GN5-2 D9.5 Open Source and Licence Support Report

© GÉANT Association on behalf of the GN5 -2 project. The research leading to these results has received funding from the European Union’s Horizon Europe research and innovation programme under Grant Agreement No. 101194278 (GN5 -2). Co -funded by the European Union. Views and opinions expressed are however those of the author(s) only and do not necessarily reflect those of the European Union. The European Union cannot be held responsible for them. 30-10-2025 Deliverable GN5-2 D9.5 Open Source and Licence Support Report Contractual Date: 31-03-2026 Actual Date: 30-10-2025 Grant Agreement No.: 101194278 Work Package: WP9 Task Item: T2 Nature of Deliverable: R Dissemination Level: PU Lead Partner: AMRES Document ID: GN5-2-25-05FFAA Authors: Branko Marović (UoB/AMRES); Kiril Kjiroski (UKIM); Ilija Jolevski (UKLO/MARnet); Milica Ristić (UoB/AMRES); Tomasz Weiss (PSNC) Abstract This report presents the results of the GN5-2 Open Source and Licence Support activity, providing IPR and OSS licence management within GÉANT. Key achievements include updated licensing guides and templates, awareness raising and training, a five-part eAcademy course, consolidated SCA and SLA services, a certification framework with supporting web tools, and enhanced automation and governance. Forthcoming activities focus on automated licence data collection, broader adoption of certificates and badges, integration of compliance tooling, and expanded developer engagement. Together, these initiatives provide scalable, consistent support for GÉANT software teams, ensuring IPR Policy compliance while promoting efficiency, reuse, and best practice. The report contains valuable information for other projects of similar scope and breadth and should be of particular interest to NRENs. Deliverable GN5-2 D9.5 Open Source and Licence Support Report Document ID: GN5-2-25-05FFAA ii Contents Executive Summary 1 1 Introduction 3 2 Open Source and Licence Support Activities 6 2.1 Background and Previous Work 7 2.1.1 Software Licence Selection and Developer Guidance 7 2.1.2 Software Composition Analysis (SCA) 8 2.1.3 Software Licence Analysis (SLA) 9 2.1.4 Project Artefacts and Compliance Templates 9 2.1.5 Governance, Collaboration, and Preparation for GN5-2 10 2.2 Software Licensing Activities 10 2.2.1 Developer Guidance, Educational Resources, and Course Development 10 2.2.2 Compliance Tools and Automation 11 2.2.3 Introduction and Conceptualisation of GÉANT Software Certificates 11 2.2.4 Licensing Certificates 12 2.2.5 SoftwareCertHub – Certificate Management Application 13 2.2.6 Details of Developer Support 16 2.2.7 Surveys, Feedback, Collaboration, and Community Engagement 18 3 Planned Activities 20 3.1 Immediate Implementation Priorities 20 3.2 Ongoing Work 20 3.3 Planned Outreach and Expansion Activities 20 3.4 Advanced Licence Governance Enhancements 21 3.5 Continuous Improvement and Assessment 21 3.6 Long-Term Sustainability 21 4 Conclusions 23 Appendix A Guide to Most-Used Licences in GÉANT 24 Appendix B Licensing Checklist 28 Appendix C Software Licensing Certificates 30 C.1 Self-Assessed Dependencies 32 C.1.1 Certification 32 C.1.2 Governance 33 C.2 Verified Dependencies 33 C.2.1 Certification 33 C.2.2 Governance 34 Contents Deliverable GN5-2 D9.5 Open Source and Licence Support Report Document ID: GN5-2-25-05FFAA iii C.3 Verified Software Licence 34 C.3.1 Certification 34 C.3.2 Governance 35 C.4 Software Licence Assurance 35 C.4.1 Certification 35 C.4.2 Governance 36 Glossary 38 References 40 Figures Figure 2.1: Licence distribution chart for GSC in GSC (left) and Mend (right)* 8 Figure 2.2: Certificate details page 14 Figure 2.3 : Certificate view snippets for referencing certificates 15 Figure 2.4 : Certificate list page 15 Figure 2.5: Licence distribution chart for MaaT 17 Figure A.1: Relationships between OSS licences commonly used in GÉANT projects 25 Figure B.1: Creation of CHANGELOG in the course on software licensing 28 Figure B.2: Creation of CHANGELOG in the Software Artefact Checklist 29 Figure B.3: Creation of CHANGELOG in the internal checklist 29 Tables Table A.1: Software licences frequently used in GÉANT projects and other significant licences 27 Table C.1: Key differences between licensing certificates 32 Deliverable GN5-2 D9.5 Open Source and Licence Support Report Document ID: GN5-2-25-05FFAA 1 Executive Summary Within the GÉANT projects, the use of third-party Open Source Software (OSS) remains widespread, as this improves productivity for non-core or commodity development elements, freeing software developers to concentrate on the differentiating parts of a product by helping them avoid reinventing what already exists. However, care must be taken to ensure that the associated licences are appropriate and not infringed, and that components do not introduce known vulnerabilities into the product, which might cause legal or reputational harm for GÉANT. It is also the wish of both the GÉANT executive and its development teams to publish the software produced by the project as OSS, as reflected in its IPR policy. This report documents the continued evolution of OSS licence management in GÉANT, reflecting the changing landscape of software development and the project’s commitment to maintaining high standards of Intellectual Property Rights (IPR) compliance. It provides an update on the Software and Licence Management (SLM) activities conducted within Task 2 of GN5-2 Work Package 9 (T2 WP9). The report describes the progress in advancing software developer guidance and support, compliance, tooling, guidance, operational efficiency, and automation achieved so far in the GN5-2 project (August 2025), following up on the deliverable by the same name published in GN5-1 [1]. Strengthening of licence guidance continued, along with dependency checks, licence analysis, and OSS licensing for GÉANT project software developments, through Software Composition Analysis (SCA) and Software Licence Analysis (SLA). This was extended with work on compliance templates and aligning project artefacts with them. These efforts supported a number of projects and informed the preparation of training materials for the GÉANT eAcademy. Governance and collaboration with the Open Source Review Board (OSRB), IPR Coordinator, and development teams ensured that activities remain aligned with broader GÉANT strategies to consolidate the IPR management of software produced in GÉANT. In GN5-2, these activities have matured into a structured compliance framework with greater emphasis on automation and reusability. Key achievements include: • Updated developer guidance and templates, including a Software Artefacts Checklist and an expanded licences “cheat sheet”. • Finalisation and release of a five-part eAcademy training course on OSS licensing. • Consolidation of SCA and SLA services, supported by a registry and improved tooling. • Initial development of automated licence data collection, also supported by artefact templates. These efforts have been supported by ongoing collaboration with the OSRB, the IPR Coordinator, GÉANT software development teams, GÉANT Learning and Development (GLAD), and the Project Management Office (PMO), and targeted outreach through GÉANT Infoshares [2]. Ongoing and forthcoming activities focus on: • Implementing automated licence data collection and compliance checks. • Full integration of templates into project workflows from project creation to closure. • Launching licensing certificates with digital badges, promoting their uptake, and providing certification support. Executive Summary Deliverable GN5-2 D9.5 Open Source and Licence Support Report Document ID: GN5-2-25-05FFAA 2 • Advancing governance by integrating the GÉANT Software Catalogue (GSC), SCA and project information management tools, compliance dashboards, and certificates management platform. • Assessing other SCA tools to inform future tool choices. • Expanding DevOps support. • Strengthening developer engagement through improved guidance, surveys, and training. While adherence to the GÉANT IPR Policy [3] remains mandatory, the enhanced services and tools developed by WP9 T2 provide voluntary but increasingly valuable support to GÉANT developers, reflecting the team’s accumulated experience and responsiveness to emerging needs in