59 KiB
59 KiB
type:: REVIEWS tags:: year:: 2025 venue:: TSE full-title:: date-start:: 20-03-2025 - 11:45 date-submitted:: external-links:: status:: DONE deadline-submission:: file:: @TSE-2025-01-0038_Proof_hi parent:: todoist:: https://app.todoist.com/app/task/tse-2025-01-0038-now-in-your-reviewer-center-6XC74mfX88JcWMMg
- ### [[Highlights]]
- # Annotazioni
(23/3/2025, 18:30:54)
- “A Study of Third-Party Libraries in GitHub Projects” ([“TSE-2025-01-0038_Proof_hi”, p. 1](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=2&annotation=NRNCY42T)) #ffd400
*The real focus of the paper is not broad, it supports Python projects. The title has to be refined and also the threats to validity section should include a discussion on this aspect.*
- “Open-source licenses provide developers with considerable freedom to use, modify, and distribute source code, but they also impose obligations that can lead to legal or compliance risks.” ([“TSE-2025-01-0038_Proof_hi”, p. 1](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=2&annotation=HEQCVSZ4)) #5fb236
- “Although license-related issues have received significant research attention, most existing work focuses on a limited subset of licenses and often overlooks copyright terms.” ([“TSE-2025-01-0038_Proof_hi”, p. 1](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=2&annotation=FH24WT7C)) #a28ae5
- “Our approach systematically extracts licenses for both the project and its dependencies, employs large language models (LLMs) to interpret key copyright-related terms, and checks for potential noncompliance.” ([“TSE-2025-01-0038_Proof_hi”, p. 1](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=2&annotation=EP5MATIQ)) #e56eee
- “These licenses are among the most critical nonexecutable components of software systems” ([“TSE-2025-01-0038_Proof_hi”, p. 1](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=2&annotation=9WNSBN4W)) #5fb236
- “Adherence to the terms and conditions outlined in these licenses is crucial.” ([“TSE-2025-01-0038_Proof_hi”, p. 1](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=2&annotation=6DTLM2ZU)) #5fb236
- “legal disputes have arisen in cases where redistribution terms were not followed” ([“TSE-2025-01-0038_Proof_hi”, p. 1](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=2&annotation=YDXVYL5S)) #5fb236
- “By ensuring license adherence, developers can prevent legal disputes and sustain the collaborative ethos of the open-source community.” ([“TSE-2025-01-0038_Proof_hi”, p. 1](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=2&annotation=MFQ3LJIS)) #5fb236
- “verifying compliance with copyright-related terms remains challenging for opensource projects.” ([“TSE-2025-01-0038_Proof_hi”, p. 1](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=2&annotation=84AGWAAN)) #e56eee
- “the widespread use of third-party libraries complicates the process.” ([“TSE-2025-01-0038_Proof_hi”, p. 1](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=2&annotation=JTQ6ITQ5)) #5fb236
- “28 third-party libraries, with one project relying on as many as 764” ([“TSE-2025-01-0038_Proof_hi”, p. 1](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=2&annotation=C7QD8SU5)) #a28ae5
- “Mismanagement of third-party dependencies can lead to inadvertent violations of license terms.” ([“TSE-2025-01-0038_Proof_hi”, p. 1](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=2&annotation=4WUFTPCE)) #5fb236
- “Python projects typically reference third-party packages in a requirements file.” ([“TSE-2025-01-0038_Proof_hi”, p. 1](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=2&annotation=G6E6IE6V)) #a28ae5
- “However, some Python projects embed third-party package files directly in their repositories or bundle them within distributed software packages” ([“TSE-2025-01-0038_Proof_hi”, p. 1](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=2&annotation=6MJILIDT)) #a28ae5
- “distribution, and failure to comply with the relevant license terms under such circumstances may result in copyright violations” ([“TSE-2025-01-0038_Proof_hi”, p. 1](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=2&annotation=DLD59RSK)) #e56eee
- “Identifying and evaluating all applicable licenses is therefore critical to ensure compliance in open-source projects.” ([“TSE-2025-01-0038_Proof_hi”, p. 1](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=2&annotation=KD2KUJPB)) #e56eee
- “The Open Source Initiative (OSI) has approved approximately 130 licenses [11], each with unique terms, and the list continues to grow as new licenses are developed to address specific needs [12]” ([“TSE-2025-01-0038_Proof_hi”, p. 1](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=2&annotation=4WDFEG8X)) #f19837
- “level of restriction they impose” ([“TSE-2025-01-0038_Proof_hi”, p. 1](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=2&annotation=4INPNFRQ)) #5fb236
- “strong copyleft” ([“TSE-2025-01-0038_Proof_hi”, p. 2](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=3&annotation=4XCUX9PP)) #2ea8e5
- “weak copyleft” ([“TSE-2025-01-0038_Proof_hi”, p. 2](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=3&annotation=G7F3HCGL)) #2ea8e5
- “permissive” ([“TSE-2025-01-0038_Proof_hi”, p. 2](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=3&annotation=3N9EMRKM)) #2ea8e5
- “Strong copyleft licenses, such as GPLv3 and OSLv3, require derivative works to remain under the same license and be open source” ([“TSE-2025-01-0038_Proof_hi”, p. 2](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=3&annotation=U2ISQRFP)) #2ea8e5
- “copyleft licenses, such as EPLv2 and MPLv2, allow derivative works to adopt different licenses while maintaining the original code as open source.” ([“TSE-2025-01-0038_Proof_hi”, p. 2](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=3&annotation=63RNULVC)) #2ea8e5
