## Canvassing for the commons <p><img data-src="images/archlinux.png" height="128px"></p> <p>FrOSCon 2026</p> <p>David Runge</p>

## Overview * [Distributing the commons 📦](#distributing-the-commons-📦) * [The funds 💶](#the-funds-💶) * [Public access 🚪](#public-access-🚪) * [Corporate 🧑‍💼](#corporate-🧑‍💼)

### `$whoami` * Freelance software developer * Arch Linux Package Maintainer (2017)/ Developer (2019)/ Main Signing Key (2021) * Rust, Python, packaging

## *"Previously..."* * Hacking in Parallel 2022 - [Pacman can have the cookies and eat the ghosts too](https://pkgbuild.com/~dvzrv/presentations/hacking-in-parallel-2022/2022-hip22-pacman_can_have_the_cookies_and__Pe5aLaW.pdf) * All Systems Go! 2023 - [Oxidizing the Arch Linux packaging infrastructure](https://pkgbuild.com/~dvzrv/presentations/all-systems-go-2023/) * All Systems Go! 2024 - [Boring Infrastructure: Building a secure signing environment](https://media.ccc.de/v/all-systems-go-2024-263-boring-infrastructure-building-a-secure-signing-environment) * All Systems Go! 2025 - [Verification of OS artifacts without stateful keyrings](https://media.ccc.de/v/all-systems-go-2025-374-verification-of-os-artifacts-without-stateful-keyrings) * Foss North 2026 - [Signing distribution artifacts with Signstar](https://pkgbuild.com/~dvzrv/presentations/foss-north-2026/)

## Slides 🔗 <a href="https://pkgbuild.com/~dvzrv/presentations/froscon-2026/"><img src="images/slides-link.png"></img></a>

## Distributing the commons 📦

### Distribution in a nutshell 🥜🐚 - International - Volunteers - Development and maintenance in free time - Various backgrounds - Loosely coupled structure and governance - Donations for infrastructure and events

### Tasks 🗃️ - Upstream software - Packages - Access - Support - Security

### Tooling ⚒️ - Package build tool - Package management tool - Website - Forge - Wiki - Issue tracking

### Transformations 🌬️ - Decouple overly centralized services - Reduce tech debt - Sunset legacy - Increase maintainability - Improve documentation

## The funds 💶

### Public access funds in focus 👁️‍🗨️ * [NLnet](https://nlnet.nl) * [ProtoType Fund](https://prototypefund.de) * [Sovereign Tech Fund](https://www.sovereign.tech/programs/fund)

### Moar funds [Awesome Maintainer Funding](https://codeberg.org/mechko/awesome-maintainer-funding) (by [Mirko Swillus](https://swillus.eu/))

### Corporate sponsorship [Valve Corporation](https://www.valvesoftware.com/)

## Public access 🚪

### NLnet - [NLNet Foundation](https://nlnet.nl/foundation/) distributes funds by the European Commission in a [conglomerate](https://nlnet.nl/commonsfund/background/#organisation) - [NGI Zero Commons Fund](https://nlnet.nl/commonsfund/) for research & development - Many other programs (e.g. [NGI Assure](https://nlnet.nl/assure/) and [User Operated Internet Fund](https://nlnet.nl/useroperated/)) - Available world-wide (with exception to sanctioned countries) - Payments as "donations" based on a Memorandum of Understanding (MoU)

### NLnet: Case study 1 (1/2) - [NGI Assure](https://nlnet.nl/assure/) and [User Operated Internet Fund](https://nlnet.nl/useroperated/) - 2022-05-31: Application for [repod](https://repod.archlinux.page) (Python based application for managing binary package repositories for Arch Linux) - 2022-06-05: Acknowledgement of receipt - 2022-07-20: Rejections for NGI Assure and User Operated Internet Fund (first round, no specific comments) 🙅

### NLnet: Case study 1 (2/2) - [NGI Assure](https://nlnet.nl/assure/) and [User Operated Internet Fund](https://nlnet.nl/useroperated/) - 2022-10-03: Application for [repod](https://repod.archlinux.page) (Python based application for managing binary package repositories for Arch Linux) - 2022-10-03: Acknowledgement of receipt - 2022-11-18: Rejection for NGI Assure (first round, no specific comments) 🙅 - 2022-11-22: Rejection for User Operated Internet Fund (first round, no specific comments) 🙅