the evolving OSS landscape. The SLM team remains committed to providing consistent, practical, and scalable OSS licence support across GÉANT. The primary challenge continues to be embedding licence compliance practices among developers, which will be addressed through sustained collaboration, training, and outreach. Deliverable GN5-2 D9.5 Open Source and Licence Support Report Document ID: GN5-2-25-05FFAA 3 1 Introduction The GÉANT Association, GÉANT project, National Research and Education Networks (NRENs), and academic institutions benefit from open source software through cost reduction, collaboration, and innovation. Open Source Software (OSS) also provides availability, flexibility, security, interoperability, and transparency. However, licence non-compliance poses legal, financial and reputational risks for organisations. OSS use requires adherence to licence terms, whether permissive or copyleft, making compliance essential across the GÉANT project. Releasing software under OSS licences aligns with the GÉANT IPR Policy [4] and is often the preferred approach of the EC, contributors, and developers. According to the policy, any OSS created within the Project shall be released under an appropriate licence, preferably the European Union Public Licence (EUPL) or a permissive licence such as the Massachusetts Institute of Technology (MIT) or Berkley Software Distribution (BSD) licence, while other OSS licences, including copyleft ones like the GNU Public License (GPL) and GNU Affero General Public License (AGPL) [5], are acceptable when required by dependency constraints. Licence governance ensures compliance with the IPR Policy and relevant licences. It is led by the IPR Coordinator and supported by the GN5-2 WP9 T2 SLM sub-task, which: • Supports participants in using and managing OSS licences. • Resolves open issues and advises on licence decisions. • Streamlines compliance processes. • Guides those managing OSS and licensing tools. • Contributes to IPR and OSS policy interpretation. • Advises designers, developers, and promoters on licensing. • Provides technical feedback for OSS strategy. The SLM team performs licence and IPR reviews, supporting compliance through Software Composition Analysis (SCA) – via the Mend tool [6] – and Software Licence Analysis (SLA) services. Developers play a key role by selecting licensed components, choosing software licences, ensuring compliance, and communicating IPR information. Their engagement supports legal compliance, transparency, and alignment with GÉANT’s IPR Policy. General aspects of OSS licensing governance and support in GÉANT are described in the first Open Source and Licence Support Report [7] and are not repeated here. That report covered: • Factors and benefits of OSS and licensing. • The evolution of OSS licence management in GÉANT. • The role of OSS in GÉANT software development, including libraries and licences used. • The GÉANT IPR Policy and its relation to OSS. • The approach to OSS support, including two main services: SCA and SLA. • The role of software developers in OSS licensing, including compliance, awareness raising, training, documentation, and interaction with the Open Source Review Board (OSRB). Introduction Deliverable GN5-2 D9.5 Open Source and Licence Support Report Document ID: GN5-2-25-05FFAA 4 • The OSS licence management workflow, including the purpose and use of SCA and SLA, compliance with selected licences, and handling of automated analysis and reporting. • Recommendations for good OSS licensing practices, including preparation, development, SCA and SLA, licence selection, declaration and compliance, copyright management, and governance. Since then, the approach has evolved from establishing the basics and providing responsive licensing operations to a structured, scalable, and automation-ready framework for OSS licence compliance across GÉANT projects. The updated approach emphasises consistent developer guidance, forward-looking governance and support, artefact standardisation, and compliance automation. The new developments include: • Structured Guidance and Education – Developer-oriented documentation, including the licence selection wiki and artefact templates, was extensively revised for consistency, IPR alignment, and usability. These formed the basis for training resources, including a five-part eAcademy course series and targeted infoshare sessions. • Standardised Artefacts and Compliance Templates – Project artefact requirements were clarified and templated to support automation, reduce onboarding complexity, and ensure consistent compliance narratives across projects. • Expanded Analysis and Tooling – Software Composition Analysis and Software Licence Analysis activities matured with refined methodologies, standardised registry and tracking practices, and progress toward automated tracing using the GÉANT Software Catalogue [8] and ScanCode [9]. Compliance artefacts and checklists were aligned with guidance and embedded in developer wikis. • Automation and Reporting – Licensing dashboards and data collection mechanisms were conceptualised, with initial implementations launched (e.g. automated extraction of licence and copyright data via ScanCode, dependency collection from artefacts, and licence certificate tracking). The focus is on scalable, visual tracking of compliance status, and integration of manual and automated data sources. Artefact templates were refined for machine-readability and integration with DevOps workflows such as GitLab pipelines. • Certification Framework – A four-level certification and badge system was introduced to support OSS compliance, backed by a certificate portal and Open Badges integration. Outreach activities include infoshare sessions, badge recognition, and wider promotion of certificate adoption within GÉANT. Sustainability is being sought by exploring the extension of the framework to additional scenarios such as software best practices, WP5 credentials, and eAcademy. • Evaluation and Governance Tooling – Alternative SCA tools are under evaluation, and licence governance is being strengthened by integrating data from the GÉANT Software Catalogue and repositories. • Governance and Strategic Preparation – Coordination with the OSRB, software development teams, the IPR Coordinator, and the eduGAIN ecosystem helped align priorities, simplify documentation, and inform future activities, particularly around automation and certification. In summary, the approach transitioned from foundational work to a comprehensive, tool-supported, cohesive licence compliance effort, combining developer guidance, process automation, tool integration, certification, and governance infrastructure. This report presents the open source and licence support provided by the SLM team and IPR Coordinator since April 2024 when the previous report [10] was published. It is organised as follows: • Section 2 describes the work carried out: Section ○ gives an overview of previous activities carried out in GN5-1 following the publication of deliverable GN5-1 D9.4 [11], including on licence selection guidance, composition analysis, licence analysis, and artefact development; Section 2.2 presents activities in GN5-2 on developer guidance and support, compliance tools, a certification initiative and related certificate management, automated tracking, and related collaborations. Introduction Deliverable GN5-2 D9.5 Open Source and Licence Support Report Document ID: GN5-2-25-05FFAA 5 • Section 3 outlines the planned activities for the remaining period of GN5-2, focusing on automation, tooling, certification outreach, and DevOps integration. • Section 4 summarises outcomes, progress in developer support, compliance automation, and certification, and how these achievements position the work for the future. • Appendix A documents the improvements made to the guide on frequently used licences, showing refinements, extensions, and alignment with project needs and eAcademy course material. • Appendix B presents the compliance checklist developed during the project, providing a structured reference for required artefacts and documentation. • Appendix C describes the certificate framework in detail, with the four levels: Self-Assessed Dependencies, Verified Dependencies, Verified Software Licence, and Software Licence Assurance. These are