OpenSSF Commitment Backs Enterprise Funding for Public Package Registries

Major technology companies including GitHub, Google, IBM, Microsoft and Red Hat have signed an OpenSSF commitment supporting sustainable funding models for public package registries and saying they intend to participate as enterprise customers. Published on 16 September 2026, the statement is also signed by Arm, Datadog, Dell Technologies, Ericsson, Kusari, the Rust Foundation and Sonatype. Packagist is among the registries named alongside PyPI, Maven Central, crates.io, RubyGems, npm, NuGet and OpenVSX.

The commitment supports continued free access for individual developers and small organisations while arguing that organisations deriving commercial value from registries at scale should help fund the infrastructure. It does not prescribe pricing, terms or tiers, leaving those decisions to individual registries. Packagist had already taken a separate funding step on 30 July 2026, when Composer and Packagist.org launched a formal sponsorship programme with Bronze at €2,500 per month, Silver at €5,000 per month and Gold at €8,000 per month, each based on an annual commitment. Packagist said Private Packagist covers more than half of its current expenses and that donated infrastructure supports services such as bandwidth, CDN, hosting, monitoring and search, while staff costs account for most expenses. Datadog and Sonatype were among the programme's launch sponsors and are also signatories to the September OpenSSF commitment.

For Drupal teams, the connection is through the wider Composer dependency ecosystem rather than the distribution of Drupal projects themselves. Drupal.org states that Drupal projects are not listed on Packagist and instead provides Composer metadata through packages.drupal.org. Packagist.org remains Composer's default package repository, so third-party PHP dependencies used by Drupal projects can still depend on that infrastructure. The OpenSSF statement does not announce a payment to Packagist, impose a registry fee or establish a new Packagist pricing model; it records enterprise support for registries developing sustainable funding approaches and a willingness to participate as customers when such models are offered.