### NLnet: Case study 2 - [NGI Assure](https://nlnet.nl/assure/) - 2023-01-26: Request for taking over [Machine usable output for Sequoia](https://nlnet.nl/project/MachineReadable-sq/) (previously [Lars Wirzenius](http://liw.fi/)) approved on 2023-01-30 - 2023-07-07: Request for Payment - 2023-11-14: Resignation from project 🏃‍➡️

### NLnet: Case study 3 - [NGI Zero Core](https://nlnet.nl/core/) - 2023-08-01: Application for _"Specifications, parsers and writers for files used in Arch Linux Package Management (ALPM)"_ (see also [ALPM](https://alpm.archlinux.page)) - 2023-08-10: Acknowledgement of receipt - 2023-09-22: Selected for round two review - 2023-09-25: Round two questions - 2023-11-07: Rejection 🙅

### NLnet: Case study 4 - [NGI Assure](https://nlnet.nl/assure/) - 2023-10-16: Request to be added to [Hardening OpenPGP CA deployments](https://nlnet.nl/project/OpenPGPCA-HSM/) - 2023-12-21: Memorandum of Understanding (MoU) changed - Finished work items successfully 🥳

### NLnet: Case study 5 - [NGI Assure](https://nlnet.nl/assure/) - 2023-12-21: Request to be added to [Improving OpenSSH's Authentication and PKI](https://nlnet.nl/project/OpenPGP-OpenSSH/) - 2024-01-10: Re-request to be added to the project (never got acknowledgement) - Finished work items successfully 🥳

### NLnet: Case study 6 - [NGI Zero Core](https://nlnet.nl/core/) - 2024-01-31: Application for [krctl](https://gitlab.archlinux.org/dvzrv/krctl) (_"Rust-based commandline tool for managing a curated OpenPGP keyring"_) - 2024-02-09: Acknowledgement of receipt - 2024-04-12: Selected for round two review - 2024-05-20: Round two questions - 2024-05-30: Rejection 🙅

### NLnet: Case study 7 - [NGI Zero Core](https://nlnet.nl/core/) - 2024-01-31: Application for [signstar](https://signstar.archlinux.page) _"Rust-based generic signing enclave with the help of a Hardware Security Module (HSM) as backend"_ - 2024-02-09: Acknowledgement of receipt - 2024-04-12: Selected for round two review - 2024-05-20: Round two questions - 2024-05-30: Rejection 🙅

### NLnet conclusion - Applications successful: 0/5 - Days between application and decision: ~87 (50, 50, 98, 119, 119) - Rather intransparent process, bias towards certain technologies (see [Operating System Bias in Next Generation Internet and NLnet](https://sleepmap.de/2023/operating-system-bias-in-next-generation-internet-and-nlnet/)). - Projects can be extended (also with new people) as needed. - Tax-wise, the funding is as if one is invoicing a private person for a service (VAT needs to be included).

### Prototype Fund - The German [Open Knowledge Foundation Deutschland e. V.](https://okfn.de/en/) conveys German tax money to research and development in new projects. - Funding is based on the process of a project executing organization (no common invoices). - Mostly tax-free for German freelancers due to German tax law.

### Prototype Fund: Case study 1 - 2022-03-18: Application for [repod](https://repod.archlinux.page) (Python based application for managing binary package repositories for Arch Linux) - 2022-06-03: Rejection 🙅 (1/171, no specific comments)

### Prototype Fund: Case study 2 - 2022-09-30: Application for [repod](https://repod.archlinux.page) (Python based application for managing binary package repositories for Arch Linux) - 2022-12-02: Communication about extension of required time for review - 2022-12-07: Rejection 🙅 (1/150, no specific comments)

### Prototype Fund: Case study 3 - 2025-11-28: Application for [justpkg](https://gitlab.archlinux.org/dvzrv/justpkg) (Rust-based package creation tool for Arch Linux) - 2026-12-02: Notification about start of review process - 2026-01-06: Notification about Prototype Fund Review and of external review - 2026-02-16: Notification of acceptance 🥳 (1/458) - 2026-04-14: Application for internal process 📝 - 2026-06-01: Start of project work ⏱️

### Prototype Fund conclusion - Applications successful: 1/3 - Days between application and decision: ~75 (77, 68, 80) - Transparent process. - The project setup is very rigid (the people applying must be the ones executing, only freelancing or GbR possible). - Tax-wise, the funding appears to be tax-exempt (according to previous people).

