The other half
The maintainer profile
Both sides publish. Licensees say what they are standing on; licensors say who they are and whether they are all right.
The question it answers
Is React’s maintainer Meta, or three unpaid people?
Take any dependency you rely on and try to answer that in under ten minutes. For most of your tree you cannot, and for the ones where you can, the answer often surprises you. Which means that “give where it is needed”, the principle every giving-back scheme rests on, is not actually a principle. It is a wish, because need is not computable.
A maintainer profile is a small JSON file that makes it computable. Walk the tree, resolve each component to its maintainer, read their profile. The give-back report stops being a gesture and becomes a picture.
https://your-project.example/.well-known/maintainer.jsonWhat it says
| Field | What it is, and why it is that shape |
|---|---|
structure |
For-profit, not-for-profit, foundation, government, unincorporated, or individual. The single most useful fact, and the one people most often get wrong when guessing. |
maintainers.band |
1, 2-5, 6-20, 21-100, 100+. Bands, never headcount. Headcount is employment information and nobody needs it; a band answers the only question a licensee actually has. |
maintainers.paid |
none, some, all. Combined with the band, this is the fragility signal. |
funding.sufficient |
no, partly, yes. Self-assessed. The most useful field in the file and the hardest to fill in honestly. |
funding.channels |
Where money can go. Existing channels only. GitHub Sponsors, Open Collective, an invoice address. This project runs no payment rail and never will. |
funding.non_monetary |
What would help that is not money. Frequently the honest answer, and almost never asked. |
products |
Package URLs, so a crawler can join a dependency tree to this profile without guessing. |
updated |
A date. A profile untouched for four years is itself a signal, and an intended one. |
Every field asked for is a field somebody has to keep up to date, unpaid, forever. So the format asks for eight things and stops. A profile that is a chore to maintain becomes a profile that is stale, and a stale profile is worse than none because it is believed.
Two profiles, opposite ends
Loading…Notice what the foundation’s profile does in its funding note: it tells you to give your money to somebody else. That is the behaviour the format is trying to make easy, and it is unavailable to any scheme where the recipient also runs the payment rail.
The conditional obligation
This is the part that makes the whole arrangement stand up without anybody policing it.
If a licensor stops publishing its maintainer profile, the licensee’s obligation to declare lapses in respect of that licensor’s software, for as long as the failure continues.
This does four things at once, which is unusual for one sentence of licence text:
- It kills the extraction objection. Nobody can say “you are taking from me and giving nothing”, because the obligation is symmetric and the licensor goes first.
- It gives licensees a reason to want their licensors alive and visible. A dead upstream is not a windfall; it is a project you now depend on that has stopped talking.
- It gives a lawyer a defined, verifiable trigger. Fetch a URL. It is there or it is not. That is a much better answer than any test involving good faith.
- It is self-enforcing with no institution at all. Nothing has to exist forever for this to keep working.
And because almost everyone building on a platform of this kind ends up being both a licensor and a licensee, the incentive turns inward. Dropping your own profile to escape your duty would simultaneously void the duty owed to you. You would be disarming yourself. That is a stronger mechanism than shame, and it needs no audience.
Section 5.3 confines it to the immediate licensor. Without that limit, one neglected profile deep in a tree could cascade unpredictably, and a dependency cycle (A depends on B, B depends on A) could unravel the obligation entirely. Confining it also keeps the trigger checkable by the person who has to act on it, which matters more than theoretical completeness.
You do not need the licence to publish one
This is the point most worth taking away from the page. The profile format has no dependency on the licence whatsoever. Any project on any licence can publish one this afternoon, and several good reasons to do so have nothing to do with giving back:
- It answers, once, the question you get asked in every enterprise procurement review.
- It says plainly that you are one person and unfunded, which is information your users should have and currently have to infer.
- It gives you somewhere to write “we do not need money, we need triage”, which almost nobody currently has anywhere to say.
- It is how
security.txtspread: publish an example and a page, not a specification, and let people copy it.
If the format spreads before the licence does, the licence becomes the formalisation of something people already do. That is the easiest adoption path any licence has ever had, and it is the intended one.