CTI - Making a decision for glibc.

[Mark Wielaard]

Hi Zack, Hi Sid,

On Tue, Feb 03, 2026 at 03:46:12PM -0500, Siddhesh Poyarekar wrote:
> On 2026-02-03 13:54, Zack Weinberg wrote:
> >But I’m just not seeing
> >enough of a reason put forward to *bother* moving glibc.  A variety of
> >problems with sourceware have been articulated, but all of them strike
> >me as *easier* to fix in situ than by moving to new infrastructure.

Thanks for asking these questions, I am also a bit puzzled. There
indeed seems to be some miscommunication going on. I'll try to listen,
but maybe I also should communicate better how Sourceware as an
organization works.

> >A desire for additional funding has been articulated, but the primary
> >reason I’m aware of why money would be needed, is to pay developers
> >to work more on glibc, and salaries should have no reason to be tied
> >to hosting for the canonical VCS repository and bug tracker.

I do note that additional funding is always appreciated. And the
Sourceware PLC (with the help of the SFC) have done pretty well
imho. https://sourceware.org/mission.html#plc

The whole transition from bare metal servers to having everything run
in (bigger) VMs was funded through a grant, individual donations and
(in kind) organizational/corporate sponsorship. We now also have an
hopefully sustainable hardware replacement fund so we are good for the
next couple of years with hardware (which is less critical now that we
can just move VMs around).

And I think there is a valid criticism that we don't publish budgets
for how to run some of the services with some extra paid staff. We did
create such a budget for the security plans a few years back
https://sourceware.org/sourceware-security-vision.html
And we discussed concrete numbers with the OpenSSF which seemed
interested in funding such plans. But in the end they said they
couldn't fund that. So I am happy to hear they now apparently do have
some funds available and we'll update the plans and budget and try to
reconnect (I had a nice chat with the OpenSSF program manager at
Fosdem).

Also Zoe, the FSF Director, is going to talk with the LF/OpenSSF about
funding for the GNU Toolchain. The FSF was created specifically to
fundraise for the GNU projects, so there are some legitimate questions
about moving that activity to some other entity.

> >So, as I said last time around: Proponents, please *explain your
> >reasons for seeking to move glibc*.  Not the criteria you chose
> >for evaluating funding and/or hosting source, but the reasons
> >why you were out there looking for funding and/or hosting sources
> >in the first place!
> >
> >Explain how you have tried and failed to fix the technical issues
> >in situ; explain why it wouldn’t be *more work* to fix them in
> >conjunction with a move.  Explain what you plan to do with the money,
> >and why you consider “only if we also provide the hosting” an
> >acceptable condition attached to the money.
> >
> >Go all the way back to the beginning of your thought process.
> >Be specific.  Be detailed.  Be candid.  Let the rest of us understand
> >your thinking.  Because right now, I repeat, knowing only what I know,
> >it seems to me that a move is *unnecessary*.
> 
> OK, I'll bite.  Let me share my personal perspective.  It's candid
> (as you requested) and it is opinionated and hopefully spells out
> why I strongly back the migration of GNU toolchain services.  Others
> may have a different view of all of these events and I can live with
> that.

I won't try to "correct" you, this is how you experienced things. I
obviously experienced them slightly differently. I'll just note that
some of the issues you encountered are entirely new to me. Please in
the future always communicate these. I am not saying they aren't
issues. In general the reported issues (especially with service
availability) are resolved within 24 hours. There are various ways to
report issues: https://sourceware.org/mission.html#organization

The Sourceware PLC does take the various cyber security regulations
serious and with the help of the SFC and FSFE we have been updating
our proposed policies and guidelines for hosted projects:
https://sourceware.org/cyber-security-faq.html

In general I think Sourceware would love to get more paid staff, but
in a sustainable way. We are updating our budget proposal for that
right now. We already have diverse funding through grants, individual
donations and (in kind) corporate and organizational sponsorship. More
is always welcome and we'll make sure companies can donate for
specific spends. The SFC already has those vendor accounts with large
companies setup precisely because those companies have already donated
through them for various projects.

Cheers,

Mark