FOSS Contribution Capabilities Catalog
Capabilities that create the attack surface for employee FOSS contribution (source).
Public Publication
Capabilities that publish company-associated material to publicly accessible FOSS platforms.
public-source-publicationPublic Source Publication
Ability to publish source code, configuration, or build artifacts to publicly accessible FOSS repositories or collaboration platforms.
cryptographic-software-contributionCryptographic Software Contribution
Ability to publish software that implements or incorporates cryptography, authentication mechanisms, or export-sensitive functionality to public FOSS projects.
Legal Commitment
Capabilities that create license grants, contributor obligations, or other legal commitments through FOSS participation.
perpetual-license-grantPerpetual License Grant Through Contribution
Ability to grant perpetual, royalty-free rights to consumers of a FOSS project by contributing software under an open source license.
contributor-agreement-acceptanceContributor Agreement Acceptance
Ability to accept Contributor License Agreements, Corporate CLAs, Developer Certificates of Origin, or similar contribution agreements on behalf of or as a company employee.
Contribution Infrastructure
Capabilities governing where and how FOSS contribution activity is performed.
company-attributed-identityCompany-Attributed Public Identity
Ability to represent contribution activity using a company-associated public identity such as a company external email address.
company-infrastructure-contributionCompany Infrastructure Contribution
Ability to perform FOSS contribution activity from the company network or on company-managed hardware using company-approved tooling.
personal-infrastructure-contributionPersonal Infrastructure Contribution
Ability to perform personal FOSS contribution activity outside the company network on non-company-managed hardware.
Governance and Engagement
Capabilities for registering, approving, reviewing, and engaging with FOSS projects and communities.
cross-border-collaborationCross-Border FOSS Collaboration
Ability to participate in globally distributed FOSS communities, repositories, and working groups across national boundaries.
community-engagementPublic Community Engagement
Ability to participate in public FOSS community meetings, forums, mailing lists, and other collaboration channels.
project-inventory-registrationFOSS Project Inventory Registration
Ability to register, classify, and maintain FOSS project engagement records in an OSPO-approved inventory system.
reviewed-contributionReviewed Contribution Submission
Ability to submit contributions through a source code management workflow that records review, approver identity, and approval date.