Certified Open Source Developer for Enterprise flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

OSI Open Source Definition

Ten criteria a license must meet to be OSI-approved, including free redistribution, available source code, permitted derived works, and no discrimination against persons, groups, or fields of endeavor.

Four Freedoms

FSF freedoms to run, study and modify, redistribute copies, and distribute modified versions. Copyleft licenses require downstream users to receive the same freedoms.

Copyleft versus permissive

Copyleft licenses require derivative distributions to keep the same license and disclose source. Permissive licenses allow relicensing of derivatives, typically requiring only notice retention.

Fork and pull request

A fork is a server-side copy of an upstream repository. A pull request proposes commits from a branch to be reviewed and merged by maintainers.

Semantic versioning

Version format MAJOR.MINOR.PATCH. MAJOR increments signal breaking changes, MINOR signals backward-compatible features, PATCH signals backward-compatible fixes only.

BDFL governance

Benevolent Dictator For Life model where one founder holds final decision authority. Common in small projects; foundation governance replaces it as projects grow.

Meritocratic governance

Contributors earn commit rights and voting influence through sustained contribution. Apache Software Foundation projects use this committer and PMC structure.

SPDX license identifiers

Standard short strings naming licenses, such as MIT, Apache-2.0, or GPL-2.0-only. Expressions combine them with AND, OR, and WITH for exceptions.

GPL distribution trigger

GPL obligations apply when binaries are distributed to others, not to purely internal use. Internal-only modifications need not be published externally.

AGPL network clause

AGPL-3.0 treats offering the program to remote users over a network as conveyance, requiring the operator to offer corresponding source to those users.

LGPL linking conditions

LGPL permits proprietary linking if users can replace the LGPL component. Dynamic linking is simpler; static linking requires providing object files or relinking ability.

Apache-2.0 patent grant

Apache-2.0 grants an express patent license from contributors and terminates it for anyone who sues over the software. MIT and BSD lack such a grant.

License compatibility direction

Compatibility is one-way. Apache-2.0 code can go into GPL-3.0 works, but GPL-2.0-only code cannot be relicensed under GPL-3.0.

NOTICE file obligation

Apache-2.0 requires redistributors to include the NOTICE file contents alongside the license text and attribution notices in distributed artifacts.

MPL file-level copyleft

Mozilla Public License requires disclosing source of modified MPL-covered files only. Larger works combining those files may remain under other licenses.

Software bill of materials

Machine-readable inventory of components, versions, and licenses in a product. SPDX and CycloneDX are the dominant formats used for compliance and vulnerability response.

Transitive dependency risk

Libraries pulled in indirectly by direct dependencies. They are often unvetted, harder to patch, and a frequent source of hidden license and vulnerability exposure.

CVSS base score limits

CVSS rates intrinsic severity, not exploitability in your environment. Reachability, configuration, and compensating controls determine actual risk and remediation priority.

Dependency confusion attack

Attacker publishes a malicious package under an internal package name to a public registry. Pinning versions and scoping registries mitigates it.

Lockfile purpose

Records exact resolved versions and integrity hashes for reproducible installs. Prevents silent upgrades and detects tampered or substituted packages.

Component intake review

Gate before adopting a library: check license, security history, maintenance activity, release cadence, and support options. Result is an approved or rejected catalog entry.

End-of-life components

Versions no longer receiving security patches. Consumption policy should define maximum component age and a documented upgrade path for unsupported runtimes.

Developer Certificate of Origin

Per-commit sign-off stating the contributor has the right to submit the code under the project license. Used by Linux kernel and many projects instead of a CLA.

Contributor License Agreement

Legal agreement granting or assigning rights to the project or foundation. Differs from DCO sign-off; some foundations require it before accepting contributions.

Upstream-first contribution

Fixing defects in the originating project rather than carrying private patches. Reduces fork drift and long-term maintenance cost for the consumer.

Contribution hygiene

Atomic commits, focused pull requests, tests and docs included, issue references, and signed commits where required. Improves review speed and merge likelihood.

Non-code contributions

Documentation, translation, triage, testing, design, and community support. Tracked in community metrics and often the fastest path to maintainer trust.

Corporate contribution approval

Employer review before contributing on company time, covering IP ownership, CLA authority, and conflict disclosure. Prevents unauthorized license or patent commitments.

Open Source Program Office

Central function owning license policy, SBOM and scanning, contribution approval, and community engagement. Its charter defines decision rights across engineering and legal.

License policy tiers

Classification of licenses as approved, conditionally approved, or prohibited. Automated CI scanners enforce the tier at merge time and flag exceptions for review.

Remediation SLA by severity

Time limits for fixing vulnerabilities keyed to severity and exploitability. Critical exploitable issues get days; low severity gets quarters, with documented risk acceptance for exceptions.

OSPO reporting metrics

Measures such as component counts, license exceptions, mean time to remediate, upstreamed contributions, and SBOM coverage. Used to show program effectiveness and audit readiness.