Looking at the comments, seems it might be a headache to manage this at open source level.
The enforcement itself seems to be tough to manage.
The enforcement itself seems to be tough to manage.
Note: A few Open Source projects have already added the OSMF. I've not yet followed up to see how it is going for them.