explained in terms of initial steps and governance processes. Deliverable GN5-2 D9.5 Open Source and Licence Support Report Document ID: GN5-2-25-05FFAA 6 2 Open Source and Licence Support Activities Key achievements during the reporting period include: • Since implementing the licence compliance framework and controls, GÉANT has not experienced any financially impactful legal incidents, reducing legal and reputational exposure. Additionally, there has been much greater awareness about licensing and compliance within the GÉANT developer community, increased adoption and declaration of OSS licences, continuous improvement in compatibility of licences of OSS dependencies, and active participation in events related to licensing. The use of the Mend tool has identified 128 distinct licences in 12.341 libraries used in 33.705 source files within 211 projects (including their various versions and multiple separately recorded scans). • Enhanced Developer Guidance and Training Framework – The Software Licence Selection and Management in GÉANT guide [12] was extensively updated to reflect revised IPR requirements and incorporate project feedback from development teams. This revision served as the foundation for a new five-part GÉANT eAcademy course on OSS licensing, providing structured learning pathways for developers. Supporting documents and templates were refined to streamline onboarding and ensure consistency across projects, improving the accessibility and practical use of licensing guidance. • Advanced Software Composition and Licence Analysis – Software composition analysis was strengthened through the deployment of multiple scanning tools, including Mend [13] and ScanCode [14], with systematic evaluation leading to recommended CLI automation approaches. The establishment of the SLA Registry introduced structured tracking of licensing analysis activities, providing transparency and accountability in service delivery. Completed Service Level Agreements for projects such as InAcademia and VAaaS demonstrate the maturity and reliability of these services, while refined artefact guidance and templates support compliance requirements and automationreadiness. • Software Licensing Certificate Framework and Web Platform – A major innovation introduced during this period was the Software Licensing Certificate Framework, establishing four certification levels designed to incentivise and recognise compliance achievements. The framework is supported by a dedicated web platform, SoftwareCertHub [15], which manages and displays certificates and badges, and provides integration into Markdown and web pages. The framework was piloted with the eduGAIN Reporting Ecosystem and GÉANT Software Catalogue projects, demonstrating its practical value and adoption potential across the GÉANT ecosystem. This testing validated the first three certification levels as practical, achievable, and meaningful. Developers found the requirements understandable and the badges stimulating, confirming that the framework balances rigour with accessibility, incentivising compliance through recognition rather than enforcement. The pilot identified and resolved interpretative dilemmas, process glitches, and practical questions, leading to simplified quick guides presented as checklists with customer-oriented language and goalfocused descriptions. Its results confirm that the framework provides a standardised yet flexible approach applicable across diverse GÉANT software projects by transferring significant effort to developers (shift left), enabling better scalability while maintaining oversight. • Automation and Governance Infrastructure Development – Progress was achieved in developing automated compliance capabilities, including the conceptualisation and initial implementation of a licence compliance dashboard that integrates data from multiple sources, including ScanCode analysis, catalogue inputs, and Mend scanning results. Internal wiki resources were systematically consolidated to improve knowledge management and accessibility, while comprehensive data models for licence Open Source and Licence Support Activities Deliverable GN5-2 D9.5 Open Source and Licence Support Report Document ID: GN5-2-25-05FFAA 13 Software Licence Assurance • For actively maintained, publicly distributed projects with consistent governance. Suitable for individual projects, branded services, or product groups. • Validates licence compliance processes and operational maturity. Confirms ongoing compliance through policies, tools, and monitoring. • Requires a dedicated compliance officer, CI integration of component and licence checks, reviewed evidence of internal processes, and active maintenance of artefacts including a Software Bill of Materials (SBOM). OSS Community Champion (forthcoming) • For projects demonstrating sustained leadership and open source excellence. May be issued to individual projects or branded groups. • Signals credibility and influence. Recognises transparency, community engagement, and comprehensive governance. Gains enhanced visibility through GÉANT outreach. • Requires transparent governance, clear contribution guidelines, public issue tracking and roadmap, comprehensive and regularly maintained documentation, active community, external recognition, and contributions to other projects. For more details, see Appendix C and [27]. 2.2.5 SoftwareCertHub – Certificate Management Application The Software Licensing Certificates web platform, named SoftwareCertHub, was launched with initial badge and certificate display functionality [28]. Its appearance and usability are being enhanced through OpenBadges 3.0 implementation, Verifiable Credentials support, and further UI and attribute improvements. This section provides a brief overview of the application’s functionality. Certificates are issued by the competent authority, in this case the GÉANT licensing team, through the Licensing Certificate Registry managed by the SoftwareCertHub application. After integration, certificates are automatically visible in the GÉANT Software Catalogue. Certificates may expire or be revoked if non-compliance is detected. Both expired and revoked certificates remain publicly listed for transparency. The certificate management application is a central governance tool for managing software licence compliance certificates. It is used for issuing and registering certificates, tracking their validity, and making them accessible via the GÉANT Software Catalogue. Certificates are verifiable and visually represented through integration-ready badges (inline or large) for use in READMEs, websites, and wikis. This ensures transparent verification and lifecycle integrity, including issuance, visibility, expiry, and revocation. Developers are encouraged to record certification dates in changelogs, and reference certificates in documentation, whether public or internal. Visual certificate representation of issued certificates comes in two forms: Figure 2.2 shows a compact (inline) certificate view (badge) for repository artefacts (upper left), and a larger view (for web pages and wikis) for SoftwareCertHub application (lower left). The certificate images use the GÉANT brand colours and prominently showcase the GÉANT logo. The immediate association to GÉANT translates the trust users have towards the project to the recipients of the certificates. The large certificate images also show the software name, version, and a larger logo. Images prominently feature colours assigned to certificates for visual association. These colours are chosen according to the certificate level so that end users can easily and intuitively associate them with achievement or maturity levels (white, bronze, silver, gold, and celeste blue). Open Source and Licence Support Activities Deliverable GN5-2 D9.5 Open Source and Licence Support Report Document ID: GN5-2-25-05FFAA 14 The images are dynamically generated SVGs because web pages and online documents “pull” the certificate images, thereby allowing them to be changed based on certificate status or design updates. Using this approach, the look of already embedded certificate images can be centrally updated when the certificate status changes (for example, expired or revoked certificates, or updated design or colour scheme). Figure 2.2: Certificate details page The Certificate