Open Source Fundamentals and Governance in Financial Services
Open Source Fundamentals and Governance in Financial Services
This domain tests whether you can reason about licenses, governance, and contribution mechanics as they apply inside a regulated firm - not just recite license names.
Core rules
- The OSI definition requires free redistribution, source code, derived works, and no discrimination against persons or fields of use. A public repository without a license is not open source; default copyright reserves all rights.
- Permissive licenses (MIT, BSD-2/3, Apache-2.0) allow proprietary redistribution but differ: Apache-2.0 includes an express patent grant, trademark and notice requirements; MIT does not.
- Copyleft licenses (GPL, LGPL, AGPL) impose reciprocity. AGPL's network clause can trigger obligations when users interact remotely, which matters for SaaS.
- Governance ranges from foundation-hosted meritocracy to single-vendor projects. Contribution terms are usually a CLA or DCO; a CLA is often a license grant, not a copyright assignment.
- SPDX identifiers and license headers make obligations machine-readable; compatibility analysis must happen before combining code.
Worked example
A team wants to combine an Apache-2.0 library with GPLv2-only code and ship the result. Apache-2.0 is compatible with GPLv3 but not GPLv2-only because of additional patent and indemnity conditions. The correct answer is not 'both are open source, so it is fine'; it is that the combined distribution is license-incompatible unless the GPLv2 code is used under a compatible exception or the Apache code is replaced.
Traps
- Treating 'free to use' as 'no obligations.'
- Assuming MIT includes a patent grant.
- Forgetting that AGPL can reach network services.
- Confusing a CLA with copyright assignment.
- Ignoring NOTICE and trademark terms in Apache-2.0.