Open source carries an estimated $8.8 trillion replacement cost if it disappeared, according to a Harvard study, yet roughly 60% of maintainers are never paid for it. The gap is structural: there is no mechanism that collects payment where software is distributed, so maintainers go unpaid regardless of how grateful users are. Everyone agrees it has to be fixed; the argument is over which of three mechanisms closes it: acquisition, foundation stewardship, or registry royalties.
Acquisition means a company buys the project. Foundation stewardship means a neutral home holds the IP and governance. Registry royalties mean a levy collected where packages are distributed. Each closes the gap differently and fails on a different axis. By the end you’ll be able to judge any model on the four axes that matter. This is one part of the full reckoning.
Why did Shopify acquire Tailwind Labs, and what did the deal reveal about funding models?
The September 2026 deal is acquisition’s proof and its warning. It rescued the code but not the funding model: the framework kept its MIT licence and 110 million weekly installs, while revenue collapsed and the commercial products were wound down.
Tailwind announced it was “joining Shopify” for a stable long-term home, where everything would stay MIT-licensed and the team would keep maintaining the projects.
On the commercial side it was different. Documentation traffic dropped 40% since early 2023 and revenue fell 80% because AI assistants now generate Tailwind code directly, and docs were how users found the paid products. Three of four engineers lost their jobs in January 2026, and Tailwind Plus and ui.sh were wound down.
Acquisition funds the founder and is a one-off exit that stabilises one project. The pattern is now familiar: HashiCorp changed Terraform’s licence in 2023 and the OpenTofu fork formed under the Linux Foundation, before HashiCorp was bought by IBM. The 2026 examples keep coming, from Vercel buying Better Auth to Aikido buying Root for $70 million.
Acquisition vs foundations vs registry royalties: which model funds open source?
Acquisition stabilises one project, but it doesn’t fund the commons. That’s where the other two models come in. None of the three funds the whole commons on its own, and the funding gap in context is what each leaves partly unclosed. Acquisition rewards an individual, a foundation spreads governance, and a registry levy spreads money automatically. The answer depends on whether you want a structural fix or a point fix.
Run the four axes. Acquisition: the acquirer pays, the acquirer decides governance, and the licence may survive, but there is no guarantee for the commons and nothing for the next project down the stack. Foundation stewardship: a neutral home like the Linux Foundation or the Django Software Foundation holds IP and governance and funds staff. Django funds three Fellows and has raised its annual goal to $500,000, and is hiring an Executive Director. But only about 3% of maintainers get foundation money. Registry royalties: a levy collected at the package registry that pays maintainers pro rata, the only mechanism that collects from every commercial user automatically.
The fork is charity versus mandate. Patronage is optional and reversible: GitHub Sponsors passed $100 million in payouts, and the Open Source Pledge asks $2,000 per developer per year, but someone can stop paying tomorrow. A registry levy or a funded foundation role is closer to a mandate because it is built into distribution rather than left to goodwill. Snyk and Chainguard already monetise free code, so the money is there; the missing piece is a mechanism that passes it to maintainers.
What is a registry royalty model for funding open source?
A registry royalty is a levy collected where software is distributed, rather than in the licence, where the free-code equilibrium makes charging futile. The money is pooled and paid pro rata to every package in a paying customer’s dependency tree.
A small per-download or per-revenue levy is collected at the package registry (npm, Docker Hub, Maven Central), then pooled and paid out monthly to every package a paying customer depends on. The registry is the natural collection point because it is the choke point: it cannot be copied the way code can, so it cannot be forked around the way a licence can. The registries will serve over 10 trillion downloads in 2026, and the warning that “commercial-scale use without commercial-scale support is unsustainable” comes from the registries themselves.
Docker is the working precedent. Docker Desktop became paid for companies above 250 employees in 2021, and revenue grew from roughly $12 million in 2020 to $207 million in 2024 despite free alternatives. The backlash confirmed that the charge that works bills the company, not the download. npm is the volume registry whose scale makes a royalty both plausible and contentious, and Sonatype’s Maven Central sees 86% of its traffic from cloud providers.
