Armijn Hemel

Android is rapidly becoming the primary vector through which open source software is entering into people's life, with new devices being announced almost daily. Unfortunately companies are cutting many corners, especially when it comes to licenses and quality assurance, because everyone is rushing their devices to market. The consequence is that many Android devices out there are not compliant with the licenses, with significant legal risk as a result, even though it is completely avoidable with a small investment in time and knowledge up front, saving a lot of time and money down the line. In this talk I want to highlight a few common violations, shatter a few myths about Android and provide some hints on how to improve the situation. This talk will not be about software patents

Modern software is typically composed of numerous components, such as third-party open source packages. To prevent legal or security problems, software vendors must identify the components (including their licenses) used to create the binaries they ship. This requires knowing exactly which source code files and other artifacts are used to create a given binary, and how they are used (e.g.whether libraries are statically or dynamically linked). In this talk I will we show a generic method to reverse-engineer this information from the build processes of software products. The method traces system calls to determine the composition graph of sources and binaries involved in build processes.