Certified Open Source Developer for Enterprise cheat sheet

Open source is defined operationally by the OSI Open Source Definition's ten criteria: free redistribution, source code, derived works, integrity of the author's source code, no discrimination against persons or groups, no discrimination against fields of endeavor, distribution of license, license must not be specific to a product, license must not restrict other software, and license must be technology-neutral.

The Free Software Foundation's four freedoms are: run the program for any purpose, study and change it (source access required), redistribute copies, and distribute modified versions; copyleft licenses enforce these downstream, permissive licenses do not.

Free software and open source describe overlapping license sets with different philosophies; a license can be FSF-free and OSI-approved (e.g., GPL, MIT), so treat the terms as distinct labels, not synonyms.

The cathedral vs. bazaar distinction (Raymond) contrasts closed, release-gated development with open, frequent-release development; modern projects typically blend both, using maintainer review gates on public repositories.

A distributed version control workflow centers on fork, branch, commit, and pull/merge request; the upstream repository is the canonical source, and a fork is a server-side copy owned by the contributor.

Release artifacts should be traceable to a signed tag or commit hash; semantic versioning (MAJOR.MINOR.PATCH) signals breaking, additive, and fix-only changes respectively.

Governance models range from single-maintainer (BDFL) to meritocratic committer hierarchies to foundation-hosted projects (e.g., Apache Software Foundation, Linux Foundation); governance determines who merges and how disputes resolve.

Community health signals include contributor diversity, time-to-review, issue close rates, release cadence, and presence of a CODE_OF_CONDUCT, CONTRIBUTING, and SECURITY policy file.

Permissive licenses (MIT, BSD-2/3-Clause, Apache-2.0) allow proprietary redistribution when copyright notices are retained; copyleft licenses (GPL, LGPL, AGPL, MPL, EPL) impose source-disclosure or file-level reciprocity conditions.

GPL-2.0 and GPL-3.0 trigger source disclosure when you distribute binaries; GPL obligations attach to distribution, not to internal-only use, so private modifications used internally need not be published.

AGPL-3.0 extends copyleft to network use: offering the modified program as a service to remote users counts as conveyance and requires offering corresponding source.

LGPL allows linking with proprietary code if the LGPL component remains replaceable and its source plus relinking ability are provided; static linking raises stricter obligations than dynamic linking.

Apache-2.0 includes an express patent grant and a patent-retaliation clause; MIT and BSD contain no express patent grant, so patent risk must be assessed separately.

License compatibility is directional: Apache-2.0 code can generally be combined into GPL-3.0 works, but GPL-2.0-only code cannot be relicensed under GPL-3.0 or mixed into an Apache-2.0-only distribution without careful analysis.

SPDX license identifiers (e.g., Apache-2.0, GPL-2.0-only, MIT) and expressions using AND/OR/WITH are the standard machine-readable way to declare license obligations in SBOMs and package metadata.

Attribution duties typically require retaining copyright notices, license text, and NOTICE files (Apache-2.0) in distributions, including container images and bundled binaries.

A software bill of materials (SBOM) enumerates components, versions, and licenses; SPDX and CycloneDX are the dominant formats, and SBOMs support both license compliance and vulnerability response.

Dependency risk tiers: direct vs. transitive dependencies, runtime vs. build-only, and maintained vs. abandoned; transitive and unmaintained components carry the highest hidden risk.

Vulnerability data comes from sources like the NVD (CVE records with CVSS scores), GitHub Advisory Database, and OSV; CVSS base score alone does not determine exploitability in your context.

Package provenance controls include signed artifacts (Sigstore/cosign), checksum verification, and lockfiles pinning exact versions and hashes to prevent dependency confusion and typosquatting.

An approved-component intake process evaluates license, security history, maintenance activity, and support options before a library enters the internal catalog.

Container base images and vendored code are frequently overlooked consumption paths; scan them with the same policy as application dependencies.

End-of-life tracking matters: unsupported runtime versions stop receiving security patches, so consumption policy should define maximum component age and upgrade paths.

Before contributing, read CONTRIBUTING.md, the code of conduct, and the governance/decision process; contributions that skip the stated process are commonly closed without review.

A Developer Certificate of Origin (DCO) sign-off asserts you have the right to submit the code; a Contributor License Agreement (CLA) assigns or licenses rights to the project or foundation - they are different mechanisms and projects require one or the other.

Small, focused pull requests with tests and documentation changes are merged faster than large mixed changes; separate refactoring from behavior change.

Commit hygiene: atomic commits, imperative subject lines under ~72 characters, issue references, and signed commits where the project requires them.

