Is there good material out there regarding maintaining internal forks of open source projects?

[dellagustin-sap]

Hello everyone,

One common situation that is faced by companies is the maintenance of internal forks of open source projects.
Of course, this is something that we try to avoid, as we usually promote that people try as much as possible to contribute to existing projects, instead of forking, but in some cases, it can't be avoided.

When we do fork then, some challenges and questions arise:

• Are there best-practices to renaming and/or versioning the fork (in special, the resulting software artifact/pagackage), so that it does not clash with the original project?
• Are there best-practices on keeping the project "pedigree" (on which version of the original is it based), so that the software logistics tooling knows, for instance, when it could be affected by a known vulnerability of the original, and also to properly generate Software Bills of Material and Open Source legal notices?

It would also be interesting to have material on the archetypes of forks, e.g., internal forks used just to have more control over the release lifecycle, but they are kept as much as possible in sync with the original, vs hard forks that have completely branched out from the original at a certain point.

If you have material, on this topic, please share, it would be interesting to build up on collective knowledge about this topic.

Best Regards.

[grnrs]

This is probably nothing to the degree of best practices you're looking for, but Google Open Source has an imho rather comprehensive documentation on how they handle third-party code in their monorepo including descriptions about responsibilities and some mentions about tooling they have internally.
https://opensource.google/documentation/reference/thirdparty

This might give you some initial and helpful insights into how this could be handled.

[dellagustin-sap]

Thanks for sharing! I'll check it.

[justaugustus]

@dellagustin-sap — worth checking out the private-mirrors GitHub App: https://github.com/github-community-projects/private-mirrors

[dellagustin-sap]

Interesting, thanks for sharing!