Understanding and Remediating Open-Source License Incompatibilities in the PyPI Ecosystem
https://arxiv.org/abs/2308.05942
Method
"we build an up-to-date dataset containing licensing and dependency information of 3,622,711 releases from 438,967 PyPI packages"
Population
"3,622,711 releases from 438,967 PyPI packages"
What it does not show
One ecosystem. Does not measure how many incompatibilities ever produced a legal claim, and the five-of-nine remediation figure is an illustrative sample rather than a population rate.
Weiwei Xu, Hao He, Kai Gao, Minghui Zhou
7.27% of package releases carried a licence incompatibility, and 61.3% of those were caused by transitive dependencies. When nine previously unknown incompatibilities were reported directly to maintainers, five were confirmed and fixed.
Tier II: Ecosystem-wide observational analysis of an entire registry’s release history, with a small tool-evaluation component. No control group.