That no longer holds true once the code has been built upon. That is unless the project keeps their project open source during development. Sure the original code remains open source, but future projects can close that door on their own additional code. On a side note, the code doesn't have to be open source to check for PUP coding. Applications can be de-compiled for examination regardless. But since it is Uncle Sam we are talking about. I doubt any coding/harvesting that benefits them would be labeled PUP.