Sourceware's independence now has a committee, a budget, and a legal home

Software Freedom Conservancy executive director Karen Sandler with an Outreachy alum at LibrePlanet 2015. The conference photograph fits Sourceware's governance story because a fiscal sponsor is a human and legal layer—contracts, accounts, advice, and project representation—not another code-hosting logo.[7]

Sourceware is easy to mistake for a collection of old hostnames. It is the shared infrastructure beneath GCC, GDB, glibc, Binutils, Cygwin, elfutils, SystemTap, Valgrind, and other projects that cannot afford to treat source hosting, mailing lists, release mirrors, or build workers as casual conveniences.[5] Its governance question is therefore sharper than “Who runs the server?” It is: who may accept money, sign a contract, choose an infrastructure partner, and speak for the platform without acquiring authority over the projects it hosts?

Three years after Sourceware joined Software Freedom Conservancy, there is enough evidence to read the answer. The positive signal is not a new forge or a larger machine. It is a set of explicit boundaries: hosted projects retain their technical independence; a Project Leadership Committee, or PLC, governs the common infrastructure; Conservancy supplies the legal and fiscal shell; and sponsors provide resources without receiving an automatic seat in any project's roadmap.[1][3][5]

That arrangement has already moved Sourceware from informal stewardship toward budgeted operations. It has also made the risks easier to see. A committee can become inactive. A fiscal sponsor can become a bottleneck. Donated hardware can still create concentration. Governance is working here only if those interfaces keep producing decisions, money, maintenance, and public evidence.

The missing layer was authority, not Git

Sourceware has operated since 1998. Its volunteers knew how to reach technical consensus and keep developer services running, while companies and institutions supplied hardware, network capacity, and hosting. The harder question was how to preserve community control while making that support more durable.[1]

That tension became public in 2022, when a proposal to modernize GNU toolchain infrastructure through the Open Source Security Foundation prompted a dispute over corporate influence, security investment, and who should control the resulting platform. Independent reporting at the time described a community divided not over whether infrastructure needed care, but over which institutional relationship could provide it without putting critical toolchains under a sponsor's leverage.[6]

Sourceware ultimately joined Software Freedom Conservancy in May 2023 after nine months of governance discussion. It created an eight-person PLC and wrote an employment-diversity rule into its fiscal sponsorship agreement: no more than two committee members may be financially related to the same entity. It also adopted a conflict-of-interest policy. The committee began holding monthly open office hours, setting priorities, directing project funds, and negotiating with hardware and service partners alongside Conservancy staff.[1]

The current PLC has seven members. Its agreement requires at least four, preserves the same two-per-employer ceiling, and treats those people as individuals rather than delegates sent by their companies.[3][5] That is a small but important design choice. Sourceware does not pretend employers are irrelevant; several organizations supply machines, bandwidth, cloud capacity, or paid contributor time. It constrains their representation instead of relying on an unwritten promise that affiliation will never matter.

The PLC's scope is also bounded. It governs Sourceware's shared services and relationship with Conservancy. It does not become the release manager for GCC, the maintainer of glibc, or the technical steering committee for every hosted project. Sourceware's own mission page says those projects remain independent and usually administer their project-specific resources themselves.[5] Infrastructure authority and code authority touch, but they are not the same authority.

Fiscal sponsorship is an operational interface

A volunteer collective can merge a patch. It cannot, by itself, be the named party on a data-center contract or open a charitable bank account. If one maintainer holds donations personally, the project inherits that person's tax position, availability, succession risk, and judgment about every payment. If one vendor holds the trademark, domain, or server lease, an infrastructure disagreement can become an ownership problem.

Conservancy's comprehensive fiscal-sponsorship model gives a project a legal home without asking its developers to create and administer a standalone nonprofit. Conservancy can receive earmarked donations that may be tax-deductible for qualifying U.S. donors, keep project accounts, hold assets, execute contracts, arrange legal help, and pay legitimate project expenses. Project leaders direct those funds, subject to Conservancy's charitable mission and legal obligations; Conservancy says it does not intervene in technical or artistic decisions while a project remains within that boundary.[2]

This is not free money. New member projects contribute 10% of the revenue Conservancy processes to its general fund, and Conservancy says that share still does not fully cover the staff work behind fiscal sponsorship. Its application page also warns that demand exceeds its limited staffing and that it prioritizes existing members.[2] Those facts belong in the governance assessment. The model exchanges a portion of revenue and some transaction latency for bookkeeping, contracts, continuity, advice, and a legal identity that is not one maintainer's wallet.

Exit is possible, but not frictionless. A project can leave with notice, while assets held under charitable rules must move to another compatible nonprofit rather than to an individual or ordinary company.[2] That constraint is not a trap hidden in the fine print; it is part of what makes tax-deductible project money public-purpose money. A team evaluating sponsorship should understand the asset path before it transfers a domain, trademark, or reserve.

