FOSS Contribution Guidance Catalog
Machine-readable guidance for employee FOSS contribution, adapted from the human-readable guidelines (source).
Exemptions
These guidelines do not introduce or change established requirements for the introduction and consumption of free and open source software.
Governance
OSPO oversight, approval, and program governance for FOSS contribution.
foss-guidance-program-objectiveFOSS Contribution Program Objective
Support employee contribution and publication of FOSS when it benefits the company and does not present unacceptable risk.
foss-guidance-ospo-governanceOpen Source Program Office Governance
Ensure FOSS contribution strategy and governance are established, evolved, and executed under OSPO oversight.
foss-guidance-ospo-governance.1The procedures and governance processes described in these guidelines are overseen by the Chair of the Open Source Program Office.
foss-guidance-ospo-governance.2The OSPO is responsible for establishing, evolving, and executing FOSS contribution strategy and governance under the direction of the guidelines owner.
Taxonomy and Scope
Classification of contribution activity and applicability boundaries.
foss-guidance-project-categoriesFOSS Project Categories
Classify every employee FOSS contribution into one of four project categories and apply the corresponding requirements.
foss-guidance-project-categories.company-moderatedCompany ModeratedOpen-source projects initiated by the company where the company acts as the primary project moderator or maintainer.
foss-guidance-project-categories.company-interest-majorCompany Interest (Major)Projects consumed in company applications where the company wishes to influence direction or contribute significant functionality.
foss-guidance-project-categories.company-interest-minorCompany Interest (Minor)Projects consumed in company applications where the company benefits from small employee contributions such as enhancements and bug fixes.
foss-guidance-project-categories.personal-contributionPersonal ContributionContribution conducted outside regular company-contracted activities to projects that are not company moderated or company interest and provide no benefit to the company.
foss-guidance-personal-contributionPersonal Contribution Conditions
Define conditions under which employees may contribute to FOSS in a personal capacity.
foss-guidance-personal-contribution.1The FOSS project must not be registered as company moderated or company interest in the FOSS inventory.
foss-guidance-personal-contribution.2Personal contributions must not conflict with the code of conduct, represent a conflict of interest, leverage company intellectual property, or represent the contributor as a company employee.
foss-guidance-personal-contribution.3Personal contributions must not be made from company-owned hardware or infrastructure and must not use a company-associated identity.
Infrastructure and Tooling
Where and how contribution activity may be performed.
foss-guidance-company-infrastructureCompany Infrastructure Use
Define where company-moderated, company-interest, and personal contributions may be performed.
foss-guidance-company-infrastructure.1Company moderated and company interest FOSS contribution activities may be performed within or outside of the company network.
foss-guidance-company-infrastructure.2Personal FOSS contributions must be performed outside the company network using non-company managed hardware.
foss-guidance-company-infrastructure.3External infrastructure used to host company moderated projects must be approved by the OSPO.
foss-guidance-standard-toolsOSPO Standard Tools and Scanning
Use OSPO-approved tools and compliance scanning when contributing from company infrastructure or managed hardware.
foss-guidance-standard-tools.1Preventative and detective internal controls must address the risks described in FOSS contribution risk guidance.
foss-guidance-standard-tools.2Company moderated and company interest activities on company network or hardware must use OSPO approved standard tools.
foss-guidance-standard-tools.3Contribution activity from company network or managed hardware must be subject to compliance scanning and review for license compliance, maker-checker separation, sensitive data disclosure, copyright text, and export regulations.
- Company moderated projects must use an OSPO approved source code management tool.
foss-guidance-peer-reviewPeer Review and Maker-Checker Controls
Maintain evidence of peer review and separation of duties for governed contributions.
foss-guidance-peer-review.1Company moderated projects must maintain transaction history showing peer review, approver, and approval date.
foss-guidance-peer-review.2Where company controls apply, peer reviewer and contributor must not be the same person.
Compliance and Regulatory Alignment
Alignment with legal, export, data-flow, and company policy obligations.
foss-guidance-foss-identityFOSS Contributor Identity
Ensure contributor identity on public FOSS platforms is appropriate to the project category.
foss-guidance-foss-identity.1Contributors to company moderated and company interest projects must identify contributions using their company external email address while employed at the company.
foss-guidance-foss-identity.2Contributors must not use company internal email addresses or internal usernames for company-associated contributions.
foss-guidance-foss-identity.3On cessation of employment, contributors must not tag commits with their company email.
foss-guidance-information-classificationInformation Classification for Publication
Review and approve company moderated and company interest contributions before transmitting material out of the company network.
foss-guidance-information-classification.1Contributions must be associated to an inventoried FOSS project registered in the OSPO FOSS inventory.
foss-guidance-information-classification.2Contributions containing material non-public information, non-standard cryptography, or non-standard authentication mechanisms must be remediated before approval.
foss-guidance-export-controlTechnology Export Regulations Compliance
Ensure FOSS projects and contributions involving export-sensitive functionality receive appropriate review.
foss-guidance-export-control.1Company moderated and company interest projects providing or performing non-standard cryptography must be reviewed prior to OSPO approval.
foss-guidance-export-control.2Company staff participating in FOSS contribution activities must comply with local export regulations.
foss-guidance-ip-reviewIntellectual Property Review
Review contributions for intellectual property, patent, trademark, and competing-interest concerns before contribution begins.
foss-guidance-ip-review.1Contribution requests must include intellectual property and competing interest review and determine whether trademark or patent applications are needed in advance.
foss-guidance-ip-review.2Company interest minor projects may not be used to publish company patentable or trademarked contributions.
foss-guidance-vulnerability-reportingVulnerability Reporting Instructions
Ensure company moderated projects publish instructions for reporting security vulnerabilities.
foss-guidance-vulnerability-reporting.1Company moderated project teams must define and document OSPO approved instructions describing how to report security vulnerabilities in the project.