- “ermissive licenses, including BSD and Apachev2.0, provide significant flexibility, permitting redistribution under different licenses” ([“TSE-2025-01-0038_Proof_hi”, p. 2](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=3&annotation=SK6IY42Y)) #2ea8e5
- “Several studies have explored the general usage of licenses [14], [15], [16], [17], analyzing their evolution and popularity to identify trends within the OSS community.” ([“TSE-2025-01-0038_Proof_hi”, p. 2](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=3&annotation=IWWFX37Q)) #f19837
- “To address this knowledge gap, this paper introduces an automated approach for detecting copyright term violations in GitHub projects.” ([“TSE-2025-01-0038_Proof_hi”, p. 2](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=3&annotation=DGKBH6LS)) #e56eee
- “identifying the third-party libraries used within a project and extracting their associated licenses” ([“TSE-2025-01-0038_Proof_hi”, p. 2](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=3&annotation=RRDNWVYL)) #2ea8e5
- “analyzed the key characteristics of the licenses and the copyright-related terms present in these projects.” ([“TSE-2025-01-0038_Proof_hi”, p. 2](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=3&annotation=BG9DJQ7H)) #2ea8e5
- “Leveraging large language models (LLMs), we employ customized prompts to interpret these terms with high accuracy.” ([“TSE-2025-01-0038_Proof_hi”, p. 2](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=3&annotation=L9Y2MLBK)) #2ea8e5
- “we assess whether the project adheres to the copyright requirements specified in the licenses of the relevant third-party libraries” ([“TSE-2025-01-0038_Proof_hi”, p. 2](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=3&annotation=KIXBT94P)) #2ea8e5
- “Our approach successfully extracted tens of thousands of licenses and identified numerous instances of copyright term violations.” ([“TSE-2025-01-0038_Proof_hi”, p. 2](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=3&annotation=3235LIZ3)) #ffd400
*Interesting to see how these have been validated.*
- “approximately 10% of the projects were found to violate one or more copyright terms” ([“TSE-2025-01-0038_Proof_hi”, p. 2](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=3&annotation=NZTQGPKZ)) #f19837
- “We address the issue of detecting violations of copyright-related terms in opensource projects” ([“TSE-2025-01-0038_Proof_hi”, p. 2](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=3&annotation=7WQU39PP)) #2ea8e5
- “extracts licenses from projects and LLMs to interpret copyright terms” ([“TSE-2025-01-0038_Proof_hi”, p. 2](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=3&annotation=2LIXRRAX)) #2ea8e5
- “evaluated it on 500 popular Python projects, examining key aspects such as license extraction, term interpretation, and violation detection.” ([“TSE-2025-01-0038_Proof_hi”, p. 2](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=3&annotation=YHXQXIXE)) #2ea8e5
- “license comprehension” ([“TSE-2025-01-0038_Proof_hi”, p. 2](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=3&annotation=YXX8ACAS)) #2ea8e5
- “license violation” ([“TSE-2025-01-0038_Proof_hi”, p. 2](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=3&annotation=5YCDARTU)) #2ea8e5
- “license compatibility.” ([“TSE-2025-01-0038_Proof_hi”, p. 2](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=3&annotation=TARRGMIG)) #2ea8e5
- “manual extraction and are limited to a small subset of popular licenses.” ([“TSE-2025-01-0038_Proof_hi”, p. 3](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=4&annotation=65QXKLN4)) #f19837
- “extract rights and obligations from license texts.” ([“TSE-2025-01-0038_Proof_hi”, p. 3](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=4&annotation=DXVHRH2Z)) #a28ae5
- “text summarization and term classification” ([“TSE-2025-01-0038_Proof_hi”, p. 3](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=4&annotation=XML6CP24)) #5fb236
- “Our research focuses on extracting and interpreting copyright-related terms within licenses. Unlike previous studies, we leverage LLMs to achieve this goal. The use of LLMs offers several advantages, including the ability to handle a broader spectrum of license types and expressions with greater accuracy and flexibility.” ([“TSE-2025-01-0038_Proof_hi”, p. 3](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=4&annotation=XX4LPEJX)) #a28ae5
- “These methods often involve manually modeling the compatibility relationships of widely used licenses or those implemented in real-world projects, focusing on resolving non-compliance due to conflicting terms” ([“TSE-2025-01-0038_Proof_hi”, p. 3](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=4&annotation=LJW5BRMW)) #5fb236
- “Furthermore, these methods generally concentrate on a limited set of popular licenses and rely on manual modeling of violations, particularly those related to copyleft terms.” ([“TSE-2025-01-0038_Proof_hi”, p. 3](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=4&annotation=P8ID6R59)) #a28ae5
- “Given that software released in binary form often includes third-party packages without respecting their licensing terms, Hemel et al. [7] introduced a tool to scan binary files and identify the third-party packages used in a project.” ([“TSE-2025-01-0038_Proof_hi”, p. 3](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=4&annotation=M4GMTNUA)) #5fb236
- “there is currently no comprehensive work on detecting violations across the full spectrum of copyright-related terms.” ([“TSE-2025-01-0038_Proof_hi”, p. 3](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=4&annotation=W463EYJD)) #a28ae5
- “learning-based techniques [2]” ([“TSE-2025-01-0038_Proof_hi”, p. 4](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=5&annotation=2SS8L3PZ)) #f19837
