Modern applications combine open source, proprietary code, and AI, creating legal and business risks that developers are increasingly responsible for managing.
Legal compliance obligations from open source licenses are primarily triggered at the point of software distribution, not during internal-only use.
Addressing license compliance early in development is crucial because fixing issues after a product has been built and shipped is significantly more costly and difficult.
Shipping a Dockerfile is a lower-risk strategy than shipping a pre-built Docker image because it shifts the responsibility of distribution to the end user.
Ensure build reproducibility and compliance by pinning versions, archiving all sources in private repositories, and generating a Software Bill of Materials (SBOM).
Open source licenses fall into three main categories: permissive, weak copyleft, and strong copyleft, each with different obligations for sharing source code.
A permissive license like BSD allows companies to keep their modifications private, whereas a strong copyleft license like GPL can require sharing proprietary code.
AI models introduce new licensing challenges, including permissive open source, proprietary APIs, and custom "fair use" licenses with commercial use restrictions.
AI models can be categorized as true open source for unrestricted commercial use, fair use with specific limitations, or commercial-only APIs that create vendor lock-in.
Make compliance scalable by adopting the SPDX framework, integrating automated checks with tools like Tern into your CI/CD pipeline, and creating an Open Source Program Office (OSPO).
Jobs that call for the skills explored in this talk.