Ensuring OSS License Compliance the Easy Way
summary
Describes a system that enforces open‑source license rules by integrating Bazel builds, a hermetic source‑controlled supply chain and SPDX license kinds so CI rejects noncompliant targets. Roles split into product engineer, OSS importer and a compliance team; license declarations live in repo metadata, conditions (notice, re‑linkable, pay‑per‑seat) gate allowed deployment environments, and install‑time checks block packages with internal “not deploy EU” or paid‑seat constraints. Google reports ongoing migration and a public implementation ready to land in Bazel.
AI-written summary · about
chapters (16)
- 0:00Intro
- 0:20Overview
- 1:23What is OSS License Compliance
- 3:57Who is this for
- 4:40Roles
- 4:51OSS Engineer
- 7:03License Model
- 7:32License Conditions
- 9:47Scale
- 10:05Tools
- 15:17License
- 16:10Automatic License Classification
- 17:30Source Code Control System
- 18:25License Declarations
- 20:45Product Engineers View
- 21:01License Check Rule
related talks
45mOSS License Compliance for Software Developers, NOT for Legal Experts
25mOpen Source Compliance
13mBuild license management into your pipelines
34mCentralized Approach To Implement OSS Compliance Program for Various Software Products
15mShifting Open Source Compliance Activities Left
50mRunning a Successful Open Source Project
31mLicense Compliance 101
49mLicensing Support by Build Systems and What Remains To Be Done