Open Source Software (OSS) (UPSC Science & Tech)
UPSC guide to open source software: licensing, India's OSS policy, DPI stack, UPI, Aarogya Setu, Bhashini, and 2024-26 developments.
Open Source Software (OSS) is software whose source code is freely available for anyone to study, modify and distribute. From the Linux kernel in your router to the Android on your phone, the Python that powers AI labs and the Kubernetes that orchestrates cloud computing — modern digital life runs on OSS. For India, OSS is not just a technical choice; it is a pillar of Digital Public Infrastructure (DPI). For UPSC, OSS fits within GS Paper III — Science & Technology, Economy, Governance.
What is open source?
- Source code published under a licence that guarantees the four freedoms (FSF definition): run, study, modify, redistribute.
- OSS licences approved by the Open Source Initiative (OSI).
- Common licences: MIT, BSD, Apache 2.0, LGPL, GPL (copyleft), AGPL, Mozilla Public Licence.
Contrasted with:
- Proprietary software — closed source.
- Freeware — free of cost but not necessarily open source.
- Source-available — readable but restricted.
Why OSS?
| Benefit | Detail |
|---|---|
| Cost | No licence fees; low total cost of ownership |
| Transparency | Code is auditable — critical for security and privacy |
| Customisation | Adapt to local languages, workflows |
| Vendor neutrality | Avoids lock-in |
| Community | Many eyes catch bugs and vulnerabilities |
| Innovation | Faster iteration via collective contributions |
| Skill building | Developers learn from and contribute to real codebases |
| Sovereignty | National security in critical systems |
The modern open-source stack
- Operating systems: Linux, BSD, Android (AOSP).
- Databases: PostgreSQL, MySQL/MariaDB, Redis, MongoDB (SSPL), SQLite, ClickHouse.
- Languages: Python, JavaScript, Go, Rust, Java (OpenJDK), PHP.
- Frameworks: React, Vue, Django, Flask, Spring, Next.js.
- Cloud-native: Kubernetes, Docker, Prometheus, Argo, Istio, OpenTelemetry.
- Data/ML: TensorFlow, PyTorch, Jupyter, Apache Spark, Airflow.
- Security: OpenSSL, nmap, Wireshark, Suricata, OpenZFS.
- Blockchain: Bitcoin Core, Ethereum (Geth), Hyperledger.
- AI: Hugging Face Transformers, LangChain, vLLM; open-weights models like Llama, Mistral, BharatGPT.
India's OSS policy framework
Government policies
- Policy on Adoption of Open Source Software (2015) — MeitY; preference for OSS in government, subject to "strategic" and "comparable" conditions.
- Framework for Adoption of Open Source Software (2015) — complementary guidance.
- Open APIs Policy (2015) — mandates open APIs for new systems.
- Policy on Collaborative Application Development through Open Source (2014, 2019 revisions) — government Github.
- e-Gov Open APIs and Open Data Standards — DIC, MeitY.
- DigiLocker, UIDAI, ABDM, DBT — built on open-source stacks.
India's open digital public infrastructure
- Aadhaar authentication stack — API framework.
- UPI — built on open NPCI specifications; reference implementations by NPCI and participating banks.
- DigiLocker — open format document repository.
- CoWIN — open-sourced after COVID under CoWIN Global Conclave (2021); made available free to ~80 countries.
- ABHA / ABDM — open health protocol.
- ONDC (Open Network for Digital Commerce) — protocol-led e-commerce.
- Bhashini — open-source AI language translation stack.
- Poshan Tracker, PM Gati Shakti, API Setu — open-API public platforms.
Open-source AI in India
- AI4Bharat (IIT Madras) — releases open Indic language models (IndicBERT, Airavata, Sangraha).
- Bhashini — open translation and speech models for 22 scheduled languages.
- Krutrim (Ola), Sarvam AI, Shakti (AI Planet) — some components released open-weights.
- IndiaAI Mission (2024) supports open-source foundation models via grants.
- OpenHathi (Sarvam AI) — Hindi-focused 7B open-weights LLM.
Global OSS ecosystem
- Linux Foundation — stewards Linux, Kubernetes, Hyperledger.
- Apache Software Foundation — hundreds of projects.
- Eclipse Foundation — Java, IoT.
- Cloud Native Computing Foundation (CNCF) — cloud-native standards.
- Open Compute Project — hardware specs.
- RISC-V International — open instruction set architecture.
- Hugging Face — hub for ML models.
- OpenSSF (Open Source Security Foundation) — security best practices.
