Methodology
Open Source Atlas ranks projects by digital sovereignty — who controls your data and your future — not by popularity alone. Every input is fetched from a real, public source. Nothing is invented: where the underlying data doesn't exist yet, the UI shows “unknown” and that pillar's weight is redistributed across the pillars that are known, never guessed or defaulted to a fake value.
The Atlas Score
The score (0–100) is a weighted mean of five pillars. Default weights:
| Pillar | Default weight | What it measures |
|---|---|---|
| Sovereignty | 30 | Self-hostability and license class (copyleft > permissive > source-available) |
| Maintained | 25 | Days since the last commit; archived projects are capped low |
| Secure | 20 | OpenSSF Scorecard (via deps.dev), ×10 |
| Adoption | 15 | Percentile rank of stars within the project's own subcategory |
| Open standards | 10 | How many of a fixed list of interoperability topics/tags the project carries |
For a single project: score = Σ(pillar × weight) / Σ(weight), summed only over the pillars that
are not null. If every pillar is unknown, the score itself is unknown. You can change the
weights yourself on the decision matrix — the score and ranking recompute
instantly in your browser, using this exact formula.
How each pillar is actually computed today
- Sovereignty — mean of: license-class score (strong copyleft 100, weak copyleft 90,
permissive 80, source-available 20) and a self-hostable indicator (90), when either is known. An
EU-maintainer bonus (self-reported GitHub org location) is specified in the design but not yet
computed — the GitHub GraphQL fetch for owner location hasn't landed in the data pipeline, so
euisnullfor every project right now rather than guessed. - Maintained — linear decay from 100 (pushed within 30 days) to 0 (pushed 2+ years ago); archived repositories are capped at 20. Only available for projects whose source provided a push date — currently a minority of the catalog (the awesome-selfhosted source doesn't include one).
- Secure — intended to be the OpenSSF Scorecard overall score from deps.dev, ×10. That
fetcher is not yet wired into the data build, so this pillar is
nullfor every project today. It is deliberately left unknown rather than estimated. - Adoption — percentile rank of a project's star count among other projects that share its primary subcategory, restricted to subcategories with at least 3 comparable star counts. Only computed for projects whose source reported a star count.
- Open standards — counts how many of a fixed set of topic keywords
(
activitypub, matrix, caldav, carddav, webdav, imap, smtp, s3, oidc, saml, ldap, openapi, graphql, csv-export, markdown, sql, postgres, ical, xmpp, fhir, lti, scorm, xapi, mqtt, modbus, sunspec, homekit, zigbee, z-wave, matter) appear in the project's topics, scaled up to 100. Zero matches is a real, known value (not "unknown") whenever a topics list exists for the project.
License classification
Licenses are bucketed from the SPDX identifier reported by the source: AGPL* → strong copyleft;
GPL* (not LGPL) → strong copyleft; LGPL/MPL/EUPL/EPL/OSL → weak copyleft;
MIT/Apache/BSD/ISC/CC0/Unlicense → permissive; BUSL/SSPL/Elastic/Commons Clause →
source-available. Anything else, including NOASSERTION or a reported "proprietary" component, is
unknown rather than assumed.
Data sources
Project records are merged from awesome-selfhosted/awesome-selfhosted-data and GitHub search
results (see fetch.py in the repository root), deduplicated by normalized repo URL, and
classified into sectors/subcategories deterministically against taxonomy.yaml — no model calls
are used to decide what a project is. The CNCF Landscape, AwesomeMap and deps.dev/OpenSSF Scorecard sources
described in the project's design notes are planned but not yet merged into every build; where a field from
one of those sources doesn't exist yet, it is null.
Dataset generated: loading…
Known limitations
- EU-maintainer flag is entirely unpopulated today (owner location isn't fetched yet), and would only ever reflect a self-reported GitHub profile location, not a legal or hosting fact.
- Security pillar is entirely unpopulated today — no project currently has a Scorecard value.
- Adoption compares a project only against others in the same primary subcategory that also have a known star count; niches with few such projects will show "unknown" rather than a shaky percentile.
- Topic-based classification (sector/subcategory, open-standards support) depends on how a project tags itself on GitHub or in the awesome-selfhosted list — a real but incomplete signal.
- Coverage is uneven: roughly seven in eight catalog entries currently come from a source that does not report stars or last-commit date, so the Maintained and Adoption pillars are "unknown" for most of the catalog until the richer GitHub GraphQL fetch is merged.
Treemap sizing
The sector page's treemap sizes each cell by log2(stars + 2), falling back to the Atlas score when a
star count is unknown, laid out with the standard squarified algorithm. The log transform keeps a handful of
very popular projects from making everything else invisible; it changes the visual scale only, never the
underlying numbers shown elsewhere.