Enhancing OSS License Compliance Efficiency in Yocto Through Tool Integration
Talkat Open Source Summit Japan + AI_dev: Open Source GenAI & ML Summit + Automotive Linux Summit 2025 · 2025-12-08..12-10·
summary
Integration of meta-spdxscanner with FOSSology uploads recipe source archives to a FOSSology container, pulls analysis results and automatically compares them to Yocto recipe license fields, reducing manual checks. The prototype handles create-spdx output, highlights mismatches (example: NTP shows an unexpected BSD notice in a copyfile; another package reports MPL-only where recipe lists GPL/MPL/LGPL), and currently takes over 10 minutes per task; output formatting and false positives remain open issues.
AI-written summary · about
chapters (13)
- 0:00OSS license compliance in Yocto
- 2:59Licenses in open source software
- 5:30License compliance in Yocto recipes
- 7:30Metscanner layer for license updates
- 9:38Metspeedx for recipe licenses
- 12:18Deploying metscanner with Docker
- 13:47Phosology container setup
- 15:47Investigating recipes with metspeedx
- 17:19License issues for updates
- 18:48Summary and future challenges
- 21:24Q&A on license determination
- 23:35Improving license scanner quality
- 26:43Q&A on multiple licenses
related talks
32mSoftware Supply Chain with the Yocto Project
41mSoftware Bill of Materials and Supply Chain with the Yocto Project
34mCentralized Approach To Implement OSS Compliance Program for Various Software Products
33mORT Automate compliance using Open Source & InnerSource
28mGenerating a SPDX SBOM for Your Code in CI Using ORT
43mUsing SBOMs for Linux Foundation Projects
37mStreamlining Open-Source License Compliance With the Continuous Clearing Tool
15mShifting Open Source Compliance Activities Left