{"id":"https://openalex.org/W4412081931","doi":"https://doi.org/10.1109/tse.2025.3586411","title":"Open Source, Hidden Costs: A Systematic Literature Review on OSS License Management","display_name":"Open Source, Hidden Costs: A Systematic Literature Review on OSS License Management","publication_year":2025,"publication_date":"2025-07-07","ids":{"openalex":"https://openalex.org/W4412081931","doi":"https://doi.org/10.1109/tse.2025.3586411"},"language":"en","primary_location":{"id":"doi:10.1109/tse.2025.3586411","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tse.2025.3586411","pdf_url":null,"source":{"id":"https://openalex.org/S8351582","display_name":"IEEE Transactions on Software Engineering","issn_l":"0098-5589","issn":["0098-5589","1939-3520","2326-3881"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310320439","host_organization_name":"IEEE Computer Society","host_organization_lineage":["https://openalex.org/P4310320439","https://openalex.org/P4310319808"],"host_organization_lineage_names":["IEEE Computer Society","Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Software Engineering","raw_type":"journal-article"},"type":"review","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":null,"display_name":"Boyuan Li","orcid":"https://orcid.org/0009-0004-6301-874X"},"institutions":[{"id":"https://openalex.org/I205237279","display_name":"Nankai University","ror":"https://ror.org/01y1kjr75","country_code":"CN","type":"education","lineage":["https://openalex.org/I205237279"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Boyuan Li","raw_affiliation_strings":["DISSec, NDST, College of Computer Science, Nankai University, Tianjin, China","DISSec, NDST, College of Computer Science, Nankai University, China"],"raw_orcid":"https://orcid.org/0009-0004-6301-874X","affiliations":[{"raw_affiliation_string":"DISSec, NDST, College of Computer Science, Nankai University, Tianjin, China","institution_ids":["https://openalex.org/I205237279"]},{"raw_affiliation_string":"DISSec, NDST, College of Computer Science, Nankai University, China","institution_ids":["https://openalex.org/I205237279"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5100319564","display_name":"Chengwei Liu","orcid":"https://orcid.org/0000-0003-1175-2753"},"institutions":[{"id":"https://openalex.org/I172675005","display_name":"Nanyang Technological University","ror":"https://ror.org/02e7b5302","country_code":"SG","type":"education","lineage":["https://openalex.org/I172675005"]}],"countries":["SG"],"is_corresponding":false,"raw_author_name":"Chengwei Liu","raw_affiliation_strings":["Nanyang Technological University, Singapore"],"raw_orcid":"https://orcid.org/0000-0003-1175-2753","affiliations":[{"raw_affiliation_string":"Nanyang Technological University, Singapore","institution_ids":["https://openalex.org/I172675005"]}]},{"author_position":"middle","author":{"id":null,"display_name":"Lingling Fan","orcid":"https://orcid.org/0000-0002-2428-9297"},"institutions":[{"id":"https://openalex.org/I205237279","display_name":"Nankai University","ror":"https://ror.org/01y1kjr75","country_code":"CN","type":"education","lineage":["https://openalex.org/I205237279"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Lingling Fan","raw_affiliation_strings":["DISSec, NDST, College of Cryptology and Cyber Science, Nankai University, Tianjin, China","DISSec, NDST, College of Cryptology and Cyber Science, Nankai University, China"],"raw_orcid":"https://orcid.org/0000-0002-2428-9297","affiliations":[{"raw_affiliation_string":"DISSec, NDST, College of Cryptology and Cyber Science, Nankai University, Tianjin, China","institution_ids":["https://openalex.org/I205237279"]},{"raw_affiliation_string":"DISSec, NDST, College of Cryptology and Cyber Science, Nankai University, China","institution_ids":["https://openalex.org/I205237279"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5100658276","display_name":"Sen Chen","orcid":"https://orcid.org/0000-0001-9477-4100"},"institutions":[{"id":"https://openalex.org/I205237279","display_name":"Nankai University","ror":"https://ror.org/01y1kjr75","country_code":"CN","type":"education","lineage":["https://openalex.org/I205237279"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Sen Chen","raw_affiliation_strings":["DISSec, NDST, College of Cryptology and Cyber Science, Nankai University, Tianjin, China","DISSec, NDST, College of Cryptology and Cyber Science, Nankai University, China"],"raw_orcid":"https://orcid.org/0000-0001-9477-4100","affiliations":[{"raw_affiliation_string":"DISSec, NDST, College of Cryptology and Cyber Science, Nankai University, Tianjin, China","institution_ids":["https://openalex.org/I205237279"]},{"raw_affiliation_string":"DISSec, NDST, College of Cryptology