Details page (Figure 2.2) also provides full information for a specific certificate, including: • Software details (name, version, repository, and Software Catalogue links). • Certificate name and compliance domain (software licensing). • Status, issuer, issue date, last review, and expiry dates. • Internal note on the certificate (visible only to authorised SoftwareCertHub users). • Public certificate note and ID. • Name and contact details of the issuer (certification board). Expired or revoked certificates remain visible but clearly marked. Certificate badges can be embedded into READMEs and other documents, web pages, and wikis with small HTML fragments or Markdown snippets, as shown in Figure 2.3. This enables end users to publicly show their certificates without technical integration with the host system. It also provides trust assurance for viewers, who can follow the embedded hyperlinks to the corresponding SoftwareCertHub pages and see more details about certificates. Open Source and Licence Support Activities Deliverable GN5-2 D9.5 Open Source and Licence Support Report Document ID: GN5-2-25-05FFAA 15 Figure 2.3 : Certificate view snippets for referencing certificates A certificate list page displays all certificates issued within a licence compliance domain, with software name, certificate status, issue date, and links to the details page (Figure 2.4 ). This list can be filtered or sorted by software, certificate type, status, and date. The certificate list [29] and individual certificate details [30] are also available as JSON via a public API, enabling programmatic access and integration with external systems. Figure 2.4 : Certificate list page Open Source and Licence Support Activities Deliverable GN5-2 D9.5 Open Source and Licence Support Report Document ID: GN5-2-25-05FFAA 16 Certificate issuance and export will be extended with Open Badges 3.0 Verifiable Credentials, allowing recipients to request and download standards-based verifiable credentials/badges from the issuer. These will be able to be imported into private or public e-wallets, providing developers and projects with a portable and verifiable standalone record of licence compliance certification. This will ensure alignment with emerging digital credential practices and enhances interoperability. All certificates will also be implemented as W3C Verifiable Credentials, cryptographically tied to the trusted issuer certificates.software.geant.org. This will ensure authenticity, integrity, and long-term trust, while providing a uniform mechanism for human-readable certificates and machine-verifiable credentials, supporting integration with the broader identity and credential ecosystem [31]. The SoftwareCertHub software project is open source under the Apache-2.0 licence. Development is ongoing, and significant enhancements are planned. 2.2.6 Details of Developer Support At the end of GN5-1, 23 GÉANT software projects out of 63 registered in the catalogue, of which 47 are active, had declared a licence, an increase from seven prior to the campaign and initial reminders. Following additional reminders issued in 2025 under GN5-2, this number rose to 40 projects. Nevertheless, four projects continue to declare the now obsolete “GÉANT Standard OSS Outward Licence”. This demonstrates that teams are actively considering and adopting OSS licences, however, they remain hesitant to request SCA and SLA services, even as they actively utilise the available licensing-related materials and attend the relevant infoshares provided. InAcademia WooCommerce Plugin and eduGAIN Reporting Ecosystem were used to pilot artefact templates, which were later further refined alongside improvements to VAaaS artefacts. Currently, the eduGAIN Reporting Ecosystem, VAaaS, and the GÉANT Software Catalogue serve as pilot cases for certification. Developers and managers of these projects have significantly supported the SLM team by raising questions and using draft materials. Since the analyses of individual projects have been conducted and reiterated across several GÉANT project phases, a summary of all analyses so far is given in the introduction to this section 2. The projects analysed (SCA and SLA) specifically in GN5-2 so far (October 2025) are detailed below: Software Composition Analysis (SCA) • MaaT (versions 1.0.9–1.0.12; last scan 27 June 2025) Scanned via Bamboo-Mend integration. Newer versions show a clear reduction in critical and highseverity vulnerabilities, reflecting improvements in dependency management and security updates. Due to the mix of direct and transitive dependencies, some risks are inherited from upstream libraries. Licence analysis detected permissive licences (Apache 2.0, MIT, BSD 2, BSD 3) and weak copyleft licences (Eclipse 1.0, Eclipse 2.0, LGPL 2.1, GPL 2.0 Classpath), allowing for both permissive and copyleft licensing (Figure 2.5). The money-api-1.0.1.jar dependency, which implements JSR 354 Money and Currency API, was licensed under a restrictive “evaluation licence” in version 1.0.1, but from version 1.1 it is under Apache 2.0, so the issue can be easily resolved by updating it. • nmaas (versions 1.7.0–1.9.0; last scan 29 July 2025) Scanned via Bamboo-Mend integration. Four scans exist for these versions, but only one includes all three projects (platform, janitor, portal). Only a handful of vulnerabilities were detected, with no critical issues, reflecting a strong security posture. The dependency profile shows a mix of direct and transitive libraries, yet overall complexity remains manageable. Licence analysis includes permissive types (Apache 2.0, MIT, BSD, ISC), weak copyleft licences (Eclipse 2.0, Eclipse 1.0, LGPL 2.1, Mozilla 2.0, Mozilla 1.1, GPL 2.0 Classpath), and strong copyleft (AGPL 3.0). Open Source and Licence Support Activities Deliverable GN5-2 D9.5 Open Source and Licence Support Report Document ID: GN5-2-25-05FFAA 17 Figure 2.5: Licence distribution chart for MaaT Software Licence Analysis (SLA) • eduGAIN Reporting Ecosystem (June 2025 and ongoing) This composition of two repositories provides information and visuals from eduGAIN monitoring and data-collection tools. The analysis included both repositories, whose dependencies are simple, and under permissive licences. Original mandatory artefacts (LICENSE, COPYRIGHT, README, but also optional AUTHORS) were produced in December 2024; they were updated, and NOTICE added in June 2025. The licences selected for both modules is EUPL 1.2. Feedback on the SLA was provided in March 2025 and included suggestions for improvements to the feedback form. Ongoing work from June 2025 focuses on certificate requirements, checklists, and updating of artefacts for licence badge certification up to the Verified Software Licence certificate. • Vulnerability Assessment as a Service (VAaaS) (June 2025 and ongoing) The SLA confirmed that the product is licensed under AGPL 3.0+, with a recommendation to switch to GPL 3.0+ for better alignment with GÉANT requirements. The LICENSE, COPYRIGHT, and README files are present and consistent, while the CHANGELOG is maintained as required. No dedicated NOTICE file is included, but attribution and licence information are documented in the existing files. All declared third-party dependencies (MIT, BSD, Apache 2.0, LGPL 3.0, Mozilla 2.0, etc.) were reviewed and confirmed compatible with GPL v3.0+. The SLA also included a security and licensing analysis (via Mend), confirming overall low risk. Some outdated libraries and unresolved licences were noted, with recommendations to review and remediate to ensure long-term compliance and security. A full SLA was conducted for the second time in June 2025 to test updated templates and suggest further improvements. Modifications include the transition from AGPL 3.0+ to GPL 3.0+. • GÉANT Software Catalogue (version 1.12.0; June 2025 and ongoing) The Mend security and licensing scan highlighted many third-party libraries, reflecting the scale of this large multi-repository product that uses many technologies. Recommendations focused on reviewing potentially problematic transitive dependencies, strengthening documentation, optimising artefacts in secondary repositories, and ensuring long-term maintainability. Licence options were discussed between the Software Catalogue and SLM teams. GSC is licensed under Apache 2.0, as are most of its dependencies. The development team is finalising the preparation of licensing and documentation artefacts by responding to SLM team edits and comments. Most dependencies are under compatible licences, including multi-licensed ones, and do not pose compatibility issues. Three indirect dependencies under GPL 2.0 requiring clarification were identified, but these appear unused or irrelevant to the software’s operation. The project also needs to improve its security posture. Joint work Open Source and Licence Support Activities Deliverable GN5-2 D9.5 Open Source and Licence Support Report Document ID: GN5-2-25-05FFAA 18 on artefacts contributed to improved templates and the developer guide. This effort is also aimed at obtaining a Verified Software Licence certificate. It is worth noting that WiFiMon was accepted for SLA in 2024 but has moved to maintenance mode. Artefactrelated discussions with other teams led to additional partial tracking and advisory activities. For example, an SLA was agreed with the developers of the User Profile Page Shibboleth plugin, but was later cancelled, as the plugin was integrated into the Shibboleth platform and transferred to the Shibboleth Consortium. 