Overview
Foundations & Organisations
FSF, OSI, ASF, LF, CNCF, Eclipse, PSF, OpenSSF and others, and what a software foundation actually does.
Foundations & Organisations
Foundations exist to hold the things a volunteer project cannot: a trademark, a bank account, a legal person, and neutrality between competing employers.
What a foundation actually does
The concrete services
- Holds the trademark so no single company can capture the project's name.
- Holds copyright or CLAs and can enforce licences centrally.
- Provides a legal entity that can sign contracts, insure events, employ staff.
- Runs infrastructure: domains, CI, artifact signing, mail, DNS, CVE assignment.
- Administers money: membership dues, sponsorship, travel funding, paid maintainers.
- Vendor-neutral governance: charters, TSC elections, anti-trust cover for collaborators.
- Compliance plumbing: SBOM/schema hosting, security audits, disclosure coordination.
What it does not do
- It does not write your code or recruit your maintainers.
- It does not make a project popular, or legitimate on its own.
- It does not guarantee neutrality — large members buy influence with engineers.
- It is not free: membership dues, legal overhead, process.
- It cannot fix a licence the community has already rejected.
The definers and advocates
| Organisation | Founded | Role | Notes |
|---|---|---|---|
| Free Software Foundation (FSF) | 1985 | Defines and defends free software; publishes the GPL family | Holds GNU copyright; runs licensing compliance |
| Open Source Initiative (OSI) | 1998 | Maintains the Open Source Definition and approved-licence list | Public, deliberately slow licence review; published OSAID 1.0 in Oct 2024 |
| Software Freedom Conservancy (SFC) | 2006 | Fiscal sponsor plus GPL enforcement | Home to Git, Selenium, Inkscape, QEMU, Wine; 2021 Vizio suit |
| Software in the Public Interest (SPI) | 1997 | Fiscal host for Debian, PostgreSQL, FFmpeg | Umbrella, not a technical foundation |
| FSFE | 2001 | EU-policy advocacy, REUSE spec | Independent of the FSF |
Project-hosting foundations
| Foundation | Founded | Known for | Typical licence |
|---|---|---|---|
| Apache Software Foundation | 1999 | Hadoop, Kafka, Spark, Tomcat, Lucene, Airflow, Maven | Apache-2.0 + ICLA/CCLA; PMC meritocracy |
| Linux Foundation | current form 2007 (OSDL + Free Standards Group) | Linux kernel, OpenTofu, Valkey, SPDX, RISC-V | Varies; Apache-2.0 common |
| CNCF | 2015 | Kubernetes, Prometheus, Envoy, Falco, Harbor, OpenTelemetry | Apache-2.0; sandbox → incubating → graduated |
| Eclipse Foundation | 2004 | Eclipse IDE, Jakarta EE, Adoptium/OpenJDK | EPL-2.0; strong IP due diligence |
| Python Software Foundation | 2001 | CPython, PyPI, PyCon | PSF License (BSD-like) |
| Mozilla Foundation | 2003 | Firefox, Thunderbird, Rust origins | MPL-2.0 |
| Rust Foundation | 2021 | Rust, crates.io | MIT OR Apache-2.0 |
| OpenJS Foundation | 2019 | Node.js, jQuery, Webpack, Electron | MIT / Apache-2.0 |
| OpenSSF | 2021 | Sigstore, SLSA, Scorecard, security audits | Coordination body, not a project host |
| OpenInfra Foundation | 2012 | OpenStack, StarlingX, Kata Containers, Zuul | Apache-2.0 |
| NumFOCUS | 2012 | NumPy, pandas, Jupyter, SciPy, Matplotlib | Fiscal sponsorship + governance |
| FINOS | 2018 | Financial-services OSS (FDC3, Waltz, Morphir) | Apache-2.0 |
| OWASP Foundation | 2001 | ASVS, Top 10, CycloneDX, Dependency-Track | Produced CycloneDX, now ECMA-424 |
| GNOME Foundation / KDE e.V. | 2000 / 1997 | GNOME, KDE Plasma | GPL/LGPL family; membership-elected boards |
| The Document Foundation | 2010 | LibreOffice | MPL-2.0 |
How a project joins one
- Get the IP clean first. Is there a licence? Are there copyright headers? Do all contributors have a CLA/DCO on file? Unattributed contractor code is the most common blocker.
- Choose by fit, not prestige. ASF for JVM/data infrastructure and a strict meritocracy; LF/CNCF for cloud-native vendor neutrality; Eclipse for enterprise Java and IP due diligence; NumFOCUS or SFC if you mostly need a fiscal sponsor.
- Expect a charter defining scope, governance, IP and voting. Read the trademark policy first.
- Transfer the assets: trademark assignment, copyright/CLA assignment, domains, and usually a requirement to use an OSI-approved licence.
- Budget for participation: membership tiers run from a few thousand to several hundred thousand dollars a year.
Fiscal sponsorship is not the same as membership. Open Collective, NumFOCUS, SFC and SPI can hold money and pay maintainers without taking governance or IP. For most small projects that is the right first step, and it is reversible.
Where the money comes from
| Source | Typical share | Consequence |
|---|---|---|
| Corporate membership dues | The large majority for LF/CNCF/ASF/Eclipse | Big payers influence roadmaps and staffing |
| Conferences and training | Major for PSF, ASF, LF events | Revenue collapses in downturns |
| Individual donations | Dominant for FSF, FSFE, Debian, SFC | Smaller budgets, higher independence |
| Government and philanthropic grants | Growing — Germany's Sovereign Tech Fund (2022), EU, NL, US | Funds maintenance of shared infrastructure |
| Service fees / certification | Eclipse, LF training | Ties revenue to adoption |
Healthy scepticism
- Foundation-washing: donating a project while keeping the roadmap, the paid maintainers and the licence. Check who can outvote the community.
- Sandbox ≠ support: CNCF sandbox and LF incubation are maturity labels, not funding or guarantees.
- Neutrality is purchased, not declared: look at the trademark policy and the board seats.
- Exit matters: a good charter lets a project leave, and lets the community fork if the foundation fails it.
See also: Governance · Business models · Contributing · Security & supply chain