- “Unlike these works, which focus on the compatibility of license terms, this paper examines whether open GitHub projects comply with the copyright-related terms in their licenses.” ([“TSE-2025-01-0038_Proof_hi”, p. 4](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=5&annotation=SPF9RXN6)) #ffd400
*It's not clear to what extent this is different from the mentioned existing work on license compatibility!!! TO BE CHECKED*
- “violations of copyright terms in licenses associated with GitHub projects” ([“TSE-2025-01-0038_Proof_hi”, p. 4](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=5&annotation=5R6IC6CM)) #e56eee
- “license extraction, license understanding, and license violation detection.” ([“TSE-2025-01-0038_Proof_hi”, p. 4](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=5&annotation=T6AYGVNH)) #2ea8e5
- “The primary objective of this approach is to verify whether projects comply with copyright requirements when using third-party librarie” ([“TSE-2025-01-0038_Proof_hi”, p. 4](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=5&annotation=YXXB49XD)) #e56eee
- “identifying the third-party libraries utilized by an open-source GitHub project” ([“TSE-2025-01-0038_Proof_hi”, p. 4](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=5&annotation=N9R9YQZG)) #2ea8e5
- “extracting the licenses associated with these dependencies” ([“TSE-2025-01-0038_Proof_hi”, p. 4](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=5&annotation=9PDCZF4N)) #2ea8e5
- “Additionally, understanding the project’s own license is essential for detecting potential conflicts or violations involving third-party licenses” ([“TSE-2025-01-0038_Proof_hi”, p. 4](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=5&annotation=4HBSJXPQ)) #5fb236
- “To address this, our approach extracts the licenses of both the project and its third-party libraries by analyzing the codebase and repository files.” ([“TSE-2025-01-0038_Proof_hi”, p. 4](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=5&annotation=IMJ6637Z)) #2ea8e5
- “analyze the copyright-related terms of the third-party licenses.” ([“TSE-2025-01-0038_Proof_hi”, p. 4](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=5&annotation=ZMRI5DJ8)) #2ea8e5
- “To ensure accurate interpretation of these terms, we leverage LLMs with customized prompts tailored to the specific features of each license, enhancing the precision of the analysis.” ([“TSE-2025-01-0038_Proof_hi”, p. 4](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=5&annotation=554KPCZ3)) #5fb236
- “we pre-analyzed the copyright terms of OSI-certified licenses and developed a comprehensive license knowledge base” ([“TSE-2025-01-0038_Proof_hi”, p. 4](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=5&annotation=JWTECFNW)) #5fb236
- “efficient identification of potential violations” ([“TSE-2025-01-0038_Proof_hi”, p. 4](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=5&annotation=DZ546PUB)) #ffd400
*TO BE CHECKED HOW THIS IDENTIFICATION IS DONE AND TO WHAT EXTENT SUCH A KNOWLEDGE BASE CONTRIBUTE THE IDENTIFICATION.*
- “Licenses of thirdparty libraries often contain copyright-related terms that typically apply to actions such as distribution or the creation of derivative works.” ([“TSE-2025-01-0038_Proof_hi”, p. 4](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=5&annotation=MCZRT6I7)) #5fb236
- “For such licenses, even importing a library may require compliance with their copyright terms.” ([“TSE-2025-01-0038_Proof_hi”, p. 4](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=5&annotation=6TMXWD2Z)) #5fb236
- “Subsequently, we focus on assessing the project’s compliance with the copyright requirements of its third-party dependencies.” ([“TSE-2025-01-0038_Proof_hi”, p. 4](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=5&annotation=YUCMZWX2)) #a28ae5
- “In this paper, we focus on Python projects, where dependencies and third-party packages are typically declared in a requirements.txt file.” ([“TSE-2025-01-0038_Proof_hi”, p. 4](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=5&annotation=4MD5JX3D)) #5fb236
- “However, previous research [24] has shown that the licenses for PyPi packages can evolve over time, with different versions of the same package potentially being governed by different licenses.” ([“TSE-2025-01-0038_Proof_hi”, p. 5](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=6&annotation=BA5BRKMF)) #5fb236
- “This file includes all third-party dependencies along with their corresponding versions.” ([“TSE-2025-01-0038_Proof_hi”, p. 5](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=6&annotation=66SLVGJT)) #a28ae5
- “normalized_licenses field” ([“TSE-2025-01-0038_Proof_hi”, p. 5](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=6&annotation=X94VHZLB)) #5fb236
- “spdx_expression” ([“TSE-2025-01-0038_Proof_hi”, p. 5](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=6&annotation=ER92AA9U)) #ffd400
*what's that?*
- “While this API provides licensing information for dependencies, the data retrieved may not always be comprehensive.” ([“TSE-2025-01-0038_Proof_hi”, p. 5](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=6&annotation=7GH2EU4P)) #5fb236
- “This combined approach ensured that we acquired all necessary licensing information for the thirdparty packages used in the GitHub project.” ([“TSE-2025-01-0038_Proof_hi”, p. 5](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=6&annotation=4PGI3YBL)) #a28ae5
- “However, we limited our license extraction to the first level of dependencies.” ([“TSE-2025-01-0038_Proof_hi”, p. 5](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=6&annotation=55LU3Y3I)) #ffd400
*Does this induce some limitations of the whole copryright violation approach?*