2.2.7 Surveys, Feedback, Collaboration, and Community Engagement To monitor the effectiveness of guidance and tooling, inform improvements, and align data collection with compliance tracking needs, the SLM team: • Contributed to the WP9 Task 2 Evaluation Survey update for all review services, improving data collection from software teams, and aligning with licensing data needs to capture structured team feedback, which will also inform improvements to licensing support. • Reviewed and improved the content and structure of surveys and other data collection tools to support licence compliance monitoring and reporting. • Defined data items for licence tracking to align surveys and other data collection tools with the planned licensing dashboards. • Collected feedback from users to evaluate practical impact. A general preference observed is for direct interaction via Zoom, email, or Slack, as developers often feel less confident in licensing matters to use formal or persistent written channels such as Jira, or to resolve issues solely through written lists. For the remediation of SCA or SLA findings, they favour iterative, interactive walkthroughs of identified or pending issues until both sides confirm resolution. They also expect that automation through compliance templates, artefact checks, and DevOps workflows will support continuous, sustainable compliance with reduced manual effort. To ensure alignment with GÉANT-wide policies, gather input, and maintain cross-team consistency in OSS licensing support, the team: • Supported OSRB activities and participated in the OSRB meeting to present progress and collect feedback. • Coordinated with the eduGAIN Reporting Ecosystem team to simplify certificate requests and align the certificate framework with developers’ perspective. • Drafted and extended new VAaaS artefacts, at the same time updating and improving the templates and documentation practices. • Engaged with OSRB, Technical Authors (TAs), and GLAD for review, feedback, and updates to ensure that materials meet GÉANT quality standards for learning materials. • Collaborated with design and communications teams on graphical and content updates. • Contributed to TA document reviews and updates, especially regarding EU logo use and funding acknowledgements, to ensure compliance and simplify crediting of EU funding and GÉANT references. • Initiated two topics on certificates and badges with the WP5 Trust and Identity (T&I) Incubator [32]. • Produced guidance for collecting testimonials on software licensing support and collected testimonials. Open Source and Licence Support Activities Deliverable GN5-2 D9.5 Open Source and Licence Support Report Document ID: GN5-2-25-05FFAA 19 User Testimonials The effectiveness of conducted efforts is reflected in positive feedback received from software teams. Feedback from the GÉANT Software Catalogue team highlighted the comprehensive nature of the support: “The licensing support was excellent. Clear templates eliminated guesswork, responses were quick and helpful, and even our complex multi-repository setup was easily handled. This turned a potentially painful compliance process from a chore into something smooth, manageable, and almost enjoyable.” Similarly, feedback from the MaaT team emphasised the educational value and guidance provided: “The licensing experts at WP9 guided us in selecting the right licence for the MaaT application and supported us in preparing its public release with the appropriate licensing information. Through this cooperation and the insights gained into open-source licensing, we have enhanced our awareness and deepened our understanding of the significance of IPR matters.” The testimonial from the eduGAIN Reporting Ecosystem team highlights how the licensing team streamlined compliance, improved workflows, and enabled the project to focus on innovation: “Working with the licensing team turned what we expected to be a heavy burden into a smooth, manageable process. Their guidance, templates, and explanations kept us compliant without slowing development, saving time and reducing uncertainty. Their support also improved our workflow by standardising documentation, clarifying dependencies, and giving our project credibility for public release. Their expertise made the process easier, letting us focus on innovation rather than administration.” These testimonials demonstrate that the combined approach of systematic evaluation, education, training, and continuous improvement has successfully delivered practical compliance support, and enhanced understanding of licensing requirements by GÉANT development teams. Deliverable GN5-2 D9.5 Open Source and Licence Support Report Document ID: GN5-2-25-05FFAA 20 3 Planned Activities Forthcoming planned activities focus on providing advice and support for software management and licensing, covering immediate actions, ongoing developments, and longer-term planned initiatives. 3.1 Immediate Implementation Priorities Immediate priorities centre on establishing foundational automation and governance structures. Key actions include: • Implementing automated licence data collection and basic compliance checks, including dependency vulnerabilities. • Integrating artefact templates into new open source project workflows. • Automating Mend scans through GitLab Community Edition. Regular OSRB meetings will ensure alignment and governance oversight. 3.2 Ongoing Work Ongoing work focuses on developing practical tools and resources. Key activities include: • Preparing ready-to-use scripts and templates in cooperation with the software tools team. • Integrating artefact templates into OSS workflows. • Piloting initial licensing compliance certificates. • Updating licensing guidelines and training content. • Exploring a licensing chatbot trained on produced materials for quick guidance. • Conducting infoshare sessions on applying for licensing certificates and automated licence compliance. Contributions to WP9 Task 2 analysis, testing, and evaluation processes will continue. 3.3 Planned Outreach and Expansion Activities These activities focus on launching licensing certificates and promoting adoption within the GÉANT community. Key initiatives include: • Conducting dedicated infoshare sessions on licensing certificates and automated licence compliance. • Stimulating use of SLA and SLA services, and licensing certificates through leader awareness campaigns, GÉANT CONNECT articles, providing a public automatically filled licensing dashboard, and potential managerial enforcements. • Expanding artefact creation and updating capabilities. Planned Activities Deliverable GN5-2 D9.5 Open Source and Licence Support Report Document ID: GN5-2-25-05FFAA 21 • Participating in the evaluation of six SCA tools to enhance secure and compliant software development practices at GÉANT. This includes: ○ Covering evaluation phases including planning, setup, analysis, and reporting, with contributions from developers, and legal, compliance, and security experts. ○ Reassessing current needs based on the 2019 evaluation that recommended WhiteSource (now Mend), considering both commercial and open source solutions. ○ Evaluating deployment models, detection capabilities, risk assessment features, integration options, and operational efficiency, with a focus on multi-project support, CI/CD integration, SAML SSO, and reporting for security vulnerabilities and IPR compliance. ○ SLM will primarily contribute with practical IPR management and licensing expertise. 