[Verse 1]
Every package has a story, every library a home
Check the vendor's domicile before you let it roam
Parent company matters when acquisition comes to play
Yesterday's open source might be locked up today
[Chorus]
Know your origin, check ownership twice
Vendor domicile, parent company slice
Hosting jurisdiction, governance too
Foundation or vendor, who's controlling you?
Origin ownership, make it crystal clear
Before dependencies disappear
[Verse 2]
Where's your registry hosted, what jurisdiction rules?
CI pipelines crossing borders, don't be played for fools
Community foundations versus vendor-led control
One maintainer holding keys puts risk upon your soul
[Chorus]
Know your origin, check ownership twice
Vendor domicile, parent company slice
Hosting jurisdiction, governance too
Foundation or vendor, who's controlling you?
Origin ownership, make it crystal clear
Before dependencies disappear
[Bridge]
Bus factor of one means trouble ahead
Release cadence dying, project might be dead
Security response time tells the tale
Centralized registry means you're bound to fail
[Verse 3]
Single points of failure hide in plain sight
One registry down and nothing works right
Dependency health checks, make them routine
Bus factor and maintainers, keep your pipeline clean
[Chorus]
Know your origin, check ownership twice
Vendor domicile, parent company slice
Hosting jurisdiction, governance too
Foundation or vendor, who's controlling you?
Origin ownership, make it crystal clear
Before dependencies disappear
[Outro]
Due diligence today saves heartbreak tomorrow
Check the governance before you borrow
Origin ownership, the foundation stone
Of resilient systems you can call your own