A client is asking my company to write up internal standards that open source software must meet before we will approve it for use on our workstations. Our policy has always been subjective and hard to quantify. We use very popular, highly reputable products like GPG, Ruby, and 7-Zip, and are wary of new, unproven projects. As part of a larger policy that also describes this "highly reputable" test, I would like to be able to point to a 3rd-party source that would provide some sort of rating of OSS products. While it's fairly easy to find sources that will tell you when a product is not considered secure, it seems more difficult to find a place that will tell you that it is. Does anyone know of a source that will give us some 3rd-party corroboration (or refutation) to our opinions that some product seems established and reputable?
Note that I'm aware of the arguments about the relative security of OSS vs closed source products, but it's not relevant here; the client is more wary of OSS and there's nothing I can do about that.