and Cyber Science, Nankai University, China","institution_ids":["https://openalex.org/I205237279"]}]},{"author_position":"middle","author":{"id":null,"display_name":"Zhenlin Zhang","orcid":"https://orcid.org/0009-0004-8608-1661"},"institutions":[{"id":"https://openalex.org/I205237279","display_name":"Nankai University","ror":"https://ror.org/01y1kjr75","country_code":"CN","type":"education","lineage":["https://openalex.org/I205237279"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Zhenlin Zhang","raw_affiliation_strings":["DISSec, NDST, College of Cryptology and Cyber Science, Nankai University, Tianjin, China","DISSec, NDST, College of Cryptology and Cyber Science, Nankai University, China"],"raw_orcid":"https://orcid.org/0009-0004-8608-1661","affiliations":[{"raw_affiliation_string":"DISSec, NDST, College of Cryptology and Cyber Science, Nankai University, Tianjin, China","institution_ids":["https://openalex.org/I205237279"]},{"raw_affiliation_string":"DISSec, NDST, College of Cryptology and Cyber Science, Nankai University, China","institution_ids":["https://openalex.org/I205237279"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5060212061","display_name":"Zheli Liu","orcid":"https://orcid.org/0000-0002-2984-2661"},"institutions":[{"id":"https://openalex.org/I205237279","display_name":"Nankai University","ror":"https://ror.org/01y1kjr75","country_code":"CN","type":"education","lineage":["https://openalex.org/I205237279"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Zheli Liu","raw_affiliation_strings":["DISSec, NDST, College of Cryptology and Cyber Science, Nankai University, Tianjin, China","DISSec, NDST, College of Cryptology and Cyber Science, Nankai University, China"],"raw_orcid":"https://orcid.org/0000-0002-2984-2661","affiliations":[{"raw_affiliation_string":"DISSec, NDST, College of Cryptology and Cyber Science, Nankai University, Tianjin, China","institution_ids":["https://openalex.org/I205237279"]},{"raw_affiliation_string":"DISSec, NDST, College of Cryptology and Cyber Science, Nankai University, China","institution_ids":["https://openalex.org/I205237279"]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":2,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":0.8894,"has_fulltext":false,"cited_by_count":2,"citation_normalized_percentile":{"value":0.76820208,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":{"min":97,"max":98},"biblio":{"volume":"51","issue":"9","first_page":"2432","last_page":"2454"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T13999","display_name":"Digital Rights Management and Security","score":0.9869999885559082,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T13999","display_name":"Digital Rights Management and Security","score":0.9869999885559082,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11675","display_name":"Open Source Software Innovations","score":0.9495000243186951,"subfield":{"id":"https://openalex.org/subfields/1706","display_name":"Computer Science Applications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11995","display_name":"FinTech, Crowdfunding, Digital Finance","score":0.9409999847412109,"subfield":{"id":"https://openalex.org/subfields/1404","display_name":"Management Information Systems"},"field":{"id":"https://openalex.org/fields/14","display_name":"Business, Management and Accounting"},"domain":{"id":"https://openalex.org/domains/2","display_name":"Social Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.7954654693603516},{"id":"https://openalex.org/keywords/license","display_name":"License","score":0.7047520279884338},{"id":"https://openalex.org/keywords/open-source","display_name":"Open source","score":0.6960040926933289},{"id":"https://openalex.org/keywords/systematic-review","display_name":"Systematic review","score":0.5239755511283875},{"id":"https://openalex.org/keywords/data-science","display_name":"Data science","score":0.4218965172767639},{"id":"https://openalex.org/keywords/software-engineering","display_name":"Software engineering","score":0.4218409061431885},{"id":"https://openalex.org/keywords/world-wide-web","display_name":"World Wide Web","score":0.37412792444229126},{"id":"https://openalex.org/keywords/programming-language","display_name":"Programming language","score":0.18943950533866882},{"id":"https://openalex.org/keywords/operating-system","display_name":"Operating system","score":0.16206204891204834},{"id":"https://openalex.org/keywords/software","display_name":"Software","score":0.15025103092193604}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7954654693603516},{"id":"https://openalex.org/C2780560020","wikidata":"https://www.wikidata.org/wiki/Q79719","display_name":"License","level":2,"score":0.7047520279884338},{"id":"https://openalex.org/C3018397939","wikidata":"https://www.wikidata.org/wiki/Q3644502","display_name":"Open