Guide
Evaluate an open-source package
Before adding an open-source package, inspect both its technical fit and the conditions under which it can be used.
At a glance
- Permission evidence
- The project's actual license
- Technical evidence
- Documentation, releases, and a relevant local trial
Overview
Before adding an open-source package, inspect both its technical fit and the conditions under which it can be used. A public repository is a starting point for evaluation, but public visibility alone does not establish a license or guarantee that the project meets an application's needs.
1. Identify the project and license
Follow the official project links and read the repository's license file. Check that the package being installed corresponds to that project; an accessible source repository is not itself a complete statement of reuse permissions.
2. Test the required behavior
Read documentation for the version being considered and try the smallest workflow needed by your application. Include the relevant failure condition rather than evaluating only a successful demonstration.
3. Record the decision
Record the selected version, the reason for using it, and any operational or license questions that remain. Keep the dependency choice reviewable so a later update does not depend on undocumented assumptions.
Sources and review
MOOR's explanatory text is supported by the following source links.
- The Open Source Definition — Open Source Initiative
- Licensing a repository — GitHub