I am exploring this same concept currently. Immediately, the fact that the public standard open source license terms are not already recorded in the Terms and Conditions records in SAM Pro is, in my opinion, an issue. This is important so that products that include these terms in their contracts, such as commercially-supported open source products that still use public FOSS terms for their base product.
While you can track installs, it also helps to track the "intended entitlements" in certain environments. For instance, if you have a particular product that was approved to use in developer groups only, such as Notepad++ which is licensed under GPL 2.0, you may want to compare current installs by intended installs, or you may want to actually allocate approvals for certain users to use the product. This becomes more of a service management topic, but has benefits in SAM lifecycles as well. Either way, to properly structure the records in ServiceNow, you would really need the following:
- GPL 2.0 in Terms and Conditions
- Contract: Don Ho, author of NotePad++, with GPL 2.0 terms associated
- Entitlement for the version approved to use in the environment
- Allocations assigned to approved users or devices
You can even create a business rule or flow that automatically approve and allocate the product to a device or user in a specific group when assigned.
Lastly, if the product is not loaded by ServiceNow in their content service, you can always create the random FOSS product as a new Product Catalog Item (Under Software Asset > Administration > Custom Products).
Just remember: the value of tracking FOSS is more for security and environment control, not really for SAM. The audit risk of FOSS products is extremely low, though there are exceptions. Each organization decides for itself if tracking them as assets is worth it as opposed to targeting with security tools alone.