- “Moreover, from the perspective of developers using third-party libraries, their responsibility typically extends only to complying with the licenses explicitly declared by the third-party packages they use.” ([“TSE-2025-01-0038_Proof_hi”, p. 5](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=6&annotation=IG52S5ID)) #5fb236
- “They should not be held accountable for issues arising from transitive dependencies,” ([“TSE-2025-01-0038_Proof_hi”, p. 5](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=6&annotation=XVPAM5FA)) #e56eee
- “Additionally, in cases where the license information for third-party packages is incomplete, our approach could be applied to those packages as well, addressing any gaps” ([“TSE-2025-01-0038_Proof_hi”, p. 5](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=6&annotation=J3LGU3X8)) #5fb236
- “Therefore, our analysis is confined to the first layer of dependencies.” ([“TSE-2025-01-0038_Proof_hi”, p. 5](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=6&annotation=58MRSKTL)) #a28ae5
- “The final metadata for third-party dependencies includes pakName, pakLic, pakAuthor, pakURL, and pakLicenseURL.” ([“TSE-2025-01-0038_Proof_hi”, p. 5](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=6&annotation=Q5XV9C28)) #5fb236
- “pakLicenseURL refers to the original link to the license.” ([“TSE-2025-01-0038_Proof_hi”, p. 5](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=6&annotation=C8TYEBA4)) #a28ae5
- “Although our focus here is on Python projects, a similar approach can be adapted to projects written in other languages, with the appropriate tools or commands used to extract the relevant information.” ([“TSE-2025-01-0038_Proof_hi”, p. 5](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=6&annotation=MBTAX2A2)) #ffd400
*Maybe. We are missing evidence on this. We do not have any supporting reference for this statement!*
- “ScanCode constructs a search index of license texts and detection rules, enabling it to match text extracted from files with an accuracy rate of up to 95%” ([“TSE-2025-01-0038_Proof_hi”, p. 5](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=6&annotation=QKXPQ8JW)) #5fb236
- “It begins by cataloging code files and classifying them by type.” ([“TSE-2025-01-0038_Proof_hi”, p. 5](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=6&annotation=5EU8PW3A)) #5fb236
- “xtracts text from binary files.” ([“TSE-2025-01-0038_Proof_hi”, p. 5](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=6&annotation=W6CTBCMG)) #5fb236
- “The tool subsequently organizes the project code and gathers relevant metadata, ultimately generating a report in JSON or CSV format.” ([“TSE-2025-01-0038_Proof_hi”, p. 5](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=6&annotation=8WN4KS9J)) #a28ae5
- “license types” ([“TSE-2025-01-0038_Proof_hi”, p. 5](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=6&annotation=Y3YNMDMT)) #2ea8e5
- “associated file” ([“TSE-2025-01-0038_Proof_hi”, p. 5](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=6&annotation=DWW23RDD)) #2ea8e5
- “hierarchy” ([“TSE-2025-01-0038_Proof_hi”, p. 5](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=6&annotation=5L2TLY7G)) #2ea8e5
- “corresponding license texts.” ([“TSE-2025-01-0038_Proof_hi”, p. 5](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=6&annotation=FZRWEBQP)) #2ea8e5
- “SPDX format, a widely adopted standard for open-source licenses” ([“TSE-2025-01-0038_Proof_hi”, p. 5](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=6&annotation=FXWW5BXF)) #a28ae5
- “Through this process, we identified the third-party libraries used in the projects.” ([“TSE-2025-01-0038_Proof_hi”, p. 5](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=6&annotation=V5595SXV)) #e56eee
- “a coarse-grained identification of license information, such as the license name and basic details, without delving into the specific terms of the licenses.” ([“TSE-2025-01-0038_Proof_hi”, p. 5](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=6&annotation=2L64HLPS)) #a28ae5
- “identify and interpret these terms within the licenses.” ([“TSE-2025-01-0038_Proof_hi”, p. 5](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=6&annotation=CW8IJ2EJ)) #a28ae5
- “transformer architecture” ([“TSE-2025-01-0038_Proof_hi”, p. 5](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=6&annotation=IYEJD2YK)) #5fb236
- “"pakLic":"GPL-3.0",” ([“TSE-2025-01-0038_Proof_hi”, p. 6](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=7&annotation=WQSLGXMF)) #ffd400
- ““detected_license_expression_spdx”:”GPL-3.0”,” ([“TSE-2025-01-0038_Proof_hi”, p. 6](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=7&annotation=DI4NWLWS)) #ffd400
- “reduced computational costs” ([“TSE-2025-01-0038_Proof_hi”, p. 6](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=7&annotation=KJ8I7CFX)) #ffd400
- “ChatGPT stand out in natural language inference, significantly outperforming previous models like BERT on various datasets.” ([“TSE-2025-01-0038_Proof_hi”, p. 6](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=7&annotation=6JE6WGHG)) #a28ae5
- “ChatGPT-4.0 [” ([“TSE-2025-01-0038_Proof_hi”, p. 6](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=7&annotation=DEVUTX54)) #2ea8e5
- “interpreting and classifying license terms, with a particular emphasis on copyright-related terms.” ([“TSE-2025-01-0038_Proof_hi”, p. 6](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=7&annotation=MJ79HQX7)) #a28ae5
- “The essence of this strategy lies in carefully structuring the prompts to guide the model in understanding complex legal language while also ensuring that the generated outputs are both precise and relevant.” ([“TSE-2025-01-0038_Proof_hi”, p. 6](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=7&annotation=BMP5IYKW)) #e56eee
