Assessing Project Risk Using CHAOSS Metrics
summary
CHAOSS defines concrete risk metrics across security, code quality, licensing, transparency and sustainability and implements them with Augur and Grimoire Lab. Key signals include test coverage percentages (safety‑critical targets around ~90%), number of active committers versus total contributors (elephant factor / bus‑factor), forks, commits/week, issues opened/closed, and file‑level license coverage. Tools generate a software BOM listing every file and commit hash, detect sudden license injections or commit spikes, and let teams compare repos or set alerts for surprising changes.
AI-written summary · about
chapters (19)
- 0:00Introduction
- 1:37CHAOSS Mission
- 2:01CHAOSS Working Groups
- 2:34Key Stakeholders
- 3:43Risk Framework
- 3:56Wargames
- 4:31Open Source
- 4:46Trusted Device
- 5:31Quality of Code
- 6:36Accurate Identification
- 8:04Test Coverage
- 10:53Licensing
- 12:58Auger
- 15:42Project Sustainability
- 16:43Risk Metrics
- 17:13Software BOM
- 19:18Dimensions of Risk
- 26:50Other Risk Concerns
- 29:03Questions
related talks
25mDefining the Limits of Risk
32mA Complex Web of Open Source Software Dependencies Risk
29mUsing CHAOSS Metrics, Models, and Software to Identify the Most Significant At-Risk Dependencies in Your Portfolio - Sean Goggins, CHAOSS Project and the University of Missouri
42mThe Role of Open Source Management Talent in Ensuring Software...
20mOSS Dependency Health: Towards Maturity and Sustainability Risk Assessment Model
43mBuilding and Supporting Open Source Communities Through Metrics
33mData to Action: Build Healthy & Sustainable OSS Communities
36mPanel Discussion: OSS Viability and Project...