source","level":3,"score":0.6960040926933289},{"id":"https://openalex.org/C189708586","wikidata":"https://www.wikidata.org/wiki/Q1504425","display_name":"Systematic review","level":3,"score":0.5239755511283875},{"id":"https://openalex.org/C2522767166","wikidata":"https://www.wikidata.org/wiki/Q2374463","display_name":"Data science","level":1,"score":0.4218965172767639},{"id":"https://openalex.org/C115903868","wikidata":"https://www.wikidata.org/wiki/Q80993","display_name":"Software engineering","level":1,"score":0.4218409061431885},{"id":"https://openalex.org/C136764020","wikidata":"https://www.wikidata.org/wiki/Q466","display_name":"World Wide Web","level":1,"score":0.37412792444229126},{"id":"https://openalex.org/C199360897","wikidata":"https://www.wikidata.org/wiki/Q9143","display_name":"Programming language","level":1,"score":0.18943950533866882},{"id":"https://openalex.org/C111919701","wikidata":"https://www.wikidata.org/wiki/Q9135","display_name":"Operating system","level":1,"score":0.16206204891204834},{"id":"https://openalex.org/C2777904410","wikidata":"https://www.wikidata.org/wiki/Q7397","display_name":"Software","level":2,"score":0.15025103092193604},{"id":"https://openalex.org/C199539241","wikidata":"https://www.wikidata.org/wiki/Q7748","display_name":"Law","level":1,"score":0.0},{"id":"https://openalex.org/C2779473830","wikidata":"https://www.wikidata.org/wiki/Q1540899","display_name":"MEDLINE","level":2,"score":0.0},{"id":"https://openalex.org/C17744445","wikidata":"https://www.wikidata.org/wiki/Q36442","display_name":"Political science","level":0,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1109/tse.2025.3586411","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tse.2025.3586411","pdf_url":null,"source":{"id":"https://openalex.org/S8351582","display_name":"IEEE Transactions on Software Engineering","issn_l":"0098-5589","issn":["0098-5589","1939-3520","2326-3881"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310320439","host_organization_name":"IEEE Computer Society","host_organization_lineage":["https://openalex.org/P4310320439","https://openalex.org/P4310319808"],"host_organization_lineage_names":["IEEE Computer Society","Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Software Engineering","raw_type":"journal-article"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[{"id":"https://openalex.org/G3464462630","display_name":null,"funder_award_id":"2024YFE0203800","funder_id":"https://openalex.org/F4320335777","funder_display_name":"National Key Research and Development Program of China"}],"funders":[{"id":"https://openalex.org/F4320335777","display_name":"National Key Research and Development Program of China","ror":null}],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":104,"referenced_works":["https://openalex.org/W1970103715","https://openalex.org/W1975675278","https://openalex.org/W1980670900","https://openalex.org/W1992218759","https://openalex.org/W1995709637","https://openalex.org/W1999815136","https://openalex.org/W2003279212","https://openalex.org/W2020288785","https://openalex.org/W2024671287","https://openalex.org/W2027370816","https://openalex.org/W2029011371","https://openalex.org/W2029181676","https://openalex.org/W2046541848","https://openalex.org/W2055774542","https://openalex.org/W2060942111","https://openalex.org/W2063401415","https://openalex.org/W2079039933","https://openalex.org/W2096079808","https://openalex.org/W2098230348","https://openalex.org/W2099154878","https://openalex.org/W2099964107","https://openalex.org/W2114224022","https://openalex.org/W2119349395","https://openalex.org/W2122662313","https://openalex.org/W2138756793","https://openalex.org/W2147209048","https://openalex.org/W2148766740","https://openalex.org/W2153635508","https://openalex.org/W2160530123","https://openalex.org/W2163118642","https://openalex.org/W2164914897","https://openalex.org/W2167803503","https://openalex.org/W2171606859","https://openalex.org/W2172066284","https://openalex.org/W2209934102","https://openalex.org/W2343325785","https://openalex.org/W2348075298","https://openalex.org/W2379690408","https://openalex.org/W2408538694","https://openalex.org/W2417033663","https://openalex.org/W2469415976","https://openalex.org/W2559532455","https://openalex.org/W2598817001","https://openalex.org/W2619669510","https://openalex.org/W2626430764","https://openalex.org/W2730498790","https://openalex.org/W2748265938","https://openalex.org/W2762844179","https://openalex.org/W2766078311","https://openalex.org/W2791776396","https://openalex.org/W2801496046","https://openalex.org/W2809426407","https://openalex.org/W2907381941","https://openalex