What makes an open source project sustainable? Finding meaningful indicators

This talk, presented by Max Grzanna from Bosch Digital and Sven Erik Jeroschewski from Robert Bosch GmbH, delves into the sustainability of open source projects by identifying meaningful, data-driven indicators. It explores the challenges of dependency risk within open source supply chains, where vulnerabilities can propagate through complex dependency trees and affect downstream systems. The speakers propose a systematic approach that treats the open source ecosystem as a network of observable signals, utilizing historical data to detect early signs of instability rather than relying on opinion-based metrics.

The session introduces a methodology that integrates Software Bill of Materials (SBOM) with project metadata sourced from platforms like GitHub and vulnerability databases. By analyzing a substantial dataset of repositories, they illustrate how to classify projects based on characteristics such as community engagement and licensing clarity. The talk emphasizes the significance of predictive indicators in assessing project health and demonstrates practical applications for organizations in identifying high-risk dependencies and making informed decisions about open source components.