Rust, Python and Maven are looking for new sources of funding

A number of infrastructure providers from the open source world have jointly issued a statement that their heavily utilized basic services need a new financial foundation. The signatories include the Eclipse Foundation (Open VSX), the Python Software Foundation (PyPi), the Rust Foundation (Crates.io), and Sonatype (Maven Central).

In the statement, they complain that many, often commercially oriented users of the load-intensive package services are not making any contribution. Together with the community, the OS services now want to find new ways and develop a fairer financial model. The current financing is “based on goodwill and not on mechanisms with responsibilities.”

“Governments and businesses demand reliability, security, and speed,” emphasizes the Rust Foundation in its blog. “The joint statement emphasizes that these expectations come with real (and rising) costs.” These are currently borne by a small group of organizations and individuals—the article names Fastly, Microsoft, Google, Meta, Huawei, and AWS. Meanwhile, other users only use Crates.io without making a sustainable contribution. These include commercial companies that generate enormous value with Rust.

In addition to source code, more and more large binary packages can be found in the directories as SDKs that only work in a commercial context. In addition, there are increasing government requirements for transparency, security, and documentation, including from Europe: “New regulatory requirements such as the EU Cyber Resilience Act (CRA) have increased compliance obligations and documentation requirements.”

Benefits for paying partners

The joint declaration now proposes the following paths:

• Commercial partnerships based on usage and with strategic benefits for partners
• Tiered access to services with increased performance or accessibility guarantees for partners
• Value-added services such as user statistics

These are not yet concrete proposals, the projects emphasize in their statement, but rather an initial contribution to the discussion. However, the Rust blog also contains a quiet threat: “Access to Crates.io will not change in the immediate future.” Rust remains silent about what comes after “immediate”.

Over the next six to twelve months, the Rust Foundation plans to set up forums for discussions, consult with maintainers and leaders in the ecosystem, and work closely with other package registries. The Rust Foundation emphasizes the importance of the community: “Nothing will change without extensive input from the community.” The OS projects are hoping for help through, among other things, more participation in the discourse and the willingness to combine the use of services with responsibility and to use build services in an infrastructure-friendly manner. And in particular, of course, through the will to become a financial partner of open-source software.

(who)