Open Source Summit + Embedded Linux Conference + OSPOCon 2021

Engineers are rarely lawyers, and lawyers rarely build products. When an organization releases hundreds of products that might depend on OSS code, it is unrealistic to expect individual product teams to accurately audit their code for OSS license compliance, and not scalable to have counsel manually review every release. The engineers don't always understand the ramifications of licenses of their dependencies, and the lawyers shouldn't have to look at the same "notice" style license hundreds of times a year. At Google, we have implemented an approach to OSS license compliance that scales human effort linearly with the number of OSS packages used in aggregate across all products. The impact is that - experts only have to review each OSS package when it is imported into our core repository - developers can build software without considering licensing - the build system informs them if they would be violating a release policy. Since Blaze is available as the OSS Bazel, we have designed this capability so that the compliance policies are defined by each organization. Anyone using Bazel can craft a mechanism suited to their particular needs.