Rules of Engagement for Forking a Dependency (SOSS Community Day Europe 2024)

You got the CVE notification, but there's no fix yet. Customers GUACing your SBOMs are worried. Should you fork? This presentation will run through the rules of engagement we've used at Atsign when these situations arise, which aim to balance good community citizenship with making sure stuff gets fixed.

1. © 2024 - Atsign | docs.atsign.com
Rules of Engagement for
Forking a Dependency
SOSS Community Day Vienna - Sep 2024
CC BY 2.0 image by i_yudai

2. © 2024 - Atsign | docs.atsign.com

3. © 2024 - Atsign | docs.atsign.com
https://xkcd.com/2347/

4. © 2024 - Atsign | docs.atsign.com
Hi, I’m Chris
@cpswan
https://chris.swanz.net

5. © 2024 - Atsign | docs.atsign.com
The steps
1.Check to see if there’s already an issue (or PR)
2.Raise an issue
3.Submit a PR
4.Fork the repo and publish a variant

6. Rules of Engagement?
https://en.wikipedia.org/wiki/Rules_of_engagement

7. 1.Check first
??????

10. 2. Raise an issue

11. ⏳

12. 3. Raise a PR

13. ⏳

14. 4. (Reluctantly) Fork (and publish a variant)

17. © 2024 - Atsign | docs.atsign.com
The steps
1.Check to see if there’s already an issue (or PR)
2.Raise an issue
3.Submit a PR
4.Fork the repo and publish a variant

18. Resources
Blog post:
https://blog.atsign.dev/steps-before-forking

19. Thanks for your time
[email protected]
@cpswan

20. Questions?