Upstream-first contribution means fixing a bug in the upstream project rather than carrying a private patch; private forks accumulate maintenance debt and drift.

Contribution types beyond code include documentation, translations, triage, test coverage, design, and release testing; all are tracked in community metrics.

Review etiquette and responsiveness affect contributor reputation; maintainers may be volunteers, and unresolved review comments block merge regardless of code quality.

Corporate contribution requires employer approval and disclosure of conflicts; contributions made on company time may be subject to the employer's IP policy.

An Open Source Program Office (OSPO) centralizes policy, license review, SBOM generation, contribution approval, and community engagement; its scope is defined by a charter with decision rights.

Policy tiers typically classify licenses into approved, approved-with-conditions, and prohibited; automated CI checks (e.g., license scanners) enforce the classification at merge time.

Inventory and scanning tools (SCA scanners, container scanners, SBOM generators) feed a component catalog; scan results must map to a remediation SLA based on severity.

Remediation SLAs commonly key off CVSS severity and exploitability: critical exploitable issues get days, low-severity issues get quarters; exceptions require documented risk acceptance.

Contribution policy defines which projects employees may contribute to, who signs the CLA/DCO, and how upstream time is approved and tracked.

Community health and project sustainability are managed through maintainer funding, succession planning for critical dependencies, and monitoring of abandoned upstreams.

Metrics for OSPO reporting include component counts, license exception volume, mean time to remediate, contribution counts upstreamed, and percentage of dependencies with SBOM coverage.

Audit readiness requires retaining license texts, NOTICE files, SBOM snapshots, and approval records for every shipped release.

Open source is defined operationally by the OSI Open Source Definition's ten criteria: free redistribution, source code, derived works, integrity of the author's source code, no discrimination against persons or groups, no discrimination against fields of endeavor, distribution of license, license must not be specific to a product, license must not restrict other software, and license must be technology-neutral.

The Free Software Foundation's four freedoms are: run the program for any purpose, study and change it (source access required), redistribute copies, and distribute modified versions; copyleft licenses enforce these downstream, permissive licenses do not.

Free software and open source describe overlapping license sets with different philosophies; a license can be FSF-free and OSI-approved (e.g., GPL, MIT), so treat the terms as distinct labels, not synonyms.

The cathedral vs. bazaar distinction (Raymond) contrasts closed, release-gated development with open, frequent-release development; modern projects typically blend both, using maintainer review gates on public repositories.

A distributed version control workflow centers on fork, branch, commit, and pull/merge request; the upstream repository is the canonical source, and a fork is a server-side copy owned by the contributor.

Release artifacts should be traceable to a signed tag or commit hash; semantic versioning (MAJOR.MINOR.PATCH) signals breaking, additive, and fix-only changes respectively.

Governance models range from single-maintainer (BDFL) to meritocratic committer hierarchies to foundation-hosted projects (e.g., Apache Software Foundation, Linux Foundation); governance determines who merges and how disputes resolve.

Community health signals include contributor diversity, time-to-review, issue close rates, release cadence, and presence of a CODE_OF_CONDUCT, CONTRIBUTING, and SECURITY policy file.

Permissive licenses (MIT, BSD-2/3-Clause, Apache-2.0) allow proprietary redistribution when copyright notices are retained; copyleft licenses (GPL, LGPL, AGPL, MPL, EPL) impose source-disclosure or file-level reciprocity conditions.

GPL-2.0 and GPL-3.0 trigger source disclosure when you distribute binaries; GPL obligations attach to distribution, not to internal-only use, so private modifications used internally need not be published.

AGPL-3.0 extends copyleft to network use: offering the modified program as a service to remote users counts as conveyance and requires offering corresponding source.

LGPL allows linking with proprietary code if the LGPL component remains replaceable and its source plus relinking ability are provided; static linking raises stricter obligations than dynamic linking.

Apache-2.0 includes an express patent grant and a patent-retaliation clause; MIT and BSD contain no express patent grant, so patent risk must be assessed separately.

License compatibility is directional: Apache-2.0 code can generally be combined into GPL-3.0 works, but GPL-2.0-only code cannot be relicensed under GPL-3.0 or mixed into an Apache-2.0-only distribution without careful analysis.

SPDX license identifiers (e.g., Apache-2.0, GPL-2.0-only, MIT) and expressions using AND/OR/WITH are the standard machine-readable way to declare license obligations in SBOMs and package metadata.

Attribution duties typically require retaining copyright notices, license text, and NOTICE files (Apache-2.0) in distributions, including container images and bundled binaries.

