Requesting Initial Feedback for Questionnaire related to ingesting 3rd party objects

[OBWANDO]

Third Party OSS Dependency Proposal

1. What is the project that hosts the third party OSS? Where is the code?

[Provide the name of the project and a link]


[Provide a link to the source]

2. What license is the software under?

[Provide a copy of the license and a link to the projects license policy (both, not just a link).]

3. What does the software do?

[The intent of the following questions is to allow the TSC to discuss suitability of the software package to solve the problem at hand. It is possible that there is a better package available.]


**What is its primary functionality? **


[e.g. SQLite is a lightweight database.]


**What problem are you trying to solve?**


[e.g. a state store is required to maintain…]


**Why is this the right software to solve it?**


[e.g. because SQLite is small, easy to use, and has a very liberal license.]

4. Is the third party software going to create a developer dependency or a project dependency?

Will the project’s open source code have a direct dependency on the third-party code, or will it be included via an abstraction layer?

[Creating an abstraction allows members to replace the third-party dependency with a more desirable implementation.]

5. Does the third party software have any security policies that may be of concern?

Sample Process flow below:

If not an abstraction layer, which approach to inclusion is taken?

1. Will the Project use the library and header files from the upstream project (“UP”)?
    1. YES: 	**DONE**
    2. NO: 	Is the project team willing to support automatically downloading the UP software at build time?
        1. YES: 	**DONE**
        2. NO:  	Is the project team willing to require downstream builders to download, build and install the UP software themselves?
            1. YES: 	**DONE**
            2. NO:	Will the UP software be directly imported into the project’s code repository?
                1. YES:	Will the project team monitor the UP  software update the project’s code repository for bug fixes, security problems and re-integration when new versions of the UP software are made available? 
                    1. YES:	**DONE**
                    2. NO:	**The UP software cannot be used**.

[jeremyong-az]

Legal followup:

Is there a designated location needed to provide attribution for licenses that require it?

Are there certain licenses that require additional approval or feedback from LF?

[jeremyong-az]

@OBWANDO Another question that has come up. For developer-only tools/sdks that have license agreements, can we get guidance from the LF on what the requirements are? e.g. We can add a link to the license agreement in a script and a prompt asking the user to accept the terms. Examples include:

Vulkan SDK
Agility DX12 SDK
WinPixEventRuntime
etc.

[jeremyong-az]

@OBWANDO I've added links to the actual licenses in question