AI-Assisted Open-Source License Compliance

End-of-lesson check

15 questions · take it digitally for instant feedback at tendril.neural-forge.io/learn/quiz/end-ai-coding-AI-license-compliance-scan-creators

1. A project has a direct dependency under the MIT license, but that dependency imports another library under the AGPL license. What term best describes this situation?

   1. Direct license violation
   2. Copyleft contamination
   3. License normalization
   4. Permissive override

2. Which license obligation tier would typically require you to release source code only if you modify the licensed code itself, but not if you simply use it?

   1. Strong copyleft
   2. Restrictive
   3. Permissive
   4. Weak copyleft

3. Why must compliance checking recurse the full dependency tree rather than only examining direct dependencies?

   1. License files are only stored in transitive dependencies
   2. A clean direct dependency can pull AGPL or GPL through a chain of transitive imports
   3. Direct dependencies are always compliant by definition
   4. AI tools cannot read metadata from direct dependencies

4. What type of file can AI assistance help generate as part of the compliance process?

   1. Binary release packages
   2. Compiler configuration files
   3. NOTICE and ATTRIBUTIONS files
   4. Source code comments

5. When grouping dependencies by obligation tier, which category would include the MIT and BSD licenses?

   1. Strong copyleft
   2. Restrictive
   3. Permissive
   4. Weak copyleft

6. A project uses a library licensed under the GPL. Under strong copyleft terms, what typically happens if you distribute your software?

   1. You must release your entire project's source code under GPL terms
   2. You need to do nothing special
   3. You must only pay a fee to the original authors
   4. You must delete all code and stop distributing

7. What does 'transitive import' refer to in the context of dependency management?

   1. License text imported into NOTICE files
   2. Import statements in your own source code
   3. The act of copying code into your project
   4. Dependencies pulled in by your direct dependencies

8. Why is it important to flag 'risky transitives' during compliance scanning?

   1. AI cannot read transitive dependency metadata
   2. Transitive dependencies are never important for compliance
   3. Some transitive dependencies may introduce restrictive or copyleft licenses that create legal obligations
   4. Transitive dependencies always cause compilation errors

9. Which task represents the strongest practical use of AI in the license compliance workflow described?

   1. Signing off on compliance documentation
   2. Negotiating license terms with third parties
   3. Summarizing obligations of each license in your dependency tree
   4. Rendering final legal judgments about license compatibility

10. What type of license would typically be classified as 'restrictive' in the obligation tier system?

    1. MIT
    2. Proprietary with specific usage restrictions
    3. GPL
    4. BSD

11. A developer adds a new dependency to their project. What should the compliance process include before finalizing the addition?

    1. Skipping compliance if the dependency is popular
    2. Only checking the direct dependency's license
    3. Checking the full dependency tree including all transitive dependencies
    4. Assuming all popular dependencies are properly licensed

12. What makes the AGPL license particularly risky from a contamination perspective?

    1. It only applies to direct dependencies
    2. It has stronger copyleft terms than standard GPL, extending to network use
    3. It is no longer a valid license
    4. It requires payment for commercial use

13. In the context of license compliance, what distinguishes what AI 'does well' from what it 'cannot do'?

    1. AI can summarize and flag based on patterns but cannot provide legal advice or detect obligations outside license text
    2. AI can compile projects but cannot analyze dependencies
    3. AI can read code but cannot read license files
    4. AI can analyze text but cannot connect to the internet

14. Which view of "AI-Assisted Open-Source License Compliance" is most consistent with a balanced take?

    1. The ideas only matter for one specific industry.
    2. Only people with PhDs can apply the ideas correctly.
    3. It is impossible to do anything useful with the topic.
    4. It is a real, useful skill worth learning carefully.

15. Which captures a genuine tradeoff to weigh when applying these ideas?

    1. Convenience and depth are guaranteed to grow together.
    2. There is never any tradeoff between speed and learning.
    3. Speed and convenience can come at the cost of depth, ownership, or skill-building.
    4. Speed always damages a project beyond repair.