Page History

This practice concerns the design and development phase of the project.

The practice applies to projects that use external libraries or components provided by third-party vendors (including OSS projects).

2.4. Management of IPR and dependencies

1. Learn about your licences of the libraries and other software incorporated in your product
   1. Establish basic understanding and awareness of IPR and GÉANT IPR Policy within the team (learn/ask GLAD and the GÉANT IPR Coordinator (iprcoordinator@geant.org) for support)
   2. Identify, analyze and document the used libraries (e.g., using a dedicated tool)
      
2. Verify if the licences conform to constraints imposed by GÉANT and licence compatibility requirements
   
   1. Determine the overall IPR orientation (e.g, permissive or copyleft), then the specific tentative licence (e.g., MIT or GPL3+) forthe project/product
   2. Authoritatively verify and document present licences (with an SCA tool or at licensors' websites and correct or refine the information in the tool or document) and check their requirements and compatibility
      
   3. Make sure that requirements set in applicable licenses and rules and recommendations from the GÉANT IPR Policy are met, including documenting the licence, including a copyright notice and publishing code changes in the source repository and on the project website
3. Establish tracking of present licences, adjustments and compliance
   1. Trigger re-evaluation of the license compliance in the event of changes in the used libraries, licences and rules (in policy or knowledge base)
   2. Detect, document and communicate changes

1. License requirements and rights are misinterpreted
   
   1. The GÉANT IPR Policy is revised to clarify ambiguities or improve the interpretation
   2. The used tools or recorded rules need to be updated and the assessors informed about the change
2. An inadequate licence has been chosen or it is not complied with
   1. The licence should be changed in consultation with the IPR Coordinator
   2. The licence compliance is achieved by IPR remediating actions (i.e., by replacing or removing some libraries)