OpenSSF members back enterprise funding models for package registries

The OpenSSF Governing Board said enterprise users should participate in sustainable funding models for public package registries, while preserving free access for individual developers and small organizations. The group said registries including PyPI, Maven Central, crates.io, RubyGems and npm face rising infrastructure, security and compliance demands. It did not prescribe pricing or terms, instead backing registry-led experiments and enterprise participation as customers.