[nairodd]

The biggest hole I see there is that not all OSS is used as a dependency. If you're talking about fully built, standalone software, then package managers alone can't capture that.

You'd have to target the distribution process as well, which essentially means we're back to square one since these are vary heterogeneous and there is no single/central way of dealing with distribution other than through platform specific or domain specific distribution channels, and these are usually big boys that don't give a damn about OSS maintainers.