SOSS Community Day Europe 2024

Organizations depend heavily on OSS libraries. Existing tools assess license compliance and code vulnerabilities in the short term, but there is a gap in tools to monitor long-term health and sustainability of OSS libraries. Enterprises especially face challenges in assessing these risks for large-scale deployments. In this panel, using Kubernetes as the sample, we show how the Risk Model we built together with ING can evaluate the health and sustainability of open source dependencies. This model is informed by the CHAOSS project (community health) and is complementary to the OpenSSF Scorecard. It goes beyond traditional SBOM analysis to assess ongoing maintenance activity. Attendees learn how this Risk Model can help ensure the health and sustainability of open source deployments. We will discuss varying security needs from the perspective of OSPOs who facilitate open source understanding and security assessments across business units. The attendees can ask questions directly to the Data Scientists that built the Risk Model on top of the open source CHAOSS GrimoireLab software.