OSS Foundations & Fiscal Sponsors

A foundation gives a project a legal home, a trademark holder, neutral governance, and tax-deductible donation handling. Pair with OSS Funding Platforms for the donor-facing layer, OSS Code of Conduct & Governance for governance models, and OSS License Selection for the licensing context most foundations enforce.

License-stewardship & advocacy (free / non-profit)

• ★ Open Source Initiative (OSI) — free; maintains the OSI-approved licenses list — the canonical "is this open source?" registry. Cite this when telling a vendor that BSL / SSPL / FSL are not open source.
• ★ Free Software Foundation (FSF) — free; stewards GPL / LGPL / AGPL; runs gnu.org. Stricter "free software" framing than OSI's "open source."
• ★ Software Freedom Conservancy — free; legal home for many OSS projects (Git, Inkscape, BusyBox); enforces GPL compliance.

Big tent / cross-ecosystem

• ★ Apache Software Foundation (ASF) — free; permissive (Apache 2.0); strong "Apache Way" governance; meritocratic incubator pipeline. Hosts Kafka, Spark, Airflow, Cassandra, OpenOffice.
• Linux Foundation — paid corporate memberships fund neutral hosting; umbrella over Linux, OpenSSF, OpenJS, CNCF, LF AI, Hyperledger. DCO-based (see CLAs & DCO).
• Eclipse Foundation — Java-rooted but broadened; EPL license; hosts Eclipse IDE, Jakarta EE, Theia.
• Mozilla Foundation — free; Firefox / Thunderbird / Common Voice / MDN steward.

Sub-foundations under Linux Foundation

• ★ CNCF (Cloud Native Computing Foundation) — Kubernetes, Prometheus, Envoy, etcd, OpenTelemetry. Graduated / Incubating / Sandbox tiers.
• OpenJS Foundation — Node.js, jQuery, Electron, Webpack, ESLint.
• OpenSSF — supply-chain security; Scorecards, sigstore, Allstar (see OSS Supply-Chain Security).
• LF AI & Data — PyTorch (since 2022), ONNX, Milvus, Acumos.

Fiscal sponsors (you don't need your own 501(c)(3))

• ★ Software in the Public Interest (SPI) — free; classic fiscal home for Debian, Arch, PostgreSQL (Global Development Group), Jenkins.
• ★ Open Source Collective (on Open Collective) — fastest path to a fiscal host today; thousands of projects use it.
• ★ NumFOCUS — fiscal sponsor for the scientific Python stack: NumPy, SciPy, pandas, Jupyter, Matplotlib, Julia, Bokeh.
• Commons Conservancy — EU-based; lightweight; KDE e.V. and others.
• Open Source Software Project (OSSP) at Internet Archive — niche.

Domain-specific

• OWASP Foundation — application security projects (ZAP, ASVS).
• OpenStack Foundation / Open Infrastructure Foundation — OpenStack, Kata Containers.
• Plone Foundation, Django Software Foundation, Python Software Foundation, Rust Foundation, PHP Foundation, Ruby Central, Node.js Foundation (now OpenJS) — language-specific stewards.

What a foundation actually gives you

• Trademark holder — you can't be sued by a fork that ships your name.
• Neutral IP — companies can contribute without "we own this" anxiety.
• Tax-deductible donations (US) — for 501(c)(3)s.
• Conferences / marketing — a Foundation can host events under its name.
• Defensive legal posture — pre-built contributor agreements, lawyers on retainer.

Honest take (2024–26)

• The Sovereign Tech Fund (Germany) is increasingly funding maintainers outside of any foundation — see OSS Grants.