Once upon a time, open-source projects existed in the free-wheeling, wild west of the Internet, the bailiwick of hobbyists and iconoclasts. Projects ran without formalities, or legal entity structures, or oversight. And that was a powerful and effective model to kickstart the free software movement. It worked pretty well for years, when open-source was a niche in the technology world.

But as open-source became the backbone of modern computing, cracks started to sprout in that model. There were some problems that loose collections of developers could not easily solve. A string of notorious security breaches (Heartbleed, Log4shell, and others), along with and other kinds of personality-driven discontinuity (the Left-Tab fiasco) demonstrated how vulnerable our world–and its businesses–are to the quality of open-source project governance. Projects running on shoestring budgets were an industry-wide problem, and there were calls for corporate interests to put their money where their tech was, and start supporting community projects.

Today, we have more choices to house and govern open-source projects, and those choices are expanding. We still have unstructured projects, run by a BDFL (benevolent dictator for life), but businesses don’t like to rely on paradigms with single points of failure. We also have government-funded projects, academic projects, commercial open-source software (COSS) projects, and projects stewarded by open-source foundations. And all of these can work, in the right circumstances.

 Enter the Foundations

For about a decade now, open-source foundations like Apache Foundation and Linux Foundation have become the go-to homes for many projects. That happened largely because these foundations provided a much-needed structure for project operations. Smaller projects needed their umbrella to operate as not-for-profit entities, because setting up an entity on their own could be expensive and time-consuming. Larger projects needed their umbrellas to pool development funds and create neutral ground for running the project. After all, corporate rivals might give money to the Linux Foundation to run a project, but they won’t give it to each other.

The foundations are not without their challenges. Some community members worry that the larger foundations are becoming monolithic and inflexible. And many foundation projects tend to be controlled by large corporate interests who provide their funding. That’s not surprising: he who pays the piper calls the tune.

So we need some alternatives.

B-Corp: A New Model

In late 2022, Rocky Enterprise Software Foundation (RESF) was formed to provide an alternative home for open-source projects. RESF is a B-corp (the B stands for benefit) – a reimagined kind corporation that has lately been gaining popularity. It is a traditional corporation with shareholders and by-laws and a board of directors, but it is attuned with today’s notions of stakeholder capitalism, equity, and social responsibility.

When developers start open-source projects, they want to avoid corporate interests hijacking their agenda. So they often assume that a not-for-profit entity is the obvious choice. Not-for-profit entities (if run correctly) are not subject to taxation, and donations to them are tax-deductible.

In reality, open-source projects fit awkwardly into the not-for-profit model–so much so that in the late 2000s and early 2010s there was a virtual moratorium by the IRS on approving open-source projects for non-taxable status. That moratorium was lifted after the IRS targeting scandal was aired in 2013. So now, open-source projects can secure the status, but it’s still awkward. Although most of the granddaddy foundations like Linux foundation or Apache Foundation are 501c3’s–charities–most new open-source foundations are 501c6’s–trade foundations. In other words, the IRS is still not convinced that giving away software is charity. That’s one reason why it is laborious to get 501c status for an open-source entity, and why projects instead turn to umbrella entities. They just don’t want the hassle (and cost) of creating an entity and arguing with the IRS, and maintaining an entity over the years.

But if you look deeper into why a not-for-profit structure is right for open-source projects, the answer is not usually about taxation at all. After all, individual donations to open-source projects are relatively rare, and corporate donors can expense their donations anyway. Open source projects gravitate toward not-for-profit structures mainly because of credibility and optics. It’s not so much a problem if the projects make money; it's a problem if they do stay true to the ethics of their open-source roots.

A B-corp can therefore be the best of both worlds. The ethics and philosophy of the organization can be embodied in its bylaws, vision and mission. That is a pact between the organization, its board, and its community. Those bylaws can be specific to open-source and to the benefit of everyone while not beholden to the requirements of the IRS.

Enter the RESF

In November, 2022, RESF launched its B-Corp charter and bylaws, documenting RESF’s governing structure and rules for hosting open-source projects, including its namesake project, Rocky Linux. In the spirit of transparency, the RESF published its principles and Bylaws, and a related FAQ. The RESF is a self imposed not-for-profit organization, structured to ensure that no single entity or individual will have undue influence, and there will be no “pay to play” for control. Board and leadership seats are earned rather than bought. In this way, RESF differs substantially from other open-source foundations, who tend to allocate project board seats among dues-paying members.

“The vision of the Rocky Enterprise Software Foundation is to create and nurture a community of individuals and organizations that are committed to ensuring the longevity, stewardship, and innovation of enterprise grade/class open-source software that is always freely available.”--RESF Bylaws and Charter

The RESF’s flagship project is Rocky Linux, which was created partially in response to Red Hat’s recent changes to the workflow of CentOS. CentOS was formerly a downstream version of RHEL (Red Hat Enterprise Linux), and for years, its downstream nature made it reliable and widely accepted by organizations who wanted an alternative to RHEL. In 2020, Red Hat announced that it would change CentOS to CentOS Stream, an upstream version to RHEL, which left a gap. Gregory Kurtzer, one of the original founders of CentOS, created Rocky Linux to fill that gap. Kurtzer wanted to ensure that corporate interests would never compromise the goals of the project. Rocky Linux’s first GA version was released on June 21, 2021, and has been gaining in popularity.

The RESF was created as a community home for not only Rocky Linux, but other open-source projects with similar needs for the stability and structure for enterprise software. RESF can help provide collaborative infrastructure, and does not require transfers of trademarks or other rights, the way other foundations do. Others may want to learn from the RESF model and start B-corps of their own.

More Choices, More Benefit

The creation of RESF is a welcome milestone in open-source governance. We have come a long way from the wild west days. Conventional foundations have also greatly advanced the state-of-the-art in open-source project governance. Now RESF provides a new alternative, intended to preserve the autonomy of open-source projects within a responsible structure, and widening the choices for new projects to find a home.

Author: Heather Meeker is a lawyer in private practice specializing in open-source software licensing, and a General Partner at OSS Capital. She advised RESF on its by-laws regarding open-source matters. CIQ provided input in writing this article.

Other noteworthy Linux and open-source stories:

• Linux desktop leaders unite behind Flathub app store. Here's why

• Ubuntu Lunar Lobster could be the surprise hit of 2023

• Companies can’t stop using open source