- “1) Provision of License Text” ([“TSE-2025-01-0038_Proof_hi”, p. 6](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=7&annotation=5CENUUBI)) #2ea8e5
- “Dimension-Based Structuring” ([“TSE-2025-01-0038_Proof_hi”, p. 6](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=7&annotation=IMTDDQJC)) #2ea8e5
- “e.g.,” ([“TSE-2025-01-0038_Proof_hi”, p. 6](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=7&annotation=YH2P7BCJ)) #ffd400
*What else? It is necessary to show the full set of dimensions!*
- “permissions” ([“TSE-2025-01-0038_Proof_hi”, p. 6](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=7&annotation=VPZ63DZ5)) #5fb236
- “restrictions” ([“TSE-2025-01-0038_Proof_hi”, p. 6](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=7&annotation=6QDI2CL4)) #5fb236
- “obligations” ([“TSE-2025-01-0038_Proof_hi”, p. 6](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=7&annotation=CYT6VCMI)) #5fb236
- “Interpretation Guidance:” ([“TSE-2025-01-0038_Proof_hi”, p. 6](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=7&annotation=NJHGQA7V)) #2ea8e5
- “guiding” ([“TSE-2025-01-0038_Proof_hi”, p. 6](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=7&annotation=YTNGUKD5)) #ffd400
*what else?*
- “4) Clear Objectives:” ([“TSE-2025-01-0038_Proof_hi”, p. 6](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=7&annotation=Y5ZJMJNY)) #2ea8e5
- “5) Output Standardization:” ([“TSE-2025-01-0038_Proof_hi”, p. 6](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=7&annotation=L5U5ITHF)) #2ea8e5
- “three categories:” ([“TSE-2025-01-0038_Proof_hi”, p. 6](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=7&annotation=XUZ8J957)) #f19837
- “permissions (actions the license permits developers to perform), restrictions (additional conditions developers must follow), and obligations (requirements developers must adhere to)” ([“TSE-2025-01-0038_Proof_hi”, p. 6](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=7&annotation=YQQLTY3H)) #ffd400
*Previously, these were presented as example. Have you considered these three categories, or do you have some more? Moreover, here you are repeating what it is written for the "Dimension-Based Structuring" aspect.*
- “These categories include terms related to distribution, modification, commercial use, liability, and more [21]. Each term is assigned one of four attitudes: “allowed”, indicating the license permits the activity; “prohibited”, meaning the license explicitly forbids it; “must”, specifying the license mandates the action; and “not mentioned”, meaning the license does not address the particular issue, enhancing ChatGPT’s ability to interpret licenses.” ([“TSE-2025-01-0038_Proof_hi”, p. 6](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=7&annotation=2Y5MD7D9)) #ffd400
*This is a repetition of what has been written for the "interpretation guidance" part.*
- “We then narrow the focus to copyright-related terms, referencing previous research that has analyzed some licenses [20], [21], [64] to provide examples of such terms” ([“TSE-2025-01-0038_Proof_hi”, p. 6](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=7&annotation=73KB6T92)) #5fb236
- “Finally, we explicitly state our objective and provide an example output format to guide ChatGPT in generating the desired results.” ([“TSE-2025-01-0038_Proof_hi”, p. 6](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=7&annotation=845I729Z)) #ffd400
*Can you show an example?*
- “134 licenses, focusing on extracting their copyright terms” ([“TSE-2025-01-0038_Proof_hi”, p. 6](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=7&annotation=PV356K3K)) #5fb236
- “Additionally, we analyzed the extracted copyright terms across these licenses and identified five common types of terms.” ([“TSE-2025-01-0038_Proof_hi”, p. 6](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=7&annotation=9J8URA8R)) #5fb236
- “Include Copyright” ([“TSE-2025-01-0038_Proof_hi”, p. 6](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=7&annotation=CI6PDKY7)) #2ea8e5
- “indemnification” ([“TSE-2025-01-0038_Proof_hi”, p. 7](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=8&annotation=GQZ7WKEP)) #a28ae5
- “copyright clauses:” ([“TSE-2025-01-0038_Proof_hi”, p. 7](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=8&annotation=CJA5WFPK)) #ffd400
*What is the resulting clauses that you got by analyzing the different licenses?*
- “Example of standardized JSON output format” ([“TSE-2025-01-0038_Proof_hi”, p. 7](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=8&annotation=5KRKWINF)) #ffd400
*Can you show an example/fragment for a real license?*
- “Include License” ([“TSE-2025-01-0038_Proof_hi”, p. 7](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=8&annotation=FQRVIAFZ)) #2ea8e5
- “Include Notice” ([“TSE-2025-01-0038_Proof_hi”, p. 7](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=8&annotation=8CZRKLD4)) #2ea8e5
- “Same License” ([“TSE-2025-01-0038_Proof_hi”, p. 7](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=8&annotation=99XITBX4)) #2ea8e5
- “Disclose Source” ([“TSE-2025-01-0038_Proof_hi”, p. 7](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=8&annotation=24XQMD69)) #2ea8e5
- “These terms were selected because they represent the most critical legal requirements in open-source licensing, addressing fundamental aspects of software usage, modification, and redistribution. The decision to concentrate on these terms, rather than others such as patent-related terms or specific attribution requirements, was guided by their broad applicability across diverse licenses and their significant impact on copyright compliance” ([“TSE-2025-01-0038_Proof_hi”, p. 7](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=8&annotation=AKTCVKJP)) #ffd400
*Some statistics related to these terms can better support this claim.