3.4 Advanced Licence Governance Enhancements Advanced licence governance is a key development stream. Key activities include: • Collecting licence data from the GÉANT Software Catalogue and repositories using ScanCode and custom scripts. • Integrating the licensing dashboard with SoftwareCertHub and the GÉANT Software Catalogue. • Expanding the certificate and badge web application to cover additional scenarios, including software code reviews • Aligning templates with CodeScan capabilities. • Delivering enhanced artefact creation and updating through GitLab repository DevOps support. 3.5 Continuous Improvement and Assessment All activities will be underpinned by continuous improvement. Key actions include: • Regularly reviewing and updating templates, automated data collection, certificates, and training. • Assessing software licensing progress, status, and issues through OSRB facilitation. • Documenting case studies. • Updating governance guidelines to reinforce lessons learned. 3.6 Long-Term Sustainability Long-term sustainability will be ensured through: • Developing the software licence space in the Software Governance eAcademy track, as this empowers people to take responsibility for licensing decisions. • Maintaining SLM services for GÉANT teams, as this keeps support and tools operational for ongoing guidance and compliance. • Aligning common best practices with open software management, as this facilitates standardised and shareable approaches across software projects. • Expanding the certificate and badge application to multiple scenarios to broaden usage and share development efforts across activities, as this reduces direct development and maintenance effort by leveraging potential external resources for this supporting tool. Planned Activities Deliverable GN5-2 D9.5 Open Source and Licence Support Report Document ID: GN5-2-25-05FFAA 22 Further development will extend SoftwareCertHub features to other scenarios, such as WP5 Incubator distributed credentials, and eAcademy. This will increase sustainability by sharing development and maintenance efforts. SoftwareCertHub credentials management could also support integration with the broader identity and credential ecosystem. SLM results will be offered to the broader OSS community through shared insights, templates, tools, certificates, and badges. This includes promoting licensing, best practices, and distributed credentials, and enabling integration with broader identity and credential ecosystems. Collaboration with other initiatives and interested parties will extend the impact of these resources, support standardised approaches, and foster adoption, reuse, and sustainable practices across the wider OSS ecosystem. Licensing Checklist Deliverable GN5-2 D9.5 Open Source and Licence Support Report Document ID: GN5-2-25-05FFAA 29 Figure B.2: Creation of CHANGELOG in the Software Artefact Checklist Figure B.3: Creation of CHANGELOG in the internal checklist The “Software Artefact Checklist” is an example of how GÉANT’s licensing support has matured from early internal or needs-based analyses and considerations to the provision of structured, practical tools tailored for specific purposes and roles. A similar approach has been applied to other guides, wiki resources, templates, and training materials. These resources simplify complex requirements, reduce licence incompatibility risks, and provide developers and the licensing team with consistent frameworks for managing software licences and artefacts. Deliverable GN5-2 D9.5 Open Source and Licence Support Report Document ID: GN5-2-25-05FFAA 30 Appendix C Software Licensing Certificates A structured GÉANT software licensing certificates scheme has been implemented to help software development teams manage licensing, dependencies, and related risks throughout a project’s lifecycle. The process’s primary aim is to provide clarity, traceability, growth paths, and assurance for internal, unpublished, and openly distributed GÉANT software projects. The certification process is designed to: • Familiarise developers with licensing, software licences, and dependency management. • Mitigate risk early by identifying licensing, dependency, and compliance issues. • Ensure compliance with the GÉANT IPR Policy and open source standards. • Prepare projects for distribution by validating licence compatibility, completeness, and transparency. • Build trust with users, contributors, and stakeholders. • Enable reuse and collaboration through verified legal and metadata artefacts, and defined processes. • Support long-term sustainability with clear guidance for contributors, partners, and management. Four certificates have been fully defined to reflect levels of maturity in producing quality documentation and managing licences, as well as to recognise dedication to tackling the complexities involved in the production of project artefacts. These certificates are as follows: • Self-Assessed Dependencies for early-stage or internal projects, confirming that the development team has identified direct dependencies, as well as reviewed them for critical vulnerabilities and eventual licence compliance for reused code. This process is intended to be manual, but it can also use the GÉANT SCA service [34]. • Verified Dependencies for projects that are not yet distributed or licensed, confirming that all dependencies have been verified using Software Composition Analysis in terms of their licences and vulnerabilities. This level of certification is suitable for projects developing tools for internal usage, and for teams preparing licensing for their project. • Verified Software Licence for projects ready for distribution, confirming the selection, declaration, and verified compatibility of the licence chosen for the project with its constituent components. Requires a completed Software Licence Analysis [35], or equivalent. • Software Licence Assurance for mature, actively maintained, publicly distributed, and consistently governed projects, confirming ongoing compliance through policies, tools, and monitoring. Suitable for software projects, maintained services, and product groups. Additionally, the SLM team is preparing a fifth certificate, named OSS Community Champion, which is to be awarded to projects showing consistent leadership and open source excellence. This certificate will highlight transparency, active community involvement, and clear governance that may be attributed to individual initiatives or larger branded groups. This recognition will affirm credibility and help boost projects’ visibility through GÉANT’s outreach. The key differences between licensing certificates are shown in Table C.1. Each subsequent certificate encompasses elements of the previous one. Obtained certificates are visible at [36] and should also be Software Licensing Certificates Deliverable D9.5 Open Source and Licence Support Report Document ID: GN5-2-25-05FFAA 31 referenced in documentation, metadata, project pages, or communications. The overviews of all certification levels, with the intention to present the relationship between certificates, are given in the table below. Aspect Self-Assessed Dependencies Verified Dependencies Verified Software Licence Software Licence Assurance Purpose Entry-level self-assessment of direct dependencies External verification of all dependencies, without requiring a licence Confirms appropriate licence choice and full compliance Mature, ongoing governance of licences and dependencies Suitable For / Scope Early-stage projects, internal tools, initial governance Projects nearing release without a licence; internal tools Software ready for public release, distributed, or externally available Actively governed OSS projects committed to compliance Validation Developer self-assessment; no external validation Verified by Licence Management Team using SCA or equivalent Reviewed by Licence Management Team via SLA service or structured