Advise about the quality / health of an Open Source project / dependency package

[sschuberth]

In addition to security vulnerabilities the advisor could also advise about the general quality of an Open Source project, e.g. using

• CHAOSS Software (GrimoireLab, Cauldron)
• Ecosyste.ms
• End-of-life (EOL)
• Google's scorecard project (also see the criticality score of Open Source projects: https://github.com/ossf/criticality_score)
  • Related: https://github.com/ossf/malicious-packages
• Hipcheck
• Pub Points
• Trusty
• JSR scoring
• CrOSSD

by extending

ort/model/src/main/kotlin/AdvisorCapability.kt

Lines 31 to 37 in 19c89ff

	enum class AdvisorCapability {
	/** Indicates that an advisor can retrieve information about defects. */
	DEFECTS,
	/** Indicates that an advisor can retrieve information about security vulnerabilities. */
	VULNERABILITIES
	}

with HEALTH or so.

[sschuberth]

We might be able to collaborate with what @janniclas's team did at https://github.com/fraunhofer-iem/spha. Also see this whitepaper. I've already reached out to Fraunhofer IEM for this.