open-source compliance