GitHub explained how it controls open source license compliance at scale

GitHub published a post in its corporate blog about how its own Open Source Program Office (OSPO) uses a new product to control licenses in order to manage open source dependencies at scale across the entire company.

Why companies need OSPO

Open Source Program Office is a specialized division that many large technology companies create to manage the use of third-party open source code: tracking licenses, legal risks and compliance with internal policies. For GitHub itself, as one of the largest platforms for development based on open source code, the task of license control is especially acute — the company simultaneously hosts millions of open source projects and actively uses third-party libraries in its own products.

What the license control product solves

The license control product discussed in the post automates what was previously done manually: scanning project dependencies, determining the type of license for each package (MIT, Apache, GPL and dozens of others) and checking compliance with corporate policy on the use of open source code.

• The post describes the practice of the Open Source Program Office within GitHub
• A new GitHub product is used to control licenses of open source dependencies
• The goal is to manage compliance with license requirements at scale

For large organizations with hundreds and thousands of repositories, manual checking of licenses for each dependency is physically impossible — non-compliance with license conditions (for example, accidental use of code with a copyleft license in a closed commercial product) can result in legal and reputational risks.

What this means

Automation of license control is becoming part of the standard toolkit of development, along with vulnerability scanning — and the fact that GitHub is testing such processes on itself shows where the industry is heading in managing open source dependencies in large organizations.