Moreover, it is not clear how humans have been in the loop during this phase of the process.*
- “Although other terms are also important, our selection prioritizes those most likely to result in significant license violations if not properly followed, thereby providing a strong foundation for our license violation detection efforts.” ([“TSE-2025-01-0038_Proof_hi”, p. 7](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=8&annotation=8UFBD29H)) #5fb236
- “The knowledge base is also available in the online supplementary materials1.” ([“TSE-2025-01-0038_Proof_hi”, p. 7](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=8&annotation=HRI87SZ4)) #ff6666
*It's missing!*
- “Here, we rely on the licenses extracted from the project and the interpreted copyright terms established in earlier stages” ([“TSE-2025-01-0038_Proof_hi”, p. 7](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=8&annotation=RB85BIEK)) #5fb236
- “In most cases, copyright-related requirements apply only in situations of distribution or derivative works.” ([“TSE-2025-01-0038_Proof_hi”, p. 8](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=9&annotation=9526MKXA)) #ffd400
*This is not clear, especially after the previous sentence.*
- “we begin by determining whether the project’s use of these libraries qualifies as distribution or derivation (except for libraries under strong copyleft licenses).” ([“TSE-2025-01-0038_Proof_hi”, p. 8](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=9&annotation=U7SSRRAT)) #ffd400
*This is important. However, an explanatory example is missing here!*
- “We start by describing our approach for assessing distribution behavior and then discuss how we evaluate compliance with each of these terms” ([“TSE-2025-01-0038_Proof_hi”, p. 8](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=9&annotation=YVBY78ES)) #5fb236
- “Sometimes, third-party libraries are bundled with the project for convenience or for offline usage.” ([“TSE-2025-01-0038_Proof_hi”, p. 8](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=9&annotation=P75IJNBH)) #a28ae5
- “To determine whether a project is distributing a thirdparty library, we begin by scanning all project files for formats commonly used to package Python libraries, such as .tar.gz, .zip, .whl, and .egg.” ([“TSE-2025-01-0038_Proof_hi”, p. 8](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=9&annotation=PBMWH2PY)) #ffd400
*This is very Python specific and it confirms my previous comments on the generalizability of the approach.*
- “non-empty purl field that accurately identifies the package name and version.” ([“TSE-2025-01-0038_Proof_hi”, p. 8](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=9&annotation=VNHGT4HZ)) #ffd400
*Can this be a threat to constuct validity of the approach?*
- “To avoid false positives, we validate the package name and version using the libraries.io API, ensuring the package originates from an official source.” ([“TSE-2025-01-0038_Proof_hi”, p. 8](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=9&annotation=HZ72EF2X)) #ffd400
*This step is not clear. What are the given inputs?*
- “Files passing these checks are classified as third-party libraries that have been distributed by the opensource project” ([“TSE-2025-01-0038_Proof_hi”, p. 8](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=9&annotation=FU9T2Z9D)) #5fb236
- “Include Copyright.” ([“TSE-2025-01-0038_Proof_hi”, p. 8](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=9&annotation=T44PXXBW)) #2ea8e5
- “If an Authori (1 ≤ i ≤ n) matching the third-party dependency is found in the project file, we consider the term requirements satisfied.” ([“TSE-2025-01-0038_Proof_hi”, p. 8](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=9&annotation=4G2PDWCT)) #ffd400
*All these steps are not clear without an explanatory example.*
- “If no matching author is found in the project files, then strictly speaking, the project fails to fulfill this term’s requirement.” ([“TSE-2025-01-0038_Proof_hi”, p. 8](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=9&annotation=4GIJEIP9)) #5fb236
- “As a result, we also check whether the distributed package includes a copyright notice. If neither the open-source project nor the package contains the necessary notice, we conclude that a license violation has occur” ([“TSE-2025-01-0038_Proof_hi”, p. 8](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=9&annotation=4KTJXLHP)) #ffd400
*See my previous comment.*
- “Include License.” ([“TSE-2025-01-0038_Proof_hi”, p. 8](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=9&annotation=2JMD4UQ4)) #2ea8e5
- “However, we apply a relaxed criterion: if the third-party package itself includes the required license information, we treat the term as satisfied.” ([“TSE-2025-01-0038_Proof_hi”, p. 8](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=9&annotation=XUJK3AAX)) #5fb236
- “Include Notice.” ([“TSE-2025-01-0038_Proof_hi”, p. 8](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=9&annotation=9R7YJB3W)) #2ea8e5
- “license extraction, license understanding, and license violation detection, each of which is integral to ensuring compliance with opensource licenses, particularly concerning copyright terms.” ([“TSE-2025-01-0038_Proof_hi”, p. 9](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=10&annotation=LFKFDH6B)) #ffd400
*You already said this.*
- “license extraction component” ([“TSE-2025-01-0038_Proof_hi”, p. 9](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=10&annotation=3BPVXSMY)) #2ea8e5
- “What are the characteristics of these licenses, including their quantity, type, and distribution?” ([“TSE-2025-01-0038_Proof_hi”, p. 9](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=10&annotation=6SWIXMH4)) #ffd400
*This part is not properly connected with the first part of the research question*
- “accurately” ([“TSE-2025-01-0038_Proof_hi”, p. 9](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=10&annotation=L2GB765F)) #2ea8e5
- “interpret” ([“TSE-2025-01-0038_Proof_hi”, p. 9](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=10&annotation=X98RYYSJ)) #2ea8e5
- “What is the proportion and coverage of these terms across licenses in open-source projects?” ([“TSE-2025-01-0038_Proof_hi”, p. 9](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=10&annotation=AAYADCFW)) #ffd400
*Same as RQ1. This second part is not properly connected with the first part of RQ2.*
- “effectively” ([“TSE-2025-01-0038_Proof_hi”, p. 9](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=10&annotation=VLN7MI7M)) #ffd400
*How to measure that?*
- “how accurate is its assessment of thirdparty library distribution behavior?” ([“TSE-2025-01-0038_Proof_hi”, p. 9](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=10&annotation=3U4K2SJ8)) #ffd400
*This is disconnected from the first part of RQ3.*
- “RQ1 evaluates the effectiveness of our license extraction component, focusing on how accurately it identifies licenses in open-source projects.” ([“TSE-2025-01-0038_Proof_hi”, p. 9](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=10&annotation=NN9634CA)) #2ea8e5
