Catch the Butterfly: Peeking into the Terms and Conflicts Among SPDX Licenses

The widespread adoption of third-party libraries (TPLs) in software development has significantly accelerated the creation of modern software. However, this convenience comes with potential legal risks. Developers may inadvertently violate the licenses of TPLs, leading to legal issues. While existing studies have explored software licenses and potential incompatibilities, these studies often focus on a limited set of licenses or rely on low-quality license data, which may affect their conclusions. To address this gap, there is an urgent need for a high-quality license dataset that encompasses a broad range of mainstream licenses and provides accurate terms and conflict information, to help developers navigate the complex landscape of software licenses, avoid potential legal pitfalls, and guide more informed and effective solutions for managing license compliance and compatibility in software development. To this end, we conduct the first work to understand the mainstream software licenses based on term granularity and obtain a high-quality dataset of 453 SPDX licenses with well-labeled terms and conflicts. Specifically, we first conduct a differential analysis of the mainstream platforms that provide license data to understand the terms and attitudes of each license. N ext, we further propose a standardized set of license terms to capture and label existing mainstream licenses with high quality. Moreover, we improve the existing license conflict mode to include copyleft conflicts and conclude the three major types of license conflicts among the 453 SPDX licenses. Based on the dataset, we carry out two empirical studies to reveal the concerns and threats from the perspectives of both licensors and licensees. One study provides an in-depth analysis of the similarities, differences, and conflicts among SPDX licenses, and the other revisits the usage and conflicts of licenses in the NPM ecosystem and draws conclusions that differ from previous work. Our studies reveal some insightful findings and disclose relevant analytical data, which set the stage for further research into the complexities of license compliance and compatibility.