Small Changes, Big Trouble: Demystifying and Parsing License Variants for Incompatibility Detection in the PyPI Ecosystem
Weiwei Xu, Hengzhi Ye, Kai Gao, Minghui Zhou
TL;DR
Open-source licenses govern reuse but license variants introduce compliance risk in packaging ecosystems. The authors perform the first large-scale empirical study of license variants in the PyPI ecosystem and introduce LV-Parser, a diff-based license parsing method, and LV-Compat, an automated incompatibility detector for dependency graphs. They find textual variations are common but substantive changes are rare (≈2%), yet they yield ≈10.7% downstream incompatibilities; LV-Parser achieves 0.936 accuracy with ~30% fewer LLM queries, and LV-Compat detects 5.2x more incompatible packages with precision 0.98. This work delivers practical tools and datasets to improve license parsing and compliance in software supply chains.
Abstract
Open-source licenses establish the legal foundation for software reuse, yet license variants, including both modified standard licenses and custom-created alternatives, introduce significant compliance complexities. Despite their prevalence and potential impact, these variants are poorly understood in modern software systems, and existing tools do not account for their existence, leading to significant challenges in both effectiveness and efficiency of license analysis. To fill this knowledge gap, we conduct a comprehensive empirical study of license variants in the PyPI ecosystem. Our findings show that textual variations in licenses are common, yet only 2% involve substantive modifications. However, these license variants lead to significant compliance issues, with 10.7% of their downstream dependencies found to be license-incompatible. Inspired by our findings, we introduce LV-Parser, a novel approach for efficient license variant analysis leveraging diff-based techniques and large language models, along with LV-Compat, an automated pipeline for detecting license incompatibilities in software dependency networks. Our evaluation demonstrates that LV-Parser achieves an accuracy of 0.936 while reducing computational costs by 30%, and LV-Compat identifies 5.2 times more incompatible packages than existing methods with a precision of 0.98. This work not only provides the first empirical study into license variants in software packaging ecosystem but also equips developers and organizations with practical tools for navigating the complex landscape of open-source licensing.