OpenSSF and Tech Giants Call for Sustainable Funding to Secure Global Software Supply Chain

The OpenSSF (Open Source Security Foundation) Governing Board has issued an urgent call for a fundamental shift in how the world’s most critical software infrastructure is funded. In a move that highlights the growing fragility of the modern digital economy, the board is urging enterprises that rely heavily on public package registries to provide more robust and predictable financial support, warning that the current model—largely dependent on volunteer labor and donated resources—is no longer sustainable in the face of escalating threats and unprecedented demand.

The call to action was formalized through a pledge signed by several of the most influential names in the technology sector, including GitHub, Google, IBM, Microsoft, and Sonatype. These organizations, which both contribute to and consume vast amounts of open-source software, have acknowledged that the infrastructure underpinning the global software supply chain is under immense pressure. The pledge outlines a stark reality: public package registries are facing a dual crisis of rising operational costs and an urgent need for massive investment to bolster security and improve the developer experience.

Public package registries such as npm, PyPI, Maven Central, crates.io, RubyGems, and NuGet serve as the central nervous system for modern software development. They are the repositories from which developers pull the pre-written code modules and libraries that make up the vast majority of modern applications. However, despite their critical role, many of these registries have historically operated on a "best-effort" basis, often managed by small, dedicated teams and funded through the goodwill of corporate donors or parent organizations.

According to the OpenSSF and its signatories, this "survival mode" of operation is no longer compatible with the needs of a global economy that depends on these systems for security, reliability, and compliance. The firms noted that every organization building software today depends on these registries, yet the demands being placed on them—ranging from high availability to advanced threat detection—are growing faster than the resources available to meet them.

The Mounting Pressure of Trillions of Downloads

The scale of the challenge is reflected in the sheer volume of traffic these registries now handle. Public repositories currently serve trillions of downloads annually, with growth rates remaining consistently high at between 30% and 50% year-over-year. This exponential increase in demand places a heavy burden on the physical and cloud infrastructure required to host, mirror, and distribute packages globally.

As download volumes soar, the operational complexity of maintaining these systems increases. Registries must ensure that packages are available 24/7, that download speeds remain consistent across different geographic regions, and that the integrity of the code being distributed is never compromised. In the current landscape, many registries still rely on a patchwork of donated infrastructure credits from cloud providers and are managed by teams that sometimes consist of as few as two or three people. The OpenSSF warns that this lean staffing and reliance on charity make the registries vulnerable to outages, slower responses to emerging threats, and a general lack of visibility across the supply chain.

The financial pressure is not merely about keeping the lights on; it is about keeping the gates shut against increasingly sophisticated adversaries. The software supply chain has become a primary target for cybercriminals and state-sponsored actors who seek to inject malicious code into widely used libraries. The OpenSSF reported that in the current year alone, 1.8 million malicious packages have been discovered across various registries.

Furthermore, the advent of artificial intelligence is expected to exacerbate these security challenges. The foundation anticipates that AI-driven tools will lead to a three-to-fivefold increase in "publish events," as automated systems generate and push more package versions and updates to public registries. While some of this activity will be legitimate, the sheer volume will make it harder for human moderators and traditional security tools to distinguish between helpful updates and automated attacks.

Moving Beyond Survival Mode

The core of the OpenSSF’s argument is that sustainable funding would allow registries to move beyond basic maintenance and toward a more proactive, enterprise-grade service model. With predictable and recurring revenue streams, registries could implement the advanced features that modern enterprises now demand but are currently unable to receive from free public services.

Among the proposed improvements are the implementation of dedicated support channels for high-volume users and the creation of private or peered access points. Such optimizations would allow large-scale consumers to pull packages more efficiently, reducing latency and improving the reliability of their internal build pipelines. Additionally, funding would enable registries to offer more sophisticated monitoring, alerting, and operational support, significantly minimizing the risk of downtime that can stall development for thousands of companies simultaneously.

From a security perspective, the benefits of a sustainable funding model are even more pronounced. The OpenSSF envisions a future where registries can offer comprehensive security features as a standard part of their operation. This includes artifact signing and trusted publishing mechanisms to verify the identity of package authors, as well as automated malware scanning and quarantine procedures to catch malicious code before it is downloaded by millions of users.

Furthermore, registries could provide critical data for compliance and auditing, such as the generation of Software Bills of Materials (SBOMs) and Vulnerability Exploitability eXchange (VEX) documents. These tools are becoming essential for organizations as they navigate new regulatory requirements and internal security policies. Without a more robust funding model, the registries will struggle to provide the build provenance attestations and incident response Service Level Agreements (SLAs) that are now considered table stakes in the enterprise world.

A New Model for Enterprise Consumers

The OpenSSF has clarified that this new push for sustainability is specifically targeted at enterprise commercial customers rather than the broader, independent developer community. The goal is to create a tiered ecosystem where large corporations that derive significant commercial value from these registries contribute to their upkeep, while individual developers and small organizations continue to access the repositories for free.

The proposed model does not commit any individual registry to a specific pricing structure, nor does it mandate specific terms or tiers. Instead, it serves as a framework and an invitation for industry-wide engagement. The OpenSSF is calling on enterprise consumers to evaluate their reliance on these registries, understand the sustainability needs of the specific ecosystems they use, and prepare to participate in funding models that ensure the long-term health of this infrastructure.

The message from the tech giants is clear: the era of treating public package registries as a "free lunch" must end if the industry wants to avoid a catastrophic failure in the software supply chain. By providing a stable financial foundation, the industry can unlock a new level of security and observability that benefits the entire ecosystem—from the largest tech conglomerates to the individual maintainers and developers who contribute to open-source projects.

The signatories of the pledge emphasized that supporting these registries is not just an act of corporate social responsibility, but a strategic necessity. Sustainable registries are more secure and more reliable, and a stronger open-source ecosystem ultimately benefits every stakeholder involved in the creation and consumption of software.

As the industry looks toward the future, the focus will shift to how these funding models are implemented and how registries will balance their commitment to the open-source community with the new requirements of their commercial supporters. For now, the OpenSSF’s call serves as a pivotal moment of recognition that the digital infrastructure the world takes for granted requires more than just code—it requires a commitment to the resources that keep that code safe and accessible.

FOLLOW US ON SOCIAL MEDIA

Follow ITPro on Google News and add us as a preferred source to keep tabs on all our latest news, analysis, views, and reviews.

You can also follow ITPro on LinkedIn, X, Facebook, and BlueSky.