Closed lenucksi closed 1 year ago
Changed the title according to the evolution of #155
Related discussion on how to approach this in #163 :
it might be interesting to discuss their (read: Datahubs) way to it, their investment (are there maybe even any legal insights that informed this setup?) their decisions and lessons learned here and see if other parts of Energinet can profit from it
I would more highlight the above to exactly get their why's, their discarded options with their reasons for discarding them etc. The technical implementation here is unfortunately just one part of the story. The created one variation and part of it in the first place (yay!), some aspects show a good intent (🎉 too), but "good intent" and "legally safe" unfortunately don't always overlap (😐). So let's get the why's, what's etc. straight before we jump to the how's such that we end up in a state that's both "good intent" and "legally safe".
Of course, getting towards the insights mentioned above would a possible assginment - it's unclear who could take it though. Any ideas @wisbech (as our current best contact to Datahub)?
Closing this, as it is migrated to Energinet Open Incubator organization.
See what we can learn&adopt from the FOSS practice of the DataHub (https://github.com/energinet-datahub) or other participants.
Potentially interesting topics:
Legal aspects and support
Do they successfully use any SCA system? Otherwise this one usually works fine for many cases: https://github.com/oss-review-toolkit/ort (and is FOSS itself) (SCA: Software Composition Analysis - Software that finds/lists the components in the software you built and summarizes the licenses they found)
IT Security aspects such as dependency updating topics, security scanning etc. (Dependabot, Snyk etc.) and support
See if there are common ways of collecting the learnings from previous open source projects. (That could facilitate that collection and lead it to a good outcome.)