A software bill of materials (SBOM) enumerates components, versions, and licenses; SPDX and CycloneDX are the dominant formats, and SBOMs support both license compliance and vulnerability response.

Dependency risk tiers: direct vs. transitive dependencies, runtime vs. build-only, and maintained vs. abandoned; transitive and unmaintained components carry the highest hidden risk.

Vulnerability data comes from sources like the NVD (CVE records with CVSS scores), GitHub Advisory Database, and OSV; CVSS base score alone does not determine exploitability in your context.

Package provenance controls include signed artifacts (Sigstore/cosign), checksum verification, and lockfiles pinning exact versions and hashes to prevent dependency confusion and typosquatting.

An approved-component intake process evaluates license, security history, maintenance activity, and support options before a library enters the internal catalog.

Container base images and vendored code are frequently overlooked consumption paths; scan them with the same policy as application dependencies.

End-of-life tracking matters: unsupported runtime versions stop receiving security patches, so consumption policy should define maximum component age and upgrade paths.

Before contributing, read CONTRIBUTING.md, the code of conduct, and the governance/decision process; contributions that skip the stated process are commonly closed without review.

A Developer Certificate of Origin (DCO) sign-off asserts you have the right to submit the code; a Contributor License Agreement (CLA) assigns or licenses rights to the project or foundation - they are different mechanisms and projects require one or the other.

Small, focused pull requests with tests and documentation changes are merged faster than large mixed changes; separate refactoring from behavior change.

Commit hygiene: atomic commits, imperative subject lines under ~72 characters, issue references, and signed commits where the project requires them.

Upstream-first contribution means fixing a bug in the upstream project rather than carrying a private patch; private forks accumulate maintenance debt and drift.

Contribution types beyond code include documentation, translations, triage, test coverage, design, and release testing; all are tracked in community metrics.

Review etiquette and responsiveness affect contributor reputation; maintainers may be volunteers, and unresolved review comments block merge regardless of code quality.

Corporate contribution requires employer approval and disclosure of conflicts; contributions made on company time may be subject to the employer's IP policy.

An Open Source Program Office (OSPO) centralizes policy, license review, SBOM generation, contribution approval, and community engagement; its scope is defined by a charter with decision rights.

Policy tiers typically classify licenses into approved, approved-with-conditions, and prohibited; automated CI checks (e.g., license scanners) enforce the classification at merge time.

Inventory and scanning tools (SCA scanners, container scanners, SBOM generators) feed a component catalog; scan results must map to a remediation SLA based on severity.

Remediation SLAs commonly key off CVSS severity and exploitability: critical exploitable issues get days, low-severity issues get quarters; exceptions require documented risk acceptance.

Contribution policy defines which projects employees may contribute to, who signs the CLA/DCO, and how upstream time is approved and tracked.

Community health and project sustainability are managed through maintainer funding, succession planning for critical dependencies, and monitoring of abandoned upstreams.

Metrics for OSPO reporting include component counts, license exception volume, mean time to remediate, contribution counts upstreamed, and percentage of dependencies with SBOM coverage.

Audit readiness requires retaining license texts, NOTICE files, SBOM snapshots, and approval records for every shipped release.

Open source is defined operationally by the OSI Open Source Definition's ten criteria: free redistribution, source code, derived works, integrity of the author's source code, no discrimination against persons or groups, no discrimination against fields of endeavor, distribution of license, license must not be specific to a product, license must not restrict other software, and license must be technology-neutral.

The Free Software Foundation's four freedoms are: run the program for any purpose, study and change it (source access required), redistribute copies, and distribute modified versions; copyleft licenses enforce these downstream, permissive licenses do not.

Free software and open source describe overlapping license sets with different philosophies; a license can be FSF-free and OSI-approved (e.g., GPL, MIT), so treat the terms as distinct labels, not synonyms.

The cathedral vs. bazaar distinction (Raymond) contrasts closed, release-gated development with open, frequent-release development; modern projects typically blend both, using maintainer review gates on public repositories.

A distributed version control workflow centers on fork, branch, commit, and pull/merge request; the upstream repository is the canonical source, and a fork is a server-side copy owned by the contributor.

Release artifacts should be traceable to a signed tag or commit hash; semantic versioning (MAJOR.MINOR.PATCH) signals breaking, additive, and fix-only changes respectively.

Governance models range from single-maintainer (BDFL) to meritocratic committer hierarchies to foundation-hosted projects (e.g., Apache Software Foundation, Linux Foundation); governance determines who merges and how disputes resolve.

Community health signals include contributor diversity, time-to-review, issue close rates, release cadence, and presence of a CODE_OF_CONDUCT, CONTRIBUTING, and SECURITY policy file.

