Build license management into your pipelines
summary
Audits of 2,400 commercial codebases find 97% contain open source, and installing Electron can pull in 87 license dependencies that each bring nested licenses; manual tracking becomes impossible. Build license checks into CI/CD, emit an SBOM from SCA tools, enforce a deny/allow list (about 20 licenses cover ~80% of enterprise use), and fail deploys on unexpected license changes. Recent re‑licensing examples include Apache 2.0 to BSL (Akka), Elastic’s move to a restrictive server license, and Grafana/Tempo switching to AGPL.
AI-written summary · about
chapters (16)
- 0:00Intro
- 0:22Open Source Security Risk Report
- 0:39Dependencies
- 2:06Introduction
- 2:42Contributing Today
- 4:30Open Source licenses
- 4:54Open Source Initiative
- 6:10Fork
- 6:46akka
- 7:56real licensing
- 8:07grafana
- 8:34cncf
- 9:08Trust
- 10:00Thomas and I
- 10:23Solutions
- 11:59Contact details
related talks
31mLicense Compliance 101
14mOpen Source Licensing in a Business World
25mEnsuring OSS License Compliance the Easy Way
01h 38mOpen Source Licensing: Types, Strategies and Compliance
45mOpen Source distributions in a cloud-native world: from a technical to a legal point of view
30mOpen Source Licensing: Use Versus Abuse
32mSOS: Sustainable Open Source
16mDeploying LLM on prem: let's review licenses and highlight open source technologies