I'm fairly sure this differs for different project/organization, not sure there is a rule, and not sure there are really any considerations that are specific to open source, good practices are good practices regardless.
That being said, I rate Canonical's practices as rather poor.
