Running an Open Source Compliance Program: A Practitioner's Guide to Inventory, Policy, Review, and Remediation
By Casey Scott McKay ·
This guide is the operational half of the Marksy article on open source licensing, and it assumes you know why license conditions are enforceable as copyright conditions and why AGPL is different from GPL. It builds a working compliance program in fifteen stages, beginning with the inventory that tells you what you are actually shipping and ending with the metrics that show whether the program works. Its organizing principle is that compliance has to operate at the dependency-addition moment rather than at release review, because by release the architectural decisions are made and reversing them costs a thousand times more. It supplies a three-tier license policy with an allowlist, a review-list, and a blocklist, a dependency gate that runs in the existing build tooling, a notices file and corresponding-source workflow, an SBOM program that serves compliance and security at once, remediation sequences for the four findings that actually matter, and response playbooks for a compliance letter, a customer security review, and an acquisition diligence request.
IP and Technology > Information Technology | Guide | Published 3 December 2024 - Updated 9 January 2025 | Casey Scott McKay - marksy.us
Summary. This guide is the operational half of the Marksy article on open source licensing, and it assumes you know why license conditions are enforceable as copyright conditions and why AGPL is different from GPL. It builds a working compliance program in fifteen stages, beginning with the inventory that tells you what you are actually shipping and ending with the metrics that show whether the program works. Its organizing principle is that compliance has to operate at the dependency-addition moment rather than at release review, because by release the architectural decisions are made and reversing them costs a thousand times more. It supplies a three-tier license policy with an allowlist, a review-list, and a blocklist, a dependency gate that runs in the existing build tooling, a notices file and corresponding-source workflow, an SBOM program that serves compliance and security at once, remediation sequences for the four findings that actually matter, and response playbooks for a compliance letter, a customer security review, and an acquisition diligence request.
Keywords: open source policy · license allowlist · dependency gate · composition analysis scan · sbom generation · spdx cyclonedx · notices file generation · corresponding source offer · agpl remediation · architectural separation · contributor license agreement · outbound contribution policy · m&a open source diligence · customer security review · compliance letter response · license exception workflow · generated code provenance · engineering adoption · program metrics
This is premium Marksy content — the full document is available to subscribers.