It's pretty clear from the part you quoted yourself. > open-source software developed or supplied outside the course of a commercial activity should not be cov

It's pretty clear from the part you quoted yourself. > open-source software developed or supplied outside the course of a commercial activity should not be covered by this Regulation. You take an upstream, free, non-commercial product and you SUPPLY it as part of the solution. You are responsible for the conformity.