FINGERPRINTS FOR OPEN SOURCE CODE GOVERNANCE

1 . A method comprising:

obtaining a piece of open source code;

obtaining a first sequence of the open source code;

generating a first hash based on the first sequence;

obtaining a second sequence of the open source code, the second sequence being shifted from the first sequence;

generating a second hash based on the second sequence;

generating a fingerprint for the open source code based on the first hash and the second hash; and

using the fingerprint to determine whether a software product includes the open source code.

2 . The method according to claim 1 , wherein the first sequence and the second sequence are shifted from each other by a predetermined length of code.

3 . The method according to claim 2 , wherein the first sequence and the second sequence overlap with each other.

4 . The method according to claim 2 , further comprising:

using a same hash function to generate the first hash and the second hash.

5 . The method according to claim 4 , wherein the software product includes program code, the method further comprising:

obtaining a first sequence of the program code;

generating a third hash based on the first sequence of the program code;

obtaining a second sequence of the program code, the second sequence of the program code being shifted from the first sequence of the program code by the predetermined length of code;

generating a fourth hash based on the second sequence of the program code; and

generating a fingerprint for the software product based on the third hash and the fourth hash.

6 . The method according to claim 5 , further comprising:

calculating a similarity value from the fingerprint of the software product and the fingerprint of the open source code;

determining whether the similarity value is greater than a predetermined threshold; and

in response determining that the similarity value is greater than the predetermined threshold, determining that the software product includes the open source code.

7 . The method according to claim 6 , further comprising:

in response to determining that the software product includes the open source code, determining a licensing term for the software product based on a licensing term of the open source code.

8 . An apparatus comprising:

one or more processors;

a memory configured to store instructions executable by the one or more processors, wherein the one or more processors are configured to execute the instructions to perform operations including:

obtaining a piece of open source code;

obtaining a first sequence of the open source code;

generating a first hash based on the first sequence;

obtaining a second sequence of the open source code, the second sequence being shifted from the first sequence;

generating a second hash based on the second sequence;

generating a fingerprint for the open source code based on the first hash and the second hash; and

using the fingerprint to determine whether a software product includes the open source code.

9 . The apparatus according to claim 8 , wherein the first sequence and the second sequence are shifted from each other by a predetermined length of code.

10 . The apparatus according to claim 9 , wherein the first sequence and the second sequence overlap with each other.

11 . The apparatus according to claim 9 , wherein the operations further include:

using a same hash function to generate the first hash and the second hash.

12 . The apparatus according to claim 11 , wherein the software product includes program code, and the operations further include:

obtaining a first sequence of the program code;

generating a third hash based on the first sequence of the program code;

obtaining a second sequence of the program code, the second sequence of the program code being shifted from the first sequence of the program code by the predetermined length of code;

generating a fourth hash based on the second sequence of the program code; and

generating a fingerprint for the software product based on the third hash and the fourth hash.

13 . The apparatus according to claim 12 , wherein the operations further include:

calculating a similarity value from the fingerprint of the software product and the fingerprint of the open source code;

determining whether the similarity value is greater than a predetermined threshold; and

in response determining that the similarity value is greater than the predetermined threshold, determining that the software product includes the open source code.

14 . The apparatus according to claim 13 , wherein the operations further include:

in response to determining that the software product includes the open source code, determining a licensing term for the software product based on a licensing term of the open source code.

15 . A non-transitory computer-readable storage medium storing instructions that, when executed by one or more processors, cause the one or more processors to perform operations including:

obtaining a piece of open source code;

obtaining a first sequence of the open source code;

generating a first hash based on the first sequence;

obtaining a second sequence of the open source code, the second sequence being shifted from the first sequence;

generating a second hash based on the second sequence;

generating a fingerprint for the open source code based on the first hash and the second hash; and

using the fingerprint to determine whether a software product includes the open source code.

16 . The non-transitory computer-readable storage medium according to claim 15 , wherein the first sequence and the second sequence are shifted from each other by a predetermined length of code.

17 . The non-transitory computer-readable storage medium according to claim 16 , wherein the first sequence and the second sequence overlap with each other.

18 . The non-transitory computer-readable storage medium according to claim 16 , wherein the operations further include:

using a same hash function to generate the first hash and the second hash.

19 . The non-transitory computer-readable storage medium according to claim 18 , wherein the software product includes program code, and the operations further include:

obtaining a first sequence of the program code;

generating a third hash based on the first sequence of the program code;

obtaining a second sequence of the program code, the second sequence of the program code being shifted from the first sequence of the program code by the predetermined length of code;

generating a fourth hash based on the second sequence of the program code; and

generating a fingerprint for the software product based on the third hash and the fourth hash.

20 . The non-transitory computer-readable storage medium according to claim 19 , wherein the operations further include:

calculating a similarity value from the fingerprint of the software product and the fingerprint of the open source code;

determining whether the similarity value is greater than a predetermined threshold; and

in response determining that the similarity value is greater than the predetermined threshold, determining that the software product includes the open source code.