process Licence Management Team review following internal audit; ongoing monitoring Effort Level Low – basic analysis documenting direct dependencies Medium – full external dependency verification High – detailed analysis and artefact creation Very high – continuous governance and validation Licence Declaration Not required Not required Required Required, with full compliance framework Dependencies Coverage Direct only; transitive optional All, including transitive; mutually compatible licences All verified, compliant, and compatible with chosen licence All validated through CI/CD integration Requirements Listed in Software Catalogue; identify direct dependencies; mutually compatible licences; no critical vulnerabilities or licence violations As left, extended to all dependencies As left, plus GÉANTapproved licence; correct artefacts; licence in documentation, Software Catalogue, repository metadata, and website As left, plus designated compliance officer; CI/CDintegrated SCA tools; licence monitoring; contributor onboarding; tool maintenance; audits; documented processes Artefacts Internal list of direct dependencies and licences; optional NOTICE or README SCA report listing licences and vulnerabilities As left, plus LICENSE, COPYRIGHT, README, NOTICE, CHANGELOG, and CONTRIBUTING As left, plus compliance records; suggested SBOM Certification Process Submit notification Submit dependency report Submit after SLA review and artefact finalisation Provide repository access, documents, and audit evidence Governance & Maintenance Maintained by developers; occasional checks possible Maintained by developers; reviewed by Licence Management Team; occasional checks Maintained by developers; reviewed at certification; occasional checks Continuous maintenance; designated compliance officer; biennial audits; occasional checks Validity Period 5 years (renewable) 5 years (renewable) Indefinite (unless revoked) Indefinite (with biennial audits) Software Licensing Certificates Deliverable D9.5 Open Source and Licence Support Report Document ID: GN5-2-25-05FFAA 32 Table C.1: Key differences between licensing certificates C.1 Self-Assessed Dependencies This certificate confirms that a software project in active development has identified and internally assessed all direct dependencies and other third-party intellectual property for licence compatibility and critical vulnerabilities. It represents the initial stage of licence governance and compliance, achieved through internal verification. C.1.1 Certification • Developers inform the Licence Management Team that the certificate requirements have been met. • They reference the certificate in documentation, metadata, project pages, or communications. Requirements • Document all directly used external libraries and code in an internal dependency list. • Record the licences of these libraries and code in the same list. • Confirm that all direct dependencies are under valid open source or proprietary licences. • Ensure that all these licences are mutually compatible with the software as a whole. • Review each direct dependency for known critical vulnerabilities and document the results in a SCA report or internal record. • Address all identified dependency vulnerabilities. • Manually review other third-party intellectual property, such as source code, visual components, content, designs, models, or similar assets. • Register the project in the GÉANT Software Catalogue. Mandatory Artefacts • Internal list of direct dependencies, including versions, licences, and vulnerability data, available upon request by the SLM team. Optional Artefacts • README – basic information about the software. • NOTICE – legal notices or attributions for third-party components; may be required by dependency licences. Aspect Self-Assessed Dependencies Verified Dependencies Verified Software Licence Software Licence Assurance Revocation Triggers Missing dependencies; licence conflicts; critical vulnerabilities; unresolved complaints; nonresponsiveness As left, for all dependencies As left, plus unapproved licence changes; incorrect artefacts; noncompliance; distribution violations As left, plus outdated tools, processes, or documents; ignored errors; failed audits; not maintained practices; misrepresentation of compliance Limitations Self-assessment only; not validated; no distribution permission; no licence selection No distribution permission; no licence selection Not a legal audit; excludes patents, export controls, and data protection Not a legal or security audit; unsuitable for prototypes; requires sustained adherence and collaboration Software Licensing Certificates Deliverable D9.5 Open Source and Licence Support Report Document ID: GN5-2-25-05FFAA 33 C.1.2 Governance Upon approval, the project receives the Self-Assessed Dependencies certificate, visible at certificates.software.geant.org and in the GÉANT Software Catalogue [37]. Further details are available in the Detailed Guide: Self-Assessed Dependencies Certificate [38]. Ongoing Requirements Keep dependency, licence, and vulnerability information up to date. Review new or changed dependencies regularly and monitor for newly discovered vulnerabilities or licence conflicts. Validity Period and Renewal The certificate is valid for five years, covering all released versions within that period, provided newly detected issues are promptly addressed. Reassess and request renewal before expiry, or earlier if major changes occur. C.2 Verified Dependencies This certificate confirms that a software project has identified all direct and transitive dependencies, verified them for licence compatibility and critical vulnerabilities, and documented them for review by the Licence Management Team. C.2.1 Certification • Complete all Self-Assessed Dependencies steps, extended to include transitive dependencies. • Submit a verification request to the Licence Management Team, including: ○ Assessment or SCA tool results. ○ Third-party IP details, if any. ○ Supporting documentation. ○ SCA report or reference to the GÉANT SCA service performed. • Provide clarifications or perform remediation as requested by the Licence Management Team. Requirements All requirements of Self-Assessed Dependencies apply, extended to include transitive dependencies. Mandatory Artefacts • All mandatory artefacts from Self-Assessed Dependencies, extended to cover transitive dependencies, based on SCA tool results. Optional Artefacts • All optional artefacts from Self-Assessed Dependencies. Software Licensing Certificates Deliverable D9.5 Open Source and Licence Support Report Document ID: GN5-2-25-05FFAA 34 C.2.2 Governance Upon approval, the project receives the Verified Dependencies certificate, visible at certificates.software.geant.org and in the GÉANT Software Catalogue. Further details are available in the Detailed Guide: Verified Dependencies Certificate [39]. Ongoing Requirements Same as for Self-Assessed Dependencies, extended to include transitive dependencies, based on SCA tool results. Validity Period and Renewal Same as for Self-Assessed Dependencies. C.3 Verified Software Licence This certificate confirms that a project’s licensing has been reviewed and validated. It verifies that the software licence has been selected, confirmed as compatible with all components, and appropriately declared, confirming readiness for compliant release. C.3.1 Certification • Complete all Verified Dependencies steps. • Perform a software licence review using the SLA Service or equivalent internal process. • Create all necessary project artefacts, supported by the Software Artefacts Checklist and related templates. • Declare the licence in repository metadata and, if applicable, in the software UI. • Ensure that all dependencies are licence-compatible and their vulnerabilities are addressed. • Provide clarifications or perform remediation as requested by the Licence Management Team. Requirements • All requirements of Verified Dependencies. • Complete of the GÉANT SLA service review, confirming licensing compliance and artefacts. • Obtain GÉANT IPR Coordinator’s approval of the licence for the software’s context and intended distribution. Mandatory Artefacts • All mandatory artefacts from Verified Dependencies. • README – basic information about the software, licence, and copyright. • LICENSE – software