SebastianW asked a question.
Open Source Mapping in Snow
Hello,
We use Snow SLM.
We’re now facing the challenge of needing to better monitor open source software—beyond what’s possible with the standard “License Required (Y/N)” flag.
In other words, a correct mapping of which FLOSS license applies to which application and version.
As far as i know, SLM doesn’t offer any other out-of-the-box features to automatically capture this kind of information. Am I correct?
How do other companies or the community handle this? Do you use custom fields that are filled in manually or via the Import Manager? Maybe Flexera has a product/solution for that?
Thanks for your input
It does not offer this feature yet as far as I know.
I am curious: What exactly is your use case for this type of info? What would you use it for inside of SLM?
We have realised that we need to improve our current approach and, above all, standardise it across multiple players. Surprisingly, the first thing that sprang to mind was our existing licence management software...
The challenge is to determine which application is licensed under which type of FLOSS license and to document whether specific requirements—such as copyleft, free use, restrictions, etc.—are being met. Unfortunately, this goes beyond the accounting approach that is usually sufficient for proprietary software (purchased licence minus usage).
Since installed applications are identified by the agent anyway, so I was hoping that at least the initial information (FLOSS license) could be added as an additional attribute to the respective applications using an existing technical solution. Perhaps there is an external catalogue that can provide the information via an API; in that case, we could add an additional custom field.
However, that would then be vulnerable to changes made to the catalogue. Hence my enquiry about a solution from Flexera, for which the relevant interfaces may already exist. I would have assumed that similar information is maintained in Risk Management anyway.
Hope that helps understanding my thoughts...
I see ... although I struggle to understand how this is different from tracking all the specifics of each EULA.
What I mean is that each product comes with specific rights, some of those rights are not based on any metric that can be recorded by an agent (some medical software, for example, is paid for doctors, but free for nurses, others can only be used on a single screen, and yet other applications have much weirder use rights), and technically, you would need to track that too.
The fact that FLOSS comes with a set of known license terms that are much more flexible than paid software makes me believe that there is much more value in tracking use rights for non-FLOSS. I am not sure of the full value of tapping into a database tagging each app to those GPL or MIT terms under all their versions and flavours ... unless I am missing something.
That said, if you see the value in that, I assume that exporting such list (if you find one) and importing it as a custom field would only need to be done once in a while, it could be manual. Now, how to handle all the FLOSS available on GitHub? Impossible to import any custom field for those, they are not even recognized in SLM yet. This is to me a much bigger concern ...