Dependencies, licences and the supply chain · seed 1 · A4, ink-friendly. The answer key prints on its own page for grown-ups.
به انگلیسی

What your code depends on

Computing · Software Engineering · ages 21-22
Name ______________________   Date ____________
  1. A fictional copyleft licence says distributing a modified covered library requires providing its source under the same terms. The team distributes that modified library. Which action meets this stated duty?

    • Pay a fee instead of providing source
    • Provide only the app's release notes and keep every modified library source file private
    • Provide the modified library source under the stated terms
  2. An app directly chooses draw-kit. Draw-kit needs font-data, which the app does not declare directly. What is font-data's relationship to the app?

    • A direct dependency of the app
    • A transitive dependency via draw-kit
    • A version pin selecting draw-kit's release without adding a package
  3. A team should assess support and replacement options when a needed dependency's updates stall.

    Circle one:   True   False

  4. A team plans to distribute a closed app linked with a library described only as copyleft. The exact terms have not been checked. What must happen before deciding whether this release is permitted?

    • Release it closed without checking the licence
    • Check the exact licence against the planned linking and release
    • Publish all app source because every copyleft licence covers the entire app
  5. The app directly declares chart-tool. Chart-tool declares date-tool and color-tool. The app declares neither helper directly. Which packages are direct dependencies of the app?

    • chart-tool only; the app declares one package directly
    • date-tool and color-tool; both are dependencies of chart-tool
    • All three packages; direct and transitive packages count as direct
  6. A maintainer confirms that support has ended for a needed package. It has unresolved bugs. No urgent security issue has been identified. Which next step addresses the loss of support?

    • Assess risk, test a supported replacement and plan migration
    • Keep the pinned version and treat its unresolved bugs as fixed
    • Remove the package now without testing the features that depend on it
  7. Fictional Rule A permits a closed app if required notices are kept. Rule B requires source for the entire combined app when distributed. A team will distribute a closed app and keep notices, but will not share source. Which rule fits these stated conditions?

    • Either rule, because kept notices replace any source duty
    • Rule B, because keeping notices also meets its source duty
    • Rule A, while keeping all the notices it requires
  8. An app directly declares alpha, beta and gamma. Alpha and beta both need the same shared-helper package. Gamma needs no packages, and there are no other dependencies. How many distinct dependency packages does the app have?

    • Four: three direct packages and one shared helper
    • Five: count the shared helper on both paths
    • Three: count only the packages directly declared by the app
LightMySky · lightmysky.comW1-mt_2kilqPb0aV-s1

Answer key

For grown-ups. Fold this page away before handing over the rest.

What your code depends on W1-mt_2kilqPb0aV-s1

  1. Provide the modified library source under the stated terms · The prompt states the trigger, covered code and duty. Distributing the modified library triggers this fictional requirement to provide its source under the same terms.
  2. A transitive dependency via draw-kit · The app reaches font-data through draw-kit rather than declaring it directly. Font-data is transitive in this graph.
  3. True · Stalled updates justify checking support and risk. The assessment may lead to replacement or maintenance work; inactivity alone does not prove abandonment.
  4. Check the exact licence against the planned linking and release · A licence label alone does not establish permissions or duties. Check the exact licence and version against the planned linking and distribution before deciding.
  5. chart-tool only; the app declares one package directly · Only chart-tool is declared directly by the app. Both helpers are reached through chart-tool.
  6. Assess risk, test a supported replacement and plan migration · Confirmed loss of support calls for risk assessment and planned replacement or maintenance. Pinning does not fix bugs, and untested removal can break dependent features.
  7. Rule A, while keeping all the notices it requires · The plan meets Rule A's stated conditions. It does not meet Rule B's source requirement. These fictional rules do not represent every permissive or copyleft licence.
  8. Four: three direct packages and one shared helper · There are three direct packages and one other distinct package. Shared-helper is reached by two paths but counts once, giving four.
Worksheet · LightMySky