Read up on crypto export controls as they were implemented in the 90s, and still are today for anything that falls under e.g. ITAR.

It's not a perfect way to block open source, but in practice it could be done and would mostly "work". The chilling effect and collateral damage would be massive though.

Sanctions can apply to copyright or patent licenses, which means you can't grant them and any existing licenses are nullified. When Huawei got sanctioned, they were cut off from any technology invented by Americans, including things like most ARM chip designs, Google Play, and even Android itself[0]. This also meant that any remaining licensees of such technologies couldn't sublicense to Huawei.

Now, you might wonder why that matters - surely, China is the one enforcing copyright and patent law, right? They could just pretend America didn't say that. Except if they do that, then they're in violation of WIPO/TRIPS, and every country in the world is going to ban their exports.

FOSS relies entirely on copyright law in order to work and be legal, and Americans and Europeans write a lot of FOSS, so the US, UK, Canada, Mexico, and the EU 27 collectively pull the strings here. If you don't have those licenses in place, not only could any contributor go rogue and start suing; the US itself would have standing to sue on behalf of it's citizens (i.e. to get products banned from international trade).

As a practical example of this, GitHub had to fight tooth-and-nail just to get a sanctions exemption so that Iranian software developers could rejoin the rest of the world.

[0] AFAIK Huawei is shipping their own AOSP fork now, and that's currently allowed; but I still maintain that the US could have banned them from that, too.