Sourceware's case shows why the distinction between service provider and sponsor matters. Conservancy does not sell it a Git appliance. It makes the PLC legible to banks, donors, counsel, conference venues, contractors, and infrastructure partners. The source-hosting stack can change while that organizational interface persists.

Three years turned governance into operations

Sourceware's May 2026 report describes the third year under Conservancy in operational terms: a standing PLC, monthly open office hours, multiple hardware and service partners, broader fundraising, the ability to hold assets and sign agreements, and regular public planning.[3] Those are maintenance signals because they change what the volunteers can reliably promise.

The clearest example is physical infrastructure. At the end of 2025 and start of 2026, Sourceware moved servers into Red Hat's RDU3 facility and Oregon State University's Open Source Lab data center. Public services now run VM-first rather than directly on bare metal, with additional x86-64 and Arm64 OpenStack capacity available for compute, redundancy, and backups.[4] The change is architectural, but the ability to coordinate two institutional hosts and direct spending is organizational.

The service surface is concrete. Sourceware operates Git hosting through cgit and gitolite, mailing lists with Mailman and public-inbox, Bugzilla, Patchwork, Buildbot, release mirrors, snapshots, and project-specific automation.[5] Each service creates a maintenance queue: account recovery, spam control, storage growth, certificate renewal, security updates, abuse response, backups, migration, and incident communication. Donated racks do not close those queues. Named people and funded time do.

That is why the 2026–2027 budget discussion matters. After completing a hardware refresh, the PLC proposed shifting emphasis from “iron” toward services and people: compensating OSUOSL, hiring staff or consultants for service upgrades and VM migrations, and funding useful work upstream in Forgejo. It exposed the proposal through three community budget discussions before publishing donation, sponsorship, and financial pages.[3][8]

The following quarterly update reported a survey of 84 people, estimated at roughly 20% of about 400 active accounts with SSH or gitolite push access. Around 70% of respondents identified as active committers; smaller groups reported Bugzilla, wiki, Forge, Patchwork, or administrative roles.[8] This is not a representative census, and Sourceware does not present it as one. It is still better planning evidence than guessing which services matter from traffic alone. The response gap also identifies a governance task: decisions must not silently treat the most engaged fifth as the whole constituency.

Independence is a topology, not solitude

Sourceware remains dependent on outside organizations. Red Hat and OSUOSL host major systems; universities and companies supply workers across x86-64, Arm, Power, s390x, SPARC, and RISC-V; volunteers operate services; donors and corporate sponsors fund work; Conservancy handles the legal layer.[4][5] The achievement is not independence from all patrons. It is a topology in which no one resource relationship automatically controls the platform or the hosted code.

The two-per-employer PLC limit constrains one obvious capture path. Public office hours and financial pages create observation points. Two data-center relationships and multiple compute partners reduce some physical concentration. Separating the PLC from hosted-project maintainers prevents an infrastructure committee from turning a server migration into a toolchain roadmap decision.[3][5]

None of those controls is self-executing. Employer diversity on paper can coexist with social concentration. Two facilities do not prove that restoration has been tested or that the same sponsor is absent from both failure paths. A public budget can omit the unpaid labor on which every service depends. Conservancy's legal capacity can protect volunteers while also adding a small staff queue to urgent transactions.

The strongest falsifier would be a retreat from inspectability: an inactive or employer-concentrated PLC, financial updates that stop explaining priorities, open office hours that cease, major infrastructure commitments made before community review, or a recovery plan that depends on one donor despite the multi-partner diagram. In that state, fiscal sponsorship would remain legally real but cease to be a useful maintenance signal.

What another project should copy—and what it should not

The Sourceware pattern fits a mature project with a public-interest mission, an active contributor community, assets or revenue to manage, contracts to sign, and leaders who want technical responsibility without becoming nonprofit administrators. It is especially valuable when several commercial users depend on the project but no single company should own its institutional layer.[2]

A tiny project receiving a few donations may reasonably decide that a 10% share and comprehensive process are too expensive. A large foundation-scale ecosystem may need its own staff and legal entity. A young project without a durable community may not meet Conservancy's acceptance criteria. Fiscal sponsorship is not a maturity badge, and a PLC is not a substitute for maintainers.

The reusable lesson is narrower. Write down who controls shared infrastructure, who may commit the project's money, how employer affiliation is constrained, where technical authority stops, what happens when someone leaves, and which reports let outsiders test the arrangement. Then fund the queues that hardware creates.

Sourceware's third-year signal is encouraging because the paperwork has crossed into operations: partner agreements, public budgets, open meetings, multi-site migration, and a proposed shift toward paid human work. The critical toolchain is still maintained by its projects. The infrastructure beneath it now has somewhere durable to put a contract—and someone publicly accountable for deciding whether to sign.

cronfeed.work