Adoption Is Not Stewardship

Adopting open source means choosing to use it. Stewarding open source means paying attention to the relationships, practices, and shared conditions that help the work last.

Both matter. They are just not the same job.

Adoption Is Usually Local

Adoption often starts with a practical need. A team needs a library, a tool, a platform, a model, or a vendor product that includes open source components. The immediate questions are local: does it work, can we support it, does it fit our security and legal context, and will it help us deliver the service?

That work is real. A good adoption path helps teams move responsibly without turning every technical choice into a governance summit.

But adoption can stay too narrow if it treats open source only as something the organization consumes.

Stewardship Begins When the Relationship Matters

Stewardship becomes relevant when a project starts to carry more weight. The organization may depend on it for an important workflow. Staff may maintain private changes. Several agencies may use the same tool. A vendor may rely on community work. Maintainers may be carrying public-sector needs without public-sector support.

At that point the question changes. It is no longer only “Can we use this?” It becomes “What relationship should we have with this work?”

That relationship might be modest. It might be better documentation, a bug report, a contribution, sponsorship, or a conversation with maintainers. In some cases, it may involve shared governance or coordination across organizations.

The Drift Is the Problem

The risky pattern is not usually a dramatic mistake. It is slow drift.

A team adopts a tool. Another team copies it. A vendor builds around it. A local patch never goes upstream. The project becomes important, but no one owns the relationship. Eventually the organization discovers that a piece of shared infrastructure has been treated like a disposable supply.

This is how open source risk becomes organizational risk: not because open source is unsafe, but because important dependencies can become invisible.

Start With the Smallest Responsible Step

Stewardship does not mean taking over a project or forming a foundation. Most organizations should start smaller.

They can document where the project is used, assign an internal owner, ask maintainers what kind of help is welcome, contribute a small fix, fund maintenance, or bring peer organizations into a focused conversation.

The point is not to perform virtue. The point is to reduce fragility, build trust, and support the shared work your organization has come to rely on.

Where External Guidance Helps

Project health work can draw on communities like CHAOSS. Supply-chain and dependency practices may draw on OpenSSF, CISA, SPDX, CycloneDX, SLSA, and related efforts. Foundations and fiscal hosts can offer governance and funding models.

Those resources help. The local work is deciding what level of participation or support fits the public responsibility in front of you.

Next step: Talk through a first step.