Engagement Lifecycle
Registration, maintenance, risk review, and retirement of FOSS engagements.
foss-guidance-inventory-registrationFOSS Inventory Registration
Register company moderated and company interest contribution activity in an OSPO-approved inventory system.
foss-guidance-inventory-registration.1Company moderated and company interest FOSS contribution activity must be registered in an OSPO approved inventory system.
foss-guidance-license-inventoryFOSS License Inventory and Management
Maintain an auditable inventory of FOSS licenses approved for contribution activity.
foss-guidance-license-inventory.1The OSPO must maintain an inventory of FOSS licenses approved for contribution activity by company contributors.
foss-guidance-license-inventory.2The inventory must provide an auditable workflow of legal review and business approval or rejection detailing permissions, conditions, and limitations.
foss-guidance-ospo-project-approvalOSPO Project Review and Approval
Require OSPO review and approval before company moderated and company interest major contributions proceed.
foss-guidance-ospo-project-approval.1FOSS projects must be reviewed and approved by the OSPO before contributions can be made.
foss-guidance-ospo-project-approval.2Company contributions are prohibited when the OSPO withdraws approval or the FOSS project is retired or archived.
foss-guidance-ospo-project-approval.3OSPO review does not apply to personal contributions.
foss-guidance-minor-project-accessCompany Interest Minor Project Access
Govern employee access to contribute to company interest minor projects.
foss-guidance-minor-project-access.1Access requests must be submitted and recorded using an OSPO-approved tool and classified as company interest minor.
foss-guidance-minor-project-access.2The requestor's line manager must approve the access request and confirm the project is approved for company use and beneficial to the company.
foss-guidance-minor-project-access.3Explicit OSPO approval is not required when the product and license are already approved in official inventories.
foss-guidance-engagement-maintenanceFOSS Engagement Maintenance and Recertification
Monitor engagements for risk changes and recertify access at least annually.
foss-guidance-engagement-maintenance.1Administrators must monitor engagements for inactive projects, license changes, cross-border impacts, and export regulation changes.
foss-guidance-engagement-maintenance.2FOSS engagements and access requests must be reviewed or recertified at least annually.
foss-guidance-engagement-maintenance.3Project access requests for company interest minor projects must be recertified at least annually and licenses validated regularly.
foss-guidance-risk-change-managementRisk Change Management
Record and review material changes in FOSS project risk.
foss-guidance-risk-change-management.1Potential changes in risk must be captured in the FOSS inventory upon identification and reviewed by OSPO or relevant SMEs.
foss-guidance-risk-change-management.2Disposition and actions taken for risk changes must be recorded in the FOSS inventory.
foss-guidance-project-retirementProject Transition and Retirement
Transition, archive, or decommission FOSS engagements when they are no longer approved or active.
foss-guidance-project-retirement.1Disengagement from a FOSS project, foundation, or community must be reviewed and approved by the OSPO.
foss-guidance-project-retirement.2Retired or archived projects must have contribution entitlements removed from OSPO-approved tooling on the agreed effective date.
foss-guidance-project-retirement.3FOSS contribution projects and access requests must be decommissioned within three months of project retirement or removal from the official product inventory.
Roles and Enablement
Roles, training, and support structures for FOSS contribution.
foss-guidance-legal-supportLegal Support for FOSS Contribution
Engage legal review when license, contributor agreement, or obligation questions arise.
foss-guidance-legal-support.1The legal department's role is advisory to the OSPO when adding licenses, when licenses change, or when CLA, CCLA, DCO, or similar agreements require review.
foss-guidance-trainingFOSS Contribution Training
Ensure employees participating in FOSS contribution activities complete annual training appropriate to their role.
foss-guidance-training.1Company staff participating in FOSS contribution activities must complete an annual training class demonstrating knowledge of these guidelines and associated governance.
foss-guidance-roles-responsibilitiesRoles and Responsibilities
Define accountable roles for FOSS contribution governance across project categories.
foss-guidance-roles-responsibilities.ospoOpen Source Program OfficeCommittee responsible for maintaining the open source contribution guidelines across company moderated, company interest major, and company interest minor projects.
foss-guidance-roles-responsibilities.line-managerLine ManagerApprover of company interest minor FOSS contribution access requests via OSPO tooling.
foss-guidance-roles-responsibilities.maintainerFOSS Project Moderator or MaintainerEnsures the community adheres to the OSPO approved code of conduct and formal contribution processes.
foss-guidance-roles-responsibilities.sponsorFOSS SponsorSponsors the project including business case, budget approval, and IP review.
foss-guidance-roles-responsibilities.administratorFOSS Project AdministratorEnsures control requirements are met and evidenced for assigned FOSS projects.