NVIDIA_Open_Source_Software_Training

1. Open Source Software Training December 2015, v0.3 SW-IP-Audit-Team

2. Contents

Introduction
Review Process
What does / doesn’t require a review?
Types of IP Protection
Types of Licenses
Typical OSS Licenses
Contributor Agreements
NVIDIA Confidential

3. Open source review process

Start at http://nv/ipaudit
Fill-out a template bug
You may be asked to attend the IP Audit Team meeting to provide
more details about your project
Or contact SW-IP-Audit-Team DL
NVIDIA Confidential

4. What requires IP Audit Team review

If you plan to DISTRIBUTE open source code
Standalone
Bundle
Embed
Modified OR unmodified
To any non-NVIDIA employee (factory, contractor, partner, under NDA)
If you plan to use open source code as part of a hosted service
If you plan to make code available as open source
NVIDIA Confidential
Contributions to third party open source project
Creation of an open source project
Other release of NVIDIA code as open source

5. What does NOT require IP Audit Team review

For fee/royalty-bearing third party software
Code that will used for INTERNAL USE ONLY
Standalone open source programs which the customer may
want to obtain and use BUT which NVIDIA is not distributing
New version of code that was previously approved for your
project, provided that your intended use and the license have
not changed
NVIDIA Confidential

6. Types of Licenses

Permissive
Copyleft
(“viral”)
MIT
GPL
BSD
LGPL
Unlicensed
Apache
Lesser Risk
NVIDIA Confidential
Greater Risk

7. Permissive License Overview

Permissive
Modification allowed
Incorporation into proprietary software
Distribution in binary or source format
Derivative works may have different license
MIT
BSD
Apache
NVIDIA Confidential
• Compliance
• Document component, copyright, license
in product manual or as source code
• May require patent grant
• Contributor agreements have other
requirements

8. Copyleft License Overview

Copyleft
(“viral”)
GPL
LGPL
NVIDIA Confidential
Modification allowed
Use can affect licensing of your software
Incorporation may cause your software to be
GPL/LGPL
Linking may cause your software to be GPL/LGPL
Source code must be provided
Derivative works must have same license
• Compliance
• Document component, copyright, license
in product manual or as source code
• Provide source code along with binaries,
or upon request
• Must have source code in-house (not 3rd-party)

9. Unlicensed Software Overview

Unlicensed
• Unlicensed software CANNOT be used
• You have no rights to this software
• Online code snippets, blog postings, etc.
NVIDIA Confidential

10. Guidance – BSD and MIT

When used with proprietary software:
Direct Incorporation
Static Linking
Dynamic Linking
YES
YES
YES
Compliance
Must retain original source code and all modifications within revision control
Document URL; date of acquisition; relevant SHA/hash, commit ID or version
Product documentation reference to component, includes specific license text
NVIDIA Confidential

11. Guidance – Apache License

When used with proprietary software:
Modification and use
Direct Incorporation
Static Linking
Dynamic Linking
Protects Patents
YES – Modifications can be made under proprietary license
YES
YES
YES
NO! – Explicit patent grant, unless alternate license specified
Compliance
Must retain original source code and all modifications within revision control
Document URL; date of acquisition; relevant SHA/hash, commit ID or version
Product documentation reference to component, includes specific license text
NVIDIA modifications can be labeled as “not a contribution” and include NV-proprietary
license
NVIDIA Confidential

12. Guidance – Apache License, cnt’d.

// Copyright (C) 2011 The Android Open Source Project
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//
http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
//
//---------------------------------------------------------------------------------//
// Not a contribution
// Changes made by NVIDIA CORPORATION enabling <XYZ> or otherwise documented as
// NVIDIA-proprietary are not a contribution and subject to the following terms and conditions:
//
// Copyright (C) 2012 NVIDIA CORPORATION. All Rights Reserved.
//
// NVIDIA CORPORATION and its licensors retain all intellectual property
// and proprietary rights in and to this software, related documentation
// and any modifications thereto. Any use, reproduction, disclosure or
// distribution of this software and related documentation is governed by
// the NVIDIA Pre-Release License Agreement between NVIDIA CORPORATION and
// the licensee. All other uses are strictly forbidden.
NVIDIA Confidential

13. Guidance – Lesser GPL (LGPL) v2.1

When used with proprietary software
Modification and use
Direct Incorporation
Static Linking
Dynamic Linking
YES
NO!
NO
YES
Compliance
Must retain original source code and all modifications within revision control
Document URL; date of acquisition; relevant SHA/hash, commit ID or version
Easiest: Distribute source code alongside binary, or downloadable from SAME location
Product documentation reference to component , includes specific LGPL license version
Difficult: “Written offer for source”
NVIDIA Confidential Must provide source code upon request to ANY requestor

14. Guidance – GPL v2

When used with proprietary software
Modification and use
Direct Incorporation
Static Linking
Dynamic Linking
YES
NO!
NO!
NO!
Compliance
Must retain original source code and all modifications within revision control
Document URL; date of acquisition; relevant SHA/hash, commit ID or version
Easiest: Distribute source code alongside binary, or downloadable from SAME location
Product documentation reference to component , includes specific GPL license version
Difficult: “Written offer for source”
NVIDIA Confidential Must provide source code upon request to ANY requestor

15. Guidance – GPL v2+ “or any later version”

GPL license may indicate “or (at your option)” any later version…”
This allows conversion of GPLv2 to GPLv3 (or later)
We choose not to provide that option to our customers
You may be asked to replace “or any later version” with GPLv2-only wording
NVIDIA Confidential

16. Guidance – GPL v3

GPLv3 –licensed software is generally NOT approved for distribution
When used with proprietary software
Modification and use
Direct Incorporation
Static Linking
Dynamic Linking
Protects Patents
NO
NO!
NO!
NO!
NO! -- Explicit patent grant
End-user must be able to replace GPLv3 software – e.g. on locked device
NVIDIA Confidential

17. Best Practices for Compliance

Open source is “free” but compliance is not – engage SW-IP-Audit-Team early
Keep third-party software under IT-managed revision control
Initial commit should be “as-received”
Initial log should indicate
Source / URL
Date obtained
Version, revision, git hash, etc.
Document relevant licenses/copyrights in product documentation
Regarding GPL:
Most GPL violations are due to “no source, no offer”
It is NOT sufficient to direct requestors to third-party sites for source code
NVIDIA Confidential Package source code with binaries, or make downloadable from same location