Skip to content

Open source strategy (conditional reference)

Load when any part of the product is open source, conforms to an open standard Bluefly stewards, or depends on upstream community adoption.

Distinguish the shapes

OPEN SOURCE PROJECT             code with a license and a community; no buyer
OPEN SOURCE PRODUCT             a project with a defined user, outcome, and adoption metrics
COMMERCIAL PRODUCT USING OSS    proprietary offer built on upstream (most Bluefly offerings)
OPEN CORE                       open base, paid edition or features
HOSTED OSS                      the open thing, run for you
COMMERCIAL SUPPORT              SLAs, escalation, assurance around the open thing
ECOSYSTEM BUSINESS              value from what others build on the standard

Bluefly's standards (OSSA, DUADP) are Apache 2.0 open specifications with reference tooling. They are ecosystem plays. Products conform to them; nobody buys a standard.

Define explicitly

  • What is open, what is commercial, and the exact boundary (feature, scale, hosting, assurance).
  • Who owns what: contributor license, trademark, governance of the spec.
  • Monetization boundary: what would be a betrayal of the community if charged for.
  • Community value: why a contributor benefits without paying Bluefly.
  • Contribution strategy: what Bluefly upstreams (Drupal contrib, Gas City packs, GitLab CI components) versus keeps. The corpus rule is compose and upstream first; custom code is last.
  • Governance: who decides spec changes, how, and how a customer can trust it will not be captured.

Adoption metrics for the open layer

Downloads are vanity. Track: independent implementations, manifests published by non-Bluefly organizations, DUADP records resolved across organizations, contributors outside Bluefly, conformance tests passed by third parties, citations in procurement or policy documents (the NIST docket response is one).

Risks specific to open strategy

Trust risk (customers fear the standard is a Bluefly lock-in in disguise), economic risk (the open layer cannibalizes the paid layer), maintenance risk (community expectations exceed a solo estate's capacity). Write mitigations, not hopes.