### Sovereign Tech Agency - Run by the German [Sovereign Tech Agency](https://www.sovereign.tech/), which provides grants to free software projects based on German tax money. - Maintenance and features. - Funding is based on common contracting practices with invoices.

### Sovereign Tech Agency: Case study 1 - [Contribute back challenge](https://www.sovereign.tech/programs/challenges/participants) - [OpenPGP documentation for application developers](https://www.sovereign.tech/tech/openpgp-documentation) - 2023-09-01 -- 2023-12-31 - Finished work items successfully 🥳

### Sovereign Tech Agency: Case study 2 - [Contribute back challenge](https://www.sovereign.tech/programs/challenges/participants) - 2023-07-05: Application for [ALPM](https://alpm.archlinux.page) (Specifications, parsers and writers for files used in Arch Linux Package Management) - 2023-08-31: Rejection 🙅 (no specific comments)

### Sovereign Tech Agency: Case study 3 - [Sovereign Tech Fund](https://www.sovereign.tech/programs/fund) - 2023-10-09: Application for [ALPM](https://alpm.archlinux.page) (Rust-based Arch Linux Package Management (ALPM) Framework) - 2023-11-28: Request for video meeting - 2024-03-20: Review delay - 2024-04-23: Further review delay - 2026-05-31: Application for internal process 📝 - 2024-07-01: Notification of acceptance 🥳 - 2024-10-01: Start of project work ⏱️ - 2025-12-31: Finished work items successfully 🥳

### Sovereign Tech Agency conclusion - Applications successful: 1/2 - Days between application and decision: ~162 (57, 266) - Unfortunate timing: Transformation from SPRIND GmbH to Sovereign Tech Agency GmbH - Transparent process. - The project setup is flexible (new subcontractors can be added as needed). - Common invoicing (B2B).

## Corporate 🧑‍💼

## Valve Corporation - Uses Arch Linux based OS on their custom hardware - Sponsors work by members of the Arch Linux team on related projects

## Signstar - <https://signstar.archlinux.page> - Designed to automate the digital signatures for package files, repository metadata (and more) in the near future. - Generic enough to be used for other digital signature purposes, too. - Sponsored since July 2024

## Buildbtw - <https://gitlab.archlinux.org/archlinux/buildbtw/> - Designed to automate the building of package sets and to become the default, centralized build tool for the distribution in the future. - Sponsored since July 2024

### Valve corporation conclusion - Contact established based on luck. - Common contracting work (B2B).

## Discussion 💬

### Types of funding - Diverse landscape of funds 🌈 - Goal orientation vs. dependence ☯️

### Usefulness - Is it needed? - Does it provide new/additional input to an existing problem domain? - Can it be maintained without continuous funding? - How likely is it to gather or extend a community?

### Is it good, actually? - Applications are work, too ✍️ - Power imbalance ⚖️ - Conflict 💥

### And now some ads - [ALPM](https://alpm.archlinux.page) - [Justpkg](https://gitlab.archlinux.org/dvzrv/justpkg) - [Signstar](https://alpm.archlinux.page) - [VOA](https://voa.archlinux.page)

## Thanks 🙏 - Arne Beer ([@nukesor@chaos.social](https://chaos.social/@nukesor)) - Heiko Schaefer ([@hko@floss.social](https://floss.social/@hko)) - Wiktor Kwapisiewicz ([@wiktor@metacode.biz](https://metacode.biz/@wiktor)) - [ProtoType Fund](https://prototypefund.de) - [Sovereign Tech Fund](https://www.sovereign.tech/programs/fund) - [Valve Software](https://www.valvesoftware.com/en/)

## Contact ☎️ - [Arch Linux's GitLab](https://gitlab.archlinux.org/dvzrv) - [David Runge \<dave@sleepmap.de\>](mailto:dave@sleepmap.de) - [@dvzrv@chaos.social](https://chaos.social/@dvzrv)

## ???