Health Check-ups on OSS Software Projects: Managing Risks While Promoting (Re)use
summary
Two-year case study with Scania reduces 107 literature-derived signals to 21 health aspects and then to about 13–14 practical attributes teams actually use; process puts an initial developer-led screening into CI pipelines that emits green/orange/red flags and pushes flagged components to semi-manual follow-up, while deployed components run semi-automated intake + automated monitoring (examples: Grimoire Lab, Augur, OSS scorecards). Workshops, checklists and peer reviews train teams; procurement and auto industry pilots show tradeoffs between lifecycle stage, governance concentration and maintainer capacity.
AI-written summary · about
chapters (11)
- 0:00Open source health management
- 1:02Defining OSS health
- 3:08Health check metaphor
- 5:18Two-year research project
- 7:46Practical screening at Scania
- 10:14Automating dependency checks
- 12:41Standardizing inspections
- 15:13Training for consistent evaluation
- 16:59Health metrics
- 19:08Prescriptions for OSS
- 20:33Q&A
related talks
40mUnderstanding OSS Risk Beyond Code Vulnerabilities
31mAssessing Open Source Software Projects in the Software Supply Chain
52mOSS Security Maturity: Time to Put on Your Big Boy Pants!
29mSecurity Audits in Action: Helping Improve Multiple LF Energy Projects
27mSecuring the Software Supply Chain: Integrating OpenSSF Scorecard, Jenkins, and the O...
37mOpenSSF Best Practices for Everyone!
30mContinuous Compliance in Open Source: Safety Assurance Through S...
42mAssessing the Risk of Open-source Components Using OpenSSF's Scorecard