License Incompatibilities in Software Ecosystems
https://arxiv.org/abs/2203.01634
Method
"we study license use and license incompatibilities between all components from seven package registries (Cargo, Maven, NPM, NuGet, Packagist, PyPI, RubyGems)"
Population
"all components from seven package registries (Cargo, Maven, NPM, NuGet, Packagist, PyPI, RubyGems)"
What it does not show
A static comparison of declared licences. It does not show that anyone noticed, was sued, was forced to relicense, or remediated — no legal consequence or developer awareness is measured.
Rolf-Helge Pfeiffer
Direct incompatibility rates ranged from 2.3% in one registry to 20.8% in another. Copyleft exposure is overwhelmingly indirect: direct incompatibilities from one strong copyleft licence peaked at 0.04%, while 6.62% of packages in another registry were violating that licence via an indirect dependency.
Tier II: Full-population mining of licence metadata and dependency graphs across seven entire package registries. Observational, no control group.