- “RQ2 assesses our approach’s capability in understanding copyright terms within the extracted licenses” ([“TSE-2025-01-0038_Proof_hi”, p. 9](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=10&annotation=EN3L6MD6)) #2ea8e5
- “interpreted copyright terms” ([“TSE-2025-01-0038_Proof_hi”, p. 9](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=10&annotation=EG523I5A)) #2ea8e5
- “RQ3 investigates how effectively our approach detects violations of copyright-related terms.” ([“TSE-2025-01-0038_Proof_hi”, p. 9](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=10&annotation=3GTD72NG)) #2ea8e5
- “We will measure the number of detected violations and, because many of these terms impose restrictions on distribution, we will also assess our approach’s accuracy in evaluating third-party library distribution behavior.” ([“TSE-2025-01-0038_Proof_hi”, p. 9](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=10&annotation=AQWXSWK7)) #5fb236
- “project metadat” ([“TSE-2025-01-0038_Proof_hi”, p. 9](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=10&annotation=F2SQ8LXA)) #2ea8e5
- “epository content” ([“TSE-2025-01-0038_Proof_hi”, p. 9](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=10&annotation=WBI546IJ)) #2ea8e5
- “commit histories.” ([“TSE-2025-01-0038_Proof_hi”, p. 9](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=10&annotation=4L3XGGPQ)) #ffd400
*Why do you need them? Is time also a dimension that you take into account?*
- “Our focus is specifically on Python projects due to Python’s widespread use and the availability of numerous well-maintained open-source projects in this language. Python is also commonly used in various domains, making it a representative language for evaluating our approach” ([“TSE-2025-01-0038_Proof_hi”, p. 9](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=10&annotation=DTQ7QTLW)) #ffd400
*It's too late to say that. The work is Python specific and consequently this is both motivation and description of the paper's focus. I don't think the approach can be used on different technologies.*
- “500 Python projects” ([“TSE-2025-01-0038_Proof_hi”, p. 9](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=10&annotation=HMFL2XQN)) #2ea8e5
- “128 small projects (0-5MB)” ([“TSE-2025-01-0038_Proof_hi”, p. 9](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=10&annotation=2HT9EAQK)) #2ea8e5
- “192 medium-sized projects (5MB-50MB)” ([“TSE-2025-01-0038_Proof_hi”, p. 9](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=10&annotation=EMIEQHPW)) #2ea8e5
- “180 large projects (over 50MB)” ([“TSE-2025-01-0038_Proof_hi”, p. 9](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=10&annotation=ITY946FR)) #2ea8e5
- “have a significant impact on the open-source community. By including projects from various fields, such as web development, data science, machine learning, and system utilities, we ensure that our dataset reflects the broad spectrum of Python applications, making our findings more generalizable and applicable across different types of software projects. We believe that this dataset provides substantial reference value for our research, as it mirrors the practices and challenges faced by developers working on prominent projects. The complete list of these p” ([“TSE-2025-01-0038_Proof_hi”, p. 10](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=11&annotation=RDSH9MB4)) #ffd400
*A table presenting the peculiar characteristics (including the domain of each project) of the dataset would help here.*
- “effectiveness of the license extraction component in our approach” ([“TSE-2025-01-0038_Proof_hi”, p. 10](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=11&annotation=D7QJVKKC)) #2ea8e5
- “Since we focus on Python projects, our approach for extracting licenses begins by using the pipreqs command to identify the third-party packages used in the project. We then leverage the libraries.io API to retrieve the corresponding license information for these packages. Both steps rely on official commands and APIs, which we consider reliable, so no further validation of these results was deemed necessary” ([“TSE-2025-01-0038_Proof_hi”, p. 10](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=11&annotation=M844DPMV)) #ffd400
*this is already said, isn't it?*
- “To extract this information, we utilized ScanCode as the primary tool” ([“TSE-2025-01-0038_Proof_hi”, p. 10](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=11&annotation=7VPXZ9FJ)) #ffd400
*This is also said. It's a repetition.
Essentially you rely on ScanCode, an existing approach. WHat's your contribution concerning the license enstraction task. What do you add to the work that ScanCode already does?*
- “Given ScanCode’s established reliability, our focus for this part was on conducting additional validation to ensure the accuracy of our results.” ([“TSE-2025-01-0038_Proof_hi”, p. 10](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=11&annotation=JR2EC9SA)) #ffd400
- “RQ2 focuses on evaluating the effectiveness of our approach in understanding copyright terms within the extracted licenses.” ([“TSE-2025-01-0038_Proof_hi”, p. 10](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=11&annotation=2Z2D9BUX)) #2ea8e5
- “Our approach leverages ChatGPT, enhanced with well-structured and context-specific prompts, to accurately interpret these copyright terms.” ([“TSE-2025-01-0038_Proof_hi”, p. 10](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=11&annotation=Q2Z2BNUW)) #ffd400
*This is also said in the previous section.*
- “Cohen’s kappa score” ([“TSE-2025-01-0038_Proof_hi”, p. 10](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=11&annotation=VJNJWE2V)) #5fb236
- “identify any cases where misinterpretations occurred” ([“TSE-2025-01-0038_Proof_hi”, p. 10](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=11&annotation=3MIZ7VKT)) #5fb236
- “This analysis aimed to determine how prevalent these terms are within the licenses and to ide” ([“TSE-2025-01-0038_Proof_hi”, p. 10](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=11&annotation=T36GXJXB)) #5fb236
- “RQ3 represents a crucial aspect of our study, as it examines the effectiveness of our approach in detecting violations of copyright-related terms in real-world opensource projects.” ([“TSE-2025-01-0038_Proof_hi”, p. 10](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=11&annotation=G22GICQ2)) #2ea8e5
- “measuring the total number of identified violations.” ([“TSE-2025-01-0038_Proof_hi”, p. 10](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=11&annotation=5LGM88RK)) #ffd400
*How did you measure the detection accuracy? (e.g. false positive, false negative, etc.)*
- “no existing work provides a comprehensive solution for detecting violations across all these specific terms, making our approach unique and leaving us without a direct baseline for comparison.” ([“TSE-2025-01-0038_Proof_hi”, p. 10](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=11&annotation=AAC6GNCD)) #5fb236
