Dependencies, Licences and the Supply Chain · seed 1 · A4, ink-friendly. The answer key prints on its own page for grown-ups.

What your code depends on

Computing · Software Engineering · ages 21-22
Name ______________________   Date ____________

  1. What does a copyleft licence require when you ship a project built on the code?

    • You pay the original authors a fee
    • You delete the library before release
    • You share your changes under the same terms

  2. In a dependency tree, what is a package nobody on the team chose directly?

    • A direct dependency
    • A transitive dependency
    • A pinned version

  3. A team should keep a replacement in mind for a dependency whose updates have stalled.

    Circle one:   True   False

  4. Your team ships an app linked against a copyleft library and keeps its own code closed. What must change?

    • Nothing, shipping is always fine
    • Open your code under the same terms or replace the library
    • Pay for a licence after release

  5. Your tree shows the app picks chart-lib, and chart-lib picks date-help and color-mix. Which packages did the team choose directly?

    • chart-lib only
    • date-help and color-mix
    • All three packages

  6. A key dependency has had no commits for a year and ignores bug reports. What is the team's best next move?

    • Pin the version and line up a replacement
    • Delete it from the project today
    • Wait silently for the maintainer

  7. Your team ships a closed product and must choose between a permissive and a copyleft library. Which fits?

    • Either, the terms work out the same
    • The copyleft one, then keep the product closed
    • The permissive one, which asks only for credit

  8. A teammate says the project has three dependencies because the team picked three libraries. What is wrong?

    • The tree holds transitive packages too, so three understates it
    • Picked libraries never count as dependencies
    • Trees only list abandoned packages
LightMySky · lightmysky.comW1-mt_2kilqPb0aV-s1

Answer key

For grown-ups. Fold this page away before handing over the rest.

What your code depends on W1-mt_2kilqPb0aV-s1

  1. You share your changes under the same terms · Copyleft trades use for openness: ship it, and your changes stay under the same terms.
  2. A transitive dependency · It arrived through another package, so it is transitive.
  3. True · Stalled updates can mean abandonment, and a plan made early is cheap.
  4. Open your code under the same terms or replace the library · Copyleft terms cover shipping, so you comply by sharing alike or by removing the dependency.
  5. chart-lib only · Only chart-lib was picked; the other two arrived with it.
  6. Pin the version and line up a replacement · Pinning buys safety while a replacement plan removes the panic.
  7. The permissive one, which asks only for credit · Permissive terms fit a closed product; copyleft would demand the product code be shared.
  8. The tree holds transitive packages too, so three understates it · Each picked library brings its own helpers, so the true count is larger.
Worksheet · LightMySky