We're sorry but this page doesn't work properly without JavaScript enabled. Please enable it to continue.
Feedback

Build license management into your pipelines

Formal Metadata

Title
Build license management into your pipelines
Title of Series
Number of Parts
38
Author
License
CC Attribution 3.0 Unported:
You are free to use, adapt and copy, distribute and transmit the work or content in adapted or unchanged form for any legal purpose as long as the work is attributed to the author in the manner specified by the author or licensor.
Identifiers
Publisher
Release Date2023
LanguageEnglish

Content Metadata

Subject Area
Genre
Abstract
We’re all moving fast and in order to do so we’re relying on a lot of dependencies to give us that commercial edge. In doing so we’re trusting the work of strangers on the internet, and also that of vendors who may change their mind on who can benefit from their software. The 2022 OSSRA (Open Source Security and Risk) report, examines the results of more than 2,400 audits of commercial codebases, of which 97% contained open source. Four of the 17 industry sectors represented in the report—Computer Hardware and Semiconductors, Cybersecurity, Energy and Clean Tech, and IoT—contained open source in 100% of their audited codebases. If you install Electron and have to add 87 packages — that means 87 license dependencies. Every single package is likely to have its own dependencies, and therefore, another license you need to comply with. As you can imagine license management can’t be done manually and when done incorrectly can create a technical debt. License litigation may end up forcing you to release your code under the same license as the package dependency you used. Other potential problems include being sued for financial liability by the creator of the component, and/or losing reputation and getting negative press coverage. Find out how to do a software composition analysis to create an SBOM (Software Bill of Materials), and how to monitor changes in your components’ licenses every time you deploy.