- “third-party library distribution across 104 projects” ([“TSE-2025-01-0038_Proof_hi”, p. 10](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=11&annotation=3TY2GSMF)) #a28ae5
- “sampled 100 of the 1,117 identified distribution instances and 50 of the 396 projects showing no distribution, then performed a manual review.” ([“TSE-2025-01-0038_Proof_hi”, p. 10](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=11&annotation=7ZADNACH)) #ffd400
*Ok this answered my previous comment concerning the accuracy of the violation detection.*
- “For instance, incorporating numerous external packages can introduce oversights, such as inadvertently adding third-party files to the project’s repository or bundling them for distribution, thereby triggering stricter copyright constraints. Extracting the licenses of third-party packages is a prerequisite for checking copyright terms. Moreover, understanding the licenses used by these packages provides insight into broader licensing practices within open-source projects.” ([“TSE-2025-01-0038_Proof_hi”, p. 10](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=11&annotation=HLY4NAVZ)) #ffd400
*This is also a repetition.*
- “To validate the accuracy of ScanCode’s extraction of each project’s own licenses, we performed a manual review of 200 randomly selected licenses.” ([“TSE-2025-01-0038_Proof_hi”, p. 11](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=12&annotation=N7GA2BJ7)) #ffd400
*THis is also said in sec 4.1.2*
- “However, incorporating numerous third-party packages can create additional responsibilities for developers. If not managed properly, these packages may introduce copyright infringement risks, as each thirdparty package may come with its own license.” ([“TSE-2025-01-0038_Proof_hi”, p. 11](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=12&annotation=9UY2FCKY)) #ffd400
*Repetition, in different words, but the concept is already said in the previous section.*
- “they examined over 500 copyright terms” ([“TSE-2025-01-0038_Proof_hi”, p. 11](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=12&annotation=YAUUXXVN)) #5fb236
- “second” ([“TSE-2025-01-0038_Proof_hi”, p. 11](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=12&annotation=6GDDYKJ4)) #ff6666
*first row*
- “The positive outcomes of this experiment provide us with the confidence to apply our approach to the automated understanding of a broader set of licenses in future work.” ([“TSE-2025-01-0038_Proof_hi”, p. 12](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=13&annotation=JAZ943BD)) #5fb236
- “distribution or derivative work” ([“TSE-2025-01-0038_Proof_hi”, p. 13](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=14&annotation=AXM63UJA)) #5fb236
- “However, some of these libraries used licenses that were not OSI-certified, and since our focus is on OSI-certified licenses, we excluded those cases. In the end, we retained 976 instances of third-party library distribution spread over 93 of the 500 projects, involving 305 distinct third-party libraries.” ([“TSE-2025-01-0038_Proof_hi”, p. 13](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=14&annotation=J7KAJCCN)) #5fb236
- “for detecting copyright term violations related to third-party libraries in GitHub projects.” ([“TSE-2025-01-0038_Proof_hi”, p. 14](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=15&annotation=YIKW9J43)) #5fb236
- “uses LLMs to interpret copyright terms and pinpoints potential violations by evaluating how projects behave alongside the license requirements of third-party libraries.” ([“TSE-2025-01-0038_Proof_hi”, p. 14](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=15&annotation=S23N2VQ9)) #5fb236
- “10% contained copyright term violations.” ([“TSE-2025-01-0038_Proof_hi”, p. 14](zotero://select/library/items/AT23QI2D)) ([pdf](zotero://open-pdf/library/items/2GHHUW3T?page=15&annotation=USI76P83)) #5fb236
- ### [[Comments]]
- SUMMARY: The paper presents an approach to automatically detect copyright violations related to using third-party libraries in open-source projects, specifically Python projects. The authors leverage existing tools like ScanCode and exploit LLMS for license interpretation. They evaluate the proposed copyright violation approach by analyzing 500 popular Python projects and discussing detected violations.
COMMENTS: The paper is about an interesting topic. Overall, I liked the paper, even though there are several issues that need to be addressed, as discussed below:
- The actual focus of the paper is restricted to Python projects, whereas the title suggests a broader context. The authors should refine the title to reflect this narrower scope and explicitly discuss the Python-specific focus early in the paper.
- Following the previous comment, the authors suggest that their approach might be adaptable to projects in other languages but provide no concrete evidence or references supporting this claim. Given the heavy reliance on Python-specific tools and formats, the generalizability claim requires substantial evidence or should be softened.
- The contributions, especially concerning license extraction, heavily rely on existing tools like ScanCode. It is unclear precisely how the paper advances beyond what these tools already accomplish. Clarification of the unique contribution of the paper compared to existing methods is necessary.
- The method used to validate third-party library distribution behavior via the libraries.io API is not detailed. The authors should clearly explain the inputs and procedures used in this step.
- The dimensions and categories employed in the prompts for ChatGPT (e.g., permissions, restrictions, obligations) should be fully enumerated and clearly differentiated rather than provided as examples.
- Similarly, the choice of the key copyright terms should be supported by statistical evidence to justify their critical importance across diverse licenses.
- A detailed table summarizing the 500 Python projects' characteristics (including domain classifications) would enhance clarity.
- Explanatory examples are missing in key areas of the papers. For instance, Section 3 can be improved by giving illustrative examples of the three phases of the proposed approach and showing their application on some real projects.
- The paper contains several instances of repeated statements, especially concerning method descriptions and motivations. The manuscript can benefit from removing or consolidating redundant information. For instance, the "experimental setup" and "result and analysis" sections repeat the approach's benefits several times.
- To improve the readability of the three research questions, I suggest adding a summary with the corresponding takeaway message at the end of each research question.
- MINORS:
- The supplementary material link referred to on page 7 is missing.
- Typographical error noted on page 11: "second" appears incorrectly and should likely be corrected to "first row."
-