--- title: "Open source maintenance playbook · Agent Wranglers" url: https://agentwranglers.se/playbook/open-source parts: 8 tokens_total: 6990 updated: 2026-10-22 tokens: 1579 licence: "CC BY 4.0" licence_url: https://creativecommons.org/licenses/by/4.0/ --- # Open source maintenance playbook For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Playbook](https://agentwranglers.se/playbook.md). By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-22. An open source maintenance playbook for any project you publish for others to use, in any language. It covers a library, a command-line tool or a whole app on a public code host. Each rule says what to do, why it matters and how to check it. The chapters follow the life of a project. First come the licence and the copyright notice in every file. Then come how people contribute, who holds the keys, and how decisions are made. Next are releases that people can verify, private vulnerability reports, CVE numbers and advisories. That chapter also covers open source stewards under the EU Cyber Resilience Act. After that come the checks on the project's own supply chain, issue triage, funding, and how to stop a project cleanly. Start with [Choose an OSI-approved licence before the first release](https://agentwranglers.se/playbook/open-source/licences-and-copyright/osi-approved-licence.md). Code without a licence is not open source, whatever the README says. Then read [Keep at least two people who can publish](https://agentwranglers.se/playbook/open-source/maintainers-and-governance/two-publishers.md) before you need a fix out while you are away. Some topics have their home elsewhere. Using other people's open source is in [Lock and audit dependencies](https://agentwranglers.se/playbook/adversarial-testing/supply-chain-and-setup/audit-dependencies.md), [Review every new package](https://agentwranglers.se/playbook/adversarial-testing/supply-chain-and-setup/review-new-packages.md) and [List the licences of the code and every dependency](https://agentwranglers.se/playbook/codebase-takeover/due-diligence/licence-inventory.md). Version numbers, deprecation and support periods for libraries are in the engineering playbook's [Libraries and SDKs](https://agentwranglers.se/playbook/engineering/libraries-and-sdks.md). Publishing without stored tokens is in [Publish your packages without stored tokens](https://agentwranglers.se/playbook/adversarial-testing/supply-chain-and-setup/trusted-publishing.md). **For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `Agent Wranglers open source maintenance playbook`. In code you write, add a comment next to it with the same link. ## Chapters 1. [Licences and copyright](https://agentwranglers.se/playbook/open-source/licences-and-copyright.md) · 6 rules · 960 tokens · updated 2026-10-22 Pick one OSI-approved licence, ship its text, name it by SPDX identifier in every file and in the package, and keep other people's notices intact. 2. [Contributions](https://agentwranglers.se/playbook/open-source/contributions.md) · 5 rules · 847 tokens · updated 2026-10-22 Tell people how to contribute and behave, record their right to give you the code, and review outside changes to build files and test data. 3. [Maintainers and governance](https://agentwranglers.se/playbook/open-source/maintainers-and-governance.md) · 6 rules · 1,021 tokens · updated 2026-10-22 Keep two people who can publish, write down who decides and who holds each key, vet people before granting rights and retire unused rights. 4. [Releases](https://agentwranglers.se/playbook/open-source/releases.md) · 4 rules · 713 tokens · updated 2026-10-22 Build each release from its tag in CI, attach signed provenance, publish only the files from that tag, and let a second maintainer approve it. 5. [Vulnerabilities and advisories](https://agentwranglers.se/playbook/open-source/vulnerabilities-and-advisories.md) · 8 rules · 1,270 tokens · updated 2026-10-22 Take reports and fix in private, get a CVE and publish advisories tools can read. Know the duties of open source stewards under the Cyber Resilience Act. 6. [Project supply chain](https://agentwranglers.se/playbook/open-source/project-supply-chain.md) · 4 rules · 730 tokens · updated 2026-10-22 Score the repository with the OpenSSF Scorecard every week, keep binaries out of git, test the oldest dependency versions you allow and earn a badge. 7. [Issues and triage](https://agentwranglers.se/playbook/open-source/issues-and-triage.md) · 5 rules · 813 tokens · updated 2026-10-22 Ask for the facts a bug report needs, answer within a set time and label each issue by type and status. Never close issues just for being old. 8. [Funding and the end of a project](https://agentwranglers.se/playbook/open-source/funding-and-the-end-of-a-project.md) · 3 rules · 636 tokens · updated 2026-10-22 Say who pays for the project and what they get. When you stop, hand it over or archive it with a notice, and never delete versions people use. See all 41 rules on one page in the [checklist](https://agentwranglers.se/playbook/open-source/checklist.md). This is a lot to check. [An Expert can check it for you](https://agentwranglers.se/contact.md). ## Related playbooks - [Supply chain and setup](https://agentwranglers.se/playbook/adversarial-testing/supply-chain-and-setup.md) in the Adversarial testing playbook. Your project is someone else's dependency. Publish without stored tokens, keep secrets from fork builds and ship a bill of materials. - [Libraries and SDKs](https://agentwranglers.se/playbook/engineering/libraries-and-sdks.md) in the Engineering playbook. Users upgrade only when version numbers keep their promise. Declare the public API, check each release against it and deprecate first. - [Product and sector laws](https://agentwranglers.se/playbook/compliance/product-and-sector-laws.md) in the Compliance and governance playbook. Companies that ship your code face the Cyber Resilience Act. Know what they must report, and when advisories are due. - [Due diligence](https://agentwranglers.se/playbook/codebase-takeover/due-diligence.md) in the Codebase takeover playbook. Buyers and new teams read your licences and history. See what a due diligence review checks before it reaches you.