OSS in defence, health and finance
- CDAC's BOSS (Bharat Operating System Solutions) Linux.
- e-Office, CollabCAD, Drishti Sahayak — OSS in government.
- BHEL's plant automation, ONGC's data pipelines — OSS underpinnings.
- Banking — Core Banking Systems increasingly use Linux, Kafka, Postgres.
- Defence — certified open-source cryptography; secure Linux distributions for internal networks.
Licensing 101
| Licence | Copyleft | Popular use |
|---|---|---|
| MIT / BSD | No | Most permissive; common in startups |
| Apache 2.0 | No; explicit patent grant | Kubernetes, TensorFlow |
| LGPL | Weak copyleft | Library-friendly |
| GPL v2/v3 | Strong | Linux, GCC, WordPress |
| AGPL | Network copyleft | SaaS-facing projects (Mastodon, MongoDB pre-SSPL) |
| MPL | File-level copyleft | Firefox |
| Creative Commons | Various | Content, data, AI datasets |
Concerns and challenges
| Concern | Detail |
|---|---|
| Sustainability | Many critical OSS projects run by unpaid maintainers (xz backdoor 2024 scare) |
| Security | Log4Shell (2021), xz Utils (2024) — supply chain vulnerabilities |
| License compliance | Commercial misuse of GPL code |
| Corporate capture | Big Tech forks, re-licensing (Elastic, Redis, MongoDB, HashiCorp in 2023-24) |
| Open-washing | Claiming "open" while retaining key restrictions |
| AI "open" debate | Open weights vs open data vs open science |
| Government lock-in | Procurement defaulting to proprietary despite policy |
The xz Utils incident (2024)
A state-sponsored backdoor was surreptitiously added to the xz compression library — used in Linux distros — by a maintainer who gained trust over two years. Discovered by a curious Microsoft engineer in March 2024. The near-miss exposed the fragility of OSS supply chains and accelerated the SBOM (Software Bill of Materials) and OpenSSF Scorecards push worldwide.
OSS and Digital Public Goods
- UN Digital Public Goods Alliance (DPGA) — open data, open content, open AI models, open standards.
- India-led DPI model — recognised in G20 New Delhi Declaration (Sep 2023).
- Global DPI Repository — WHO's Digital Health Technologies, UNICEF's Giga, 50-in-5 coalition.
India's role in global OSS
- CoWIN global rollout — pledged free to interested countries post-COVID.
- DPI stack (MOSIP, Beckn, Bhashini, Modular Open Source Identity Platform) exported to Philippines, Sri Lanka, Togo, Morocco, Ethiopia, and others.
- India supported EU AI Act's treatment of open-source models at AI Action Summit.
- India is 3rd largest OSS contributor country globally (GitHub Octoverse 2023-24).
Latest developments (2024-26)
- xz Utils backdoor (Mar 2024) — triggered supply-chain security reviews.
- IndiaAI Mission (Mar 2024) — Rs 10,372 crore; promotes open models and datasets.
- Bhashini expansion (2024-25) — 22 languages; open-source release of IndicTrans-2.
- AI Action Summit, Paris (Feb 2025) — India advocated open-weights and DPI exports.
- DPI Global Repository (2024) — India's Bhashini, Beckn, DIKSHA listed.
- India Semiconductor Mission — driving open-source hardware (RISC-V Shakti, VEGA).
- DeepTech Policy 2024 — supports open-source deep-tech ecosystems.
- National Quantum Mission (2024) — open quantum SDKs and simulators being developed.
- Chandrayaan-4 plan and Gaganyaan progress — flight software built on RTOS components with open APIs.
- Elastic re-adoption of OSI-approved licence (Aug 2024) — reverse relicensing after 3-year dispute.
UPSC Relevance
GS Paper III — Science & Technology
- OSS landscape, DPI, open-source AI.
GS Paper III — Economy
- Vendor neutrality, cost savings, exports.
GS Paper II — Governance
- MeitY OSS policy, DPI service delivery.
GS Paper III — Internal Security
- Supply-chain vulnerabilities (xz), defence OSS.
Prelims pointers — MeitY OSS Policy 2015, GPL vs Apache, BOSS Linux, CoWIN open-sourced, Bhashini open-source, RISC-V, Shakti, ONDC, OSPP, OpenSSF, xz Utils incident.
Interview probes — OSS vs proprietary in government procurement; xz lessons; monetisation challenges; open-source AI; DPI global exports.
Open source is digital commons — an ecosystem where contribution builds credit. India's growing role, both as exporter of DPI and user of global OSS, makes sustaining and securing this commons a civic and strategic priority.