Open Source Funding Has Turned Ideological. Your Stack Didn't Get a Vote
The money keeping your base-layer software alive increasingly comes with a worldview attached. That turns funding into a forking mechanism, and 'which branch am I on?' into a question your risk register has never asked.
The most dangerous assumption in your stack is that the boring parts are settled. Over the past three years the cache layer, the search index and the infrastructure-as-code tool, components whole businesses standardised on precisely because they looked permanent, have each split into rival, separately funded branches. Open source funding used to be too dull to ask about. Now it decides which branch of your own platform survives, and nobody sent your procurement team the memo.
Take the infrastructure layer first. In August 2023 HashiCorp moved Terraform and its other flagship tools from the open Mozilla Public License to the Business Source License, which bars competitors from using them in production. Within days, firms whose products depend on Terraform published the OpenTofu manifesto, and by September the fork had a home at the Linux Foundation, its backers pledging full-time engineers to it for at least five years. Terraform's licence and Terraform's community now live in different buildings.
The cache ran the same play faster. In March 2024 Redis dropped the permissive BSD licence it had carried since its first release in favour of dual source-available terms. Within days the Linux Foundation announced Valkey, a fork of the last BSD release, with AWS, Google Cloud and Oracle among its backers. Fourteen months on, Redis 8 added the AGPLv3, an OSI-approved open licence, back to its options.
The search index ran the full arc first. Elastic relicensed Elasticsearch and Kibana away from Apache 2.0 in January 2021, a move aimed squarely at AWS. AWS responded by forking both as OpenSearch, which now sits inside its own foundation under the Linux Foundation umbrella. In August 2024 Elastic added AGPLv3 and declared that Elasticsearch is open source again.
The retreats are the tell. Twice now a relicensed original has restored an open licence after its fork found institutional money. Neither company describes the sequence as capitulation, and the causal link is this desk's inference, not anything in a filing. But if funded forks were not working as leverage, it is hard to say what those reversals were for.
Where does open source funding actually come from now?
The old answer still covers most of the money: vendors employing maintainers and foundations pooling corporate subscriptions, both of which broadly reward commercial relevance. The newer money is not one thing. At least three distinct motivations now write cheques, and they want different worlds.
First, defensive consortium money: companies bankrolling a fork because their own products depend on terms the original abandoned. That is what Valkey's backer list is, and what OpenTofu's five-year engineering pledges are. No inference is needed here; the foundation announcements state the motive plainly. The funders are protecting their supply.
Second, state sovereignty programmes. Germany's Sovereign Tech Agency, financed through the federal economics ministry, pays for the maintenance of components almost nobody else will fund. Its published investment portfolio listed, as of early 2025, more than €23 million committed across more than 60 foundational technologies since financing began in late 2022, curl and WireGuard among them, explicitly in the name of European digital sovereignty. A funder class that did not exist five years ago is now disclosing eight-figure spend.
Third, values patronage, which is older than both and mostly smaller. Devuan has maintained a systemd-free fork of Debian ever since Debian's technical committee adopted systemd in 2014, sustained by the donations it solicits for exactly that independence. XLibre forked the X.Org display server in June 2025, pitching itself to volunteers and patrons as a refuge from upstream governance. And the GNU coreutils, GPL-licensed and stewarded within the GNU project since the early 1990s, now compete with uutils, an MIT-licensed Rust rewrite begun in 2013 and led today by Sylvestre Ledru, which Ubuntu 25.10 shipped as its default last October. Whether the people paying for these projects are buying governance dissent or simply software they prefer, no donor survey exists to say; their own appeals lean on principle, and this desk reads the money accordingly, as inference rather than record.
Note what the three classes do not share: a preferred future. Consortium money wants continuity of terms. Sovereignty money wants fewer, better-maintained shared components. Patronage exists to keep dissent alive. They pull in incompatible directions, each prepared to fund its own direction indefinitely, and talking about "open source funding" as if it were one stream is exactly how the risk hides.
Why do relicensed projects keep getting forked?
Because the forks no longer starve. When money followed commercial merit, a schism's losing side usually lacked the resources to persist, so arguments resolved. Now a credible fork can find a patron whose interest is the fork existing, whether that patron is a hyperscaler protecting a managed service or a donor base paying for independence. Devuan has demonstrated the durability of small patronage for over a decade; Valkey demonstrated the speed of large patronage inside a fortnight. Fork viability used to be a question of engineering capacity. On this desk's reading of the cases above, it is becoming a question of who is willing to pay, and why.
Which produces a continuity question that almost no procurement checklist contains: which funded branch of this component are we actually on, who bankrolls it, and is the other branch still getting security attention? You probably didn't choose your branch. Your distribution or your cloud provider chose it for you, and they change sides: Ubuntu's coreutils swap arrived in a release announcement, not in your change log.
What should your due diligence ask now?
Treat the funded branch, not the project name, as the unit of analysis. For each load-bearing component: which branch are we on, and by whose decision? Who funds it, and what do they want? What happens if the principal patron walks away, or the licence changes again? Are security fixes flowing between branches, and how quickly? And what would migrating to the sibling branch cost if our side of the fork loses?
None of this appears on a software bill of materials, which records what you're running but not who's paying for it to keep existing. Mapping it is unglamorous dependency work: exactly what a deliberate technical strategy exists to surface before it becomes an incident, and something an independent review reaches faster than an internal team that has always assumed the base layer was somebody else's problem.
The commons your business is built on is still there. It's just no longer one thing, and the people paying for its pieces no longer want the same future. Find out whose future you're funding by default. Then decide if you mean it.
Questions people ask
How do I find out who funds an open source project my business depends on?
Start with the project's own governance page, its foundation membership and any published sponsor list, then look at who employs the most active maintainers, since employment is the quietest form of funding. If those answers are hard to find, the opacity itself belongs on your risk register.
Is it risky to depend on a fork of an open source project?
Not inherently. A fork with sustained funding, several active maintainers and a working security process can be safer than a neglected original. The real risk sits in transition periods, when fixes land in one branch and reach the other slowly or not at all, so judge each branch on its operational evidence rather than on which side of the argument it sits.
Should my company fund the open source software it uses?
If a component failing would stop your product, paying its maintainers isn't charity, it's cheap insurance. A small slice of revenue routed upstream buys early warning, influence and goodwill. Just know that in the current climate your money is also a vote for a governance model, whether you intend it or not.
Related
- Epic v Google: The App Catalogue Remedy That Hands Rivals the Moat
- Memory Prices Turned. Renegotiate the Supply Contract Before the Next Refresh.
- How AI Makes Bad Bosses Worse: The Agreeability Machine in the Corner Office
- Digital Business
Written by an AI editorial persona of Abyshire's proprietary editorial system and reviewed by our team.