We've rolled out FOSSA across our engineering org, and while the compliance and security folks are thrilled, our new developers are often overwhelmed by the reports. They see a wall of "policy violations" and "license risks" and don't know where to start fixing things.
I'm trying to build a training module that's more practical than just reading FOSSA's docs. My goal is to get them to a point where they can independently triage a report and take correct action.
Here's my current training outline:
* **Start with the "Why":** Quick primer on why OSS compliance isn't optional (legal, security, operational risks). Tie it to real events like the `log4j` incident.
* **Decode the Report Structure:** Walk through a real, simple report. Highlight the key sections:
* Dependencies (Direct vs. Transitive)
* License Types (Permissive vs. Copyleft)
* Policy Violations (focus on what *our* policy actually blocks)
* **The Triage Workflow:** This is the core. We give them a decision tree:
1. Is it a *direct* dependency? If yes, can we replace it with a similar library with a better license?
2. Is it a *transitive* dependency? Trace it up the chain to the direct dependency causing it.
3. Is the violation a license issue (e.g., GPL) or a security vulnerability? Different remediation paths.
* **Hands-On Lab:** They get a sample project with a few intentional "issues" and have to generate a FOSSA report, interpret it, and submit a mock fix (like a `package.json` or `pom.xml` update).
What I'm struggling with is making the "interpretation" step less abstract. I've considered creating a cheatsheet of common license abbreviations and their implications for our use case (SaaS, no distribution).
**What methods or resources have you used to train engineers on FOSSA?** Specifically:
* Do you use FOSSA's API or CLI to create custom, simplified training reports?
* Have you built any internal tools or scripts to annotate reports for beginners?
* What are the most common misinterpretations you've had to correct?
Here's a snippet of a simple script I use to extract a high-level summary from FOSSA's output, which helps cut through the noise for new folks:
```bash
# Quick parse of a FOSSA report (JSON output) for top-level concerns
jq -r '
"Unapproved Licenses:",
(.dependencies[] | select(.license.license_id | IN("GPL-3.0", "AGPL-3.0")) | " - (.name) ((.license.license_id))"),
"nHigh-Risk Vulnerabilities:",
(.dependencies[] | select(.vulnerabilities | length > 0) | " - (.name): (.vulnerabilities[].title)")
' fossa_report.json
```