The Linux Foundation Member Summit 2021

When managing dependencies there are varying levels of complexity and context. Specifically, this talk will review how the CHAOSS Risk Working Group is developing a set of Minimum Viable Metrics that consider: Direct, transitive, interdependent, and circular dependencies. We then discuss the range of variables that can add contextual dimensions to inform how these dependencies can be measured, and a common language for interpreting them. Repository dependency enumeration (Upstream: Projects that my project depends on) Dependency sustainability risk (possibly an accumulation of Evolution, Common and Value working group metrics) “How active is the project now?” - are commits still being made? If it’s small it might be fine, but larger ones are usually concerning if there’s no commits - Dependency : How many times is a single dependency is referenced - Libyears for projects/libraries my project depends on (total, average) - Enumeration of known vulnerabilities for my project’s upstream dependencies - CVE's & Vulnerabilities: CVE's are a small subset.