Permissive licenses (MIT, BSD-2/3-Clause, Apache-2.0) allow proprietary redistribution when copyright notices are retained; copyleft licenses (GPL, LGPL, AGPL, MPL, EPL) impose source-disclosure or file-level reciprocity conditions.

GPL-2.0 and GPL-3.0 trigger source disclosure when you distribute binaries; GPL obligations attach to distribution, not to internal-only use, so private modifications used internally need not be published.

AGPL-3.0 extends copyleft to network use: offering the modified program as a service to remote users counts as conveyance and requires offering corresponding source.

LGPL allows linking with proprietary code if the LGPL component remains replaceable and its source plus relinking ability are provided; static linking raises stricter obligations than dynamic linking.

Apache-2.0 includes an express patent grant and a patent-retaliation clause; MIT and BSD contain no express patent grant, so patent risk must be assessed separately.

License compatibility is directional: Apache-2.0 code can generally be combined into GPL-3.0 works, but GPL-2.0-only code cannot be relicensed under GPL-3.0 or mixed into an Apache-2.0-only distribution without careful analysis.

SPDX license identifiers (e.g., Apache-2.0, GPL-2.0-only, MIT) and expressions using AND/OR/WITH are the standard machine-readable way to declare license obligations in SBOMs and package metadata.

Attribution duties typically require retaining copyright notices, license text, and NOTICE files (Apache-2.0) in distributions, including container images and bundled binaries.

A software bill of materials (SBOM) enumerates components, versions, and licenses; SPDX and CycloneDX are the dominant formats, and SBOMs support both license compliance and vulnerability response.

Dependency risk tiers: direct vs. transitive dependencies, runtime vs. build-only, and maintained vs. abandoned; transitive and unmaintained components carry the highest hidden risk.

Vulnerability data comes from sources like the NVD (CVE records with CVSS scores), GitHub Advisory Database, and OSV; CVSS base score alone does not determine exploitability in your context.

Package provenance controls include signed artifacts (Sigstore/cosign), checksum verification, and lockfiles pinning exact versions and hashes to prevent dependency confusion and typosquatting.

An approved-component intake process evaluates license, security history, maintenance activity, and support options before a library enters the internal catalog.

Container base images and vendored code are frequently overlooked consumption paths; scan them with the same policy as application dependencies.

End-of-life tracking matters: unsupported runtime versions stop receiving security patches, so consumption policy should define maximum component age and upgrade paths.

Before contributing, read CONTRIBUTING.md, the code of conduct, and the governance/decision process; contributions that skip the stated process are commonly closed without review.

A Developer Certificate of Origin (DCO) sign-off asserts you have the right to submit the code; a Contributor License Agreement (CLA) assigns or licenses rights to the project or foundation - they are different mechanisms and projects require one or the other.

Small, focused pull requests with tests and documentation changes are merged faster than large mixed changes; separate refactoring from behavior change.

Commit hygiene: atomic commits, imperative subject lines under ~72 characters, issue references, and signed commits where the project requires them.

Upstream-first contribution means fixing a bug in the upstream project rather than carrying a private patch; private forks accumulate maintenance debt and drift.

Contribution types beyond code include documentation, translations, triage, test coverage, design, and release testing; all are tracked in community metrics.

Review etiquette and responsiveness affect contributor reputation; maintainers may be volunteers, and unresolved review comments block merge regardless of code quality.

Corporate contribution requires employer approval and disclosure of conflicts; contributions made on company time may be subject to the employer's IP policy.

An Open Source Program Office (OSPO) centralizes policy, license review, SBOM generation, contribution approval, and community engagement; its scope is defined by a charter with decision rights.

Policy tiers typically classify licenses into approved, approved-with-conditions, and prohibited; automated CI checks (e.g., license scanners) enforce the classification at merge time.

Inventory and scanning tools (SCA scanners, container scanners, SBOM generators) feed a component catalog; scan results must map to a remediation SLA based on severity.

Remediation SLAs commonly key off CVSS severity and exploitability: critical exploitable issues get days, low-severity issues get quarters; exceptions require documented risk acceptance.

Contribution policy defines which projects employees may contribute to, who signs the CLA/DCO, and how upstream time is approved and tracked.

Community health and project sustainability are managed through maintainer funding, succession planning for critical dependencies, and monitoring of abandoned upstreams.

Metrics for OSPO reporting include component counts, license exception volume, mean time to remediate, contribution counts upstreamed, and percentage of dependencies with SBOM coverage.

Audit readiness requires retaining license texts, NOTICE files, SBOM snapshots, and approval records for every shipped release.