This page not only lists frequently asked questions but also interesting questions
- License Handling
- Installation
- FOSSology’s Capabilities
License Handling
Installation
Question: I have installed from source, but cannot reach the FOSSology application under port 8081, what is wrong?
Answer: At source install, the Apache Web server is installed on the host machine (the machine also FOSSology is installed on) and thus it needs to be called on the host, which is usually at port 80.
Port 8081 is in use for docker and vagrant installations. In this installation FOSSology runs as guest in a virtualised environmet. For these environments, port 80 of the Apache Web server in the guest machine is mapped to port 8081 on the host, so it will not interfere with any deployed http services on port 80 on the host machine.
FOSSology’s Capabilities
Question: Does this tool detect GPL violations in commercial software?
Answer: There are a *lot* of clauses in the GPL, and the clauses where FOSSology
helps with compliance are, admittedly, not the ones that are most often
violated today. For example, if you have a binary that may have GPL’d code
in it (i.e., a straight-up GPLv2§3 / GPLv3§6 violation): FOSSology cannot
determine the libraries used for creating the binary; you need a
binary analysis tool. (For example, just use ‘binwalk’ and ‘strings’ for
that situation.)
More generally, working backwards from a known-violating binary,
FOSSology can’t *directly* help you figure out the proper complete,
Corresponding Source (CCS) that is needed to resolve that violation. CCS
release construction, particularly when done in a post hoc fashion, is
something only a human can do. But FOSSology assists in those situations.
For example, FOSSology will do an excellent job finding what are called
“license incompatibility violations”, such as when you have a code base that
has combined code that says “non-commercial-use only” with GPL’d software.
FOSSology can be also used to compare the licensing information from the
public upstream project with the sources provided, to be sure that license
notices have not been surreptitiously modified.