licence text. • COPYRIGHT – copyright ownership information. Optional Artefacts • NOTICE – legal notices or attributions for third-party components; may be required by the software or dependency licences. • CHANGELOG – record of changes; may be required by the software or dependency licences. Software Licensing Certificates Deliverable D9.5 Open Source and Licence Support Report Document ID: GN5-2-25-05FFAA 35 • CONTRIBUTING – contribution policy or guidelines. C.3.2 Governance Upon approval, the project receives the Verified Software Licence certificate, visible at certificates.software.geant.org and in the GÉANT Software Catalogue. Further details are available in the Detailed Guide: Verified Software Licence Certificate [40]. Ongoing Requirements Maintain ongoing licensing compliance and up-to-date artefacts. Continuous licence and dependency scanning (e.g. via CI/CD) may be used to ensure long-term compliance. The Licence Management Team validates issuance and may occasionally review status. Validity Period and Renewal The certificate is valid indefinitely, provided newly detected issues are promptly addressed. C.4 Software Licence Assurance This certificate builds upon the Verified Software Licence Certificate, and confirms that a project integrates mature, sustainable, and traceable licensing and dependency management practices into its development and delivery lifecycle. It applies to actively maintained, publicly or purposefully distributed software under consistent governance, and may cover a single project or a group of related software products under unified ownership and management. C.4.1 Certification • Ensure Verified Software Licence compliance for each included software. • Submit a request to the Licence Management Team, including: ○ Contact details of the Licence Compliance Officer. ○ Results of the SLA or equivalent review for exemplary software. ○ Access to the exemplary code repository with all relevant artefacts (README, LICENSE, COPYRIGHT, NOTICE, CHANGELOG, etc.). ○ List of all dependencies with licences and security status for exemplary software. ○ Results of automated checks, including CI/CD compliance rules. ○ Governance and compliance policies, including dependency and licence management guidelines. ○ Evidence of governance and training activities, such as onboarding materials and contribution guidelines. ○ Exemplary records of dependency management compliance decisions. ○ Exemplary records associated with one or several contributions. ○ Exemplary records of known vulnerabilities and their remediation. ○ Records of compliance reviews and audits. ○ Clarifications or supporting notes, if needed. Software Licensing Certificates Deliverable D9.5 Open Source and Licence Support Report Document ID: GN5-2-25-05FFAA 36 • Respond to the Licence Management Team’s feedback by providing clarifications, demonstrating compliance tool effectiveness, and implementing corrective actions, such as addressing documentation or process gaps, as required. Requirements • All Verified Software Licence requirements for each software developed or maintained by the project. • Regularly maintain all artefacts required by the Verified Software Licence Certificate. • Designate a Licence Compliance Officer responsible for licensing decisions and queries. • Establish and enforce governance policies covering inbound and outbound licences, dependency management, contributions, conflict resolution, compliance tools, and audits. • Integrate automated compliance tools into the CI/CD pipeline, with alerts for licence, version, and security issues. • Maintain compliance rules, scanning configurations, and alert thresholds. • Implement team onboarding and training with up-to-date materials. • Document development practices related to compliance tools, monitoring, and dependency management are documented. • Maintain contribution guidelines or policies. • Establish adequate general or per-software licensing policies. • Preserve compliance records for dependency approvals, licensing decisions, contributions, reviews, vulnerabilities, and remediation. • Perform regular compliance reviews and audits, with documented findings and corrective actions. Mandatory Artefacts • Core licensing artefacts (README, LICENSE, COPYRIGHT, NOTICE, CHANGELOG, etc.) for all included software. • Up-to-date onboarding and training materials on licensing, security, and IPR management. • Dependency and licence management guidelines. • Dependency and licence approvals, including exceptions or waivers where applicable. • Contribution guidelines. • Code testing or review records, including for external contributions where applicable. • CI/CD compliance tool rules and configurations. • SCA, licence, and security scan results and reports. • Records of dependency management, compliance decisions, vulnerabilities, and remediation. • Records of monitoring alerts and responses. • Minutes or sign-off records from compliance reviews and audits. Optional Artefacts • Software Bill of Materials (SBOM) – recommended for each software. C.4.2 Governance Upon approval, the project receives the Software Licence Assurance certificate, visible at certificates.software.geant.org and in the GÉANT Software Catalogue. Further details are available in the Detailed Guide: Software Licence Assurance Certificate [41]. Ongoing Requirements Maintain ongoing compliance, governance, automation, and licensing artefacts for all included software. Software Licensing Certificates Deliverable D9.5 Open Source and Licence Support Report Document ID: GN5-2-25-05FFAA 37 The Licence Management Team validates issuance and may review certificate status. Conduct a biennial audit, either as an internal review by the development team or as an external audit arranged with the Licence Management Team. Conduct an internal review after governance or leadership changes, major changes to compliance processes, or significant compliance concerns raised by users. Validity Period and Renewal The certificate is valid indefinitely, provided certified practices are maintained, newly detected issues are promptly addressed, and biennial audits are successfully completed. Deliverable GN5-2 D9.5 Open Source and Licence Support Report Document ID: GN5-2-25-05FFAA 38 Glossary AGPL GNU Affero General Public License BCL Business Source License BSD Berkley Software Distribution BSL Boost Software License CC Creative Commons CC0 Creative Commons Zero public domain dedication CC-BY Creative Commons Attribution licence CC-BY-SA Creative Commons Attribution-ShareAlike licence CDDL Common Development and Distribution License CI/CD Continuous Integration and Continuous Delivery CLI Command-Line Interface EUPL European Union Public Licence FSF Free Software Foundation GLAD GÉANT Learning and Development GN4-3 GÉANT Network 4 Phase 3, a project part-funded by the EC’s Horizon 2020 programme under Specific Grant Agreement No. 856726 GN5-1 GÉANT Network 5 Phase 1, a project funded by the European Union’s Horizon Europe research and innovation programme under Grant Agreement No. 101100680, and one of the projects implementing the GN5 Framework Partnership Agreement GN5-2 GÉANT Network 5, Phase 2, a project funded by the European Union’s Horizon Europe research and innovation programme under Grant Agreement No. 101194278 and one of the projects implementing the actions defined in the GN5-FPA gNMI gRPC Network Management Interface gNMIc gRPC Network Management Interface (client) gRPC Google Remote Procedure Calls GPL GNU General Public License GSC GÉANT Software Catalogue GSD GÉANT Software Development Support InAcademia GÉANT service providing real-time, secure validation of student affiliation IPR Intellectual Property Rights ISC Internet Software Consortium, later changed to Internet Systems Consortium KPI Key Performance Indicator LGPL GNU Lesser General Public License MaaT A tool for managing information about infrastructure resources and services in network automation and orchestration use cases (formerly Inventory3) MIT Massachusetts Institute of Technology licence MPL Mozilla Public License nmaas Network Management as a Service NREN National Research and Education Network NUnit Licence used for NUnit unit-testing framework OSI Open Source Initiative OSRB Open Source Review Board OSS Open Source Software PMO Project Management Office