5.75% of downstream applications preserving complete license statements. The study advocates determining license validity through legal documents rather than metadata alone and introduces a reproducible, large-scale compliance auditing framework.

Existing open-source licenses lack a systematic, large-scale methodology for comparing permissiveness. This work proposes the first approach leveraging large language models to conduct pairwise comparisons among mainstream licenses, constructing a partial order based on license permissiveness and mapping it onto established classification schemes. By doing so, it elucidates interpretable legal constraint dimensions underlying combinations of license terms. The method not only effectively recovers key attributes associated with more restrictive licenses but also provides an extensible framework for license compliance analysis and selection, supporting platforms such as GitHub and Hugging Face.

This study addresses the compliance challenges faced by data practitioners in machine learning systems under regulations such as the GDPR and the AI Act, particularly concerning data quality. Through semi-structured interviews with practitioners in the European Union, combined with thematic analysis of regulatory texts and engineering workflows, the research systematically uncovers a structural disconnect between regulation-driven data quality requirements and ML engineering practices. It identifies five core challenges: misalignment between legal principles and engineering implementation, fragmented data pipelines, lack of purpose-built compliance tools, ambiguous accountability, and reactive responses to audits. Building on these findings, the work proposes directions for designing compliance-oriented tooling, establishing effective governance mechanisms, and fostering cultural transformation to bridge the gap between regulatory mandates and practical ML development.

This study addresses the verification challenges faced by open-source software—particularly Linux distributions—under diverse and overlapping compliance requirements. It presents the first systematic empirical analysis of over 1,500 real-world “compliance-as-code” rules drawn from 14 major distributions. Employing static analysis, textual similarity metrics, code clustering, and cross-standard mapping techniques, the research uncovers significant disparities in rule coverage across vendors and reveals that while rule rationales exhibit semantic fragmentation, their underlying code snippets often display localized similarity. The work identifies 24 core security controls commonly adopted by more than ten international organizations and establishes preliminary mappings between these rules and emerging regulatory frameworks such as the Cyber Resilience Act (CRA). These findings lay a theoretical and practical foundation for scalable, automated compliance verification and dynamic rule updating.

Empirical research on scholarly software lacks large-scale, evidence-based foundations. Method: We constructed the largest literature-linked open-source research software dataset to date, comprising 134,352 distinct projects and 134,154 source code repositories, along with their citations in open-access publications. By systematically integrating metadata from open publishing platforms and code hosting services, we extracted structured information—including version history, licenses, programming languages, and functional descriptions—enabling the first fine-grained mapping between research software and its associated scholarly outputs. Contribution/Results: The publicly released dataset includes complete metadata for over 120,000 projects, substantially addressing the scarcity of high-quality empirical data in research software engineering (RSE). It provides a reproducible foundation for assessing software impact, analyzing development practices, and informing evidence-based policy formulation in scholarly software infrastructure.

This work addresses the inadequacy of traditional open-source licenses, which rely on auditable relationships between source and object code, in governing Artificial General Intelligence (AGI) systems composed of multidimensional components such as code, data, weights, and hyperparameters. To overcome this limitation, the paper proposes “reproducible builds” as a new Copyleft paradigm for the AGI era, replacing conventional code-sharing logic by ensuring models can be precisely reconstructed from declared inputs. It establishes reproducible builds as a cornerstone of AGI governance, articulates seven technical requirements, and identifies the Model Context Protocol (MCP) as a novel dynamic linking layer necessitating a “protocol-not-platform” governance framework. Integrating OSAID, MOF, OpenMDW, and deterministic inference, the study formulates a technically and legally aligned system enabling bit-accurate model reconstruction, thereby providing both theoretical grounding and practical pathways for AI open-source licensing.