.org/W2910956077","https://openalex.org/W2921525397","https://openalex.org/W2928487989","https://openalex.org/W2955008925","https://openalex.org/W2955426500","https://openalex.org/W2963541700","https://openalex.org/W2971092323","https://openalex.org/W2999281421","https://openalex.org/W3089853590","https://openalex.org/W3093923734","https://openalex.org/W3137324396","https://openalex.org/W3155866485","https://openalex.org/W3161799213","https://openalex.org/W3199693282","https://openalex.org/W3200506265","https://openalex.org/W3207006608","https://openalex.org/W3216662458","https://openalex.org/W4220959955","https://openalex.org/W4224437660","https://openalex.org/W4234659140","https://openalex.org/W4244714958","https://openalex.org/W4245365421","https://openalex.org/W4247858078","https://openalex.org/W4285209474","https://openalex.org/W4286531993","https://openalex.org/W4295787464","https://openalex.org/W4301168982","https://openalex.org/W4311938462","https://openalex.org/W4312565886","https://openalex.org/W4313006773","https://openalex.org/W4316192725","https://openalex.org/W4376606877","https://openalex.org/W4382323326","https://openalex.org/W4383898366","https://openalex.org/W4384009753","https://openalex.org/W4386114095","https://openalex.org/W4388483277","https://openalex.org/W4388502416","https://openalex.org/W4389720861","https://openalex.org/W4389988829","https://openalex.org/W4391903895","https://openalex.org/W4392605607","https://openalex.org/W4394013531","https://openalex.org/W4396723431","https://openalex.org/W4400582885","https://openalex.org/W4400593390","https://openalex.org/W4400680130","https://openalex.org/W4402457202","https://openalex.org/W4404955167","https://openalex.org/W4411271306","https://openalex.org/W4411552348"],"related_works":["https://openalex.org/W2606446052","https://openalex.org/W2036021480","https://openalex.org/W3195777957","https://openalex.org/W2382668227","https://openalex.org/W2348482143","https://openalex.org/W2024584030","https://openalex.org/W3104168426","https://openalex.org/W1603675680","https://openalex.org/W3081674575","https://openalex.org/W4287673983"],"abstract_inverted_index":{"Integrating":[0],"third-party":[1],"software":[2,10,30,80,90,110,200,204],"components":[3],"is":[4,24],"a":[5],"common":[6],"practice":[7,23],"in":[8,15,161],"modern":[9],"development,":[11],"offering":[12],"significant":[13,70],"advantages":[14],"terms":[16],"of":[17,34,78,109,198],"efficiency":[18],"and":[19,45,53,59,62,118,151,174,191,193],"innovation.":[20],"However,":[21,69],"this":[22,181],"fraught":[25],"with":[26,66],"risks":[27,201],"related":[28],"to":[29,38,64,167],"licensing.":[31],"A":[32],"lack":[33],"understanding":[35],"may":[36],"lead":[37],"disputes,":[39],"which":[40],"can":[41],"pose":[42],"serious":[43],"legal":[44],"operational":[46],"challenges.":[47,68],"To":[48,113],"these":[49,67],"ends,":[50],"both":[51],"academia":[52,190],"industry":[54,192],"have":[55],"conducted":[56],"various":[57],"investigations":[58],"proposed":[60],"solutions":[61],"tools":[63],"deal":[65],"limitations":[71],"still":[72],"remain.":[73],"Moreover,":[74],"the":[75,86,106,115,125,165,187,195,203],"rapid":[76],"evolution":[77],"open-source":[79],"(OSS)":[81],"licenses,":[82],"as":[83,85,94],"well":[84],"rapidly":[87],"incorporated":[88],"generative":[89],"engineering":[91,205],"techniques,":[92],"such":[93],"large":[95],"language":[96],"models":[97],"for":[98,178],"code":[99],"(CodeLLMs),":[100],"are":[101],"placing":[102],"greater":[103],"demands":[104],"on":[105,131,156,170],"systematic":[107,127],"management":[108],"license":[111,146,148,152],"risks.":[112],"unveil":[114],"severe":[116],"challenges":[117,160],"explore":[119],"possible":[120],"future":[121,171],"directions,":[122],"we":[123,158],"conduct":[124],"first":[126],"literature":[128],"review":[129,183],"(SLR)":[130],"80":[132],"carefully":[133],"selected":[134],"OSS":[135],"license-related":[136],"papers,":[137],"classifying":[138],"existing":[139,162],"research":[140,172],"into":[141],"three":[142],"key":[143],"categories,":[144],"i.e.,":[145],"identification,":[147],"risk":[149,153],"assessment,":[150],"mitigation.":[154],"Based":[155],"these,":[157],"discuss":[159],"solutions,":[163],"conclude":[164],"opportunities":[166],"shed":[168],"light":[169],"directions":[173],"offer":[175],"practical":[176],"recommendations":[177],"practitioners.We":[179],"hope":[180],"thorough":[182],"will":[184],"help":[185],"bridge":[186],"gaps":[188],"between":[189],"accelerate":[194],"ecosystem-wide":[196],"governance":[197],"legitimate":[199],"within":[202],"community.":[206]},"counts_by_year":[{"year":2026,"cited_by_count":2}],"updated_date":"2026-07-14T23:27:15.235271","created_date":"2025-10-10T00:00:00"}