The objections are real: who sets the rate, who audits the pool, and whether it repels the ecosystem. The first objection is that this is just Tidelift again. The difference is where the money is collected: Tidelift sold corporate subscriptions project by project, which required opt-in, whereas a royalty sits on the mirror bill your team never treats as a decision. thanks.dev already does pro rata distribution, and Flossbank tried in 2020 before dying for want of opt-in. With 99.999% of companies freeloading, opt-in is not enough, and AI slop is only making the registry harder to run by hand: a swarm of OpenAI-run agents published thousands of packages to RubyGems in two days, which is what the AI slop that broke the registry looks like.
Acquisition is an exit, a foundation is a home, and a registry royalty is a meter. Only the meter runs automatically. Judge every funding route on the structural-or-one-off test and the choice gets simple.
Funding and governance are a procurement question, not a donation decision. Before you trust any funding route, assess a dependency’s governance. That is how the three resolutions connect to the action a team can take.
Frequently Asked Questions
Why is the open source funding gap described as structural rather than a money problem?
Because no mechanism collects payment where software is distributed. The commons carries an estimated $8.8 trillion replacement cost, yet roughly 60% of maintainers are unpaid; licences like MIT make code free to fork, so charging through the licence is futile. The problem is not a shortage of gratitude or goodwill, it is the absence of a structural collection point.
How much do open source maintainers actually earn from their projects?
Very little. Most maintainers are unpaid, and even celebrated projects rarely translate popularity into sustainable income. After the 2026 Shopify acquisition, Tailwind’s revenue fell nearly 80% and its commercial products were wound down. For the people the industry relies on, dependable pay is the exception rather than the rule.
What happens to the licence when a company acquires an open source project?
It often survives, but not always. Tailwind kept its MIT licence through the Shopify deal, so the code stayed free and forkable. Elsewhere the licence is the point of change: HashiCorp moved away from open licensing, which triggered the OpenTofu fork and, eventually, the IBM acquisition. Acquisition does not guarantee a permanent licence.
Is a registry royalty just Tidelift with a new name?
No, the mechanism is different. Tidelift pays maintainers through corporate subscriptions negotiated project by project, which requires opt-in. A registry royalty is collected automatically at the point of distribution, such as npm or Docker Hub, and paid pro rata across a customer’s whole dependency tree. It scales by default rather than depending on goodwill.
Can a foundation pay maintainers enough to make it a career?
Rarely at scale, though it helps specific projects. A neutral home like the Linux Foundation or Django Software Foundation can fund staff and hold governance, which gives a project stability. But only about 3% of maintainers report receiving foundation money, so stewardship tends to secure a single project rather than pay the wider commons.
Why do companies like HashiCorp change their open source licence?
Usually to monetise work that competitors resell for free. When a cloud provider can offer a company’s software as a service without paying, the licence becomes the only lever left to charge. HashiCorp’s change triggered the OpenTofu fork, showing that licence shifts protect revenue but fracture the commons.
Would a registry royalty make open source more expensive for small teams?
It is designed not to. Most proposals levy commercial users, often above a size threshold, the way Docker Desktop is free for individuals and paid above 250 employees. Small teams and hobbyists would typically stay exempt, while large commercial consumers, who capture most of the value, would pay the levy.
What can a CTO do right now to fund the dependencies they rely on?
Start with visibility, then structure. Map the critical packages your stack depends on, check whether each has governance or a funded maintainer, and consider direct funding schemes such as the Open Source Pledge or GitHub Sponsors. Treat the top of that list like any other supply-chain risk, with a budget line, not a donation.
What is the difference between funding the finder and funding the fix in open source security?
Funding the finder pays whoever wrote the vulnerable line; funding the fix pays whoever patches it. Most security money, including OpenSSF and the proposed Great Refactor Fund, funds the fix. That leaves the original maintainer, often unpaid, with no reward for the code that created the exposure in the first place.
Is GitHub Sponsors enough to fix open source funding?
No, because it is optional and reversible. Sponsorship is patronage, not a mandate: someone can stop paying tomorrow, and most users never contribute at all. It helps individual maintainers who already have visibility, but it cannot close a structural, trillion-dollar gap on its own. The meter has to run automatically.
What is the free-rider problem in open source funding, and why does it matter?
It means users capture the value of open source without paying for it, and it is why voluntary models struggle. Flossbank foreshadowed pro rata registry funding but died for want of opt-in. When funding depends on goodwill, most beneficiaries free-ride, which is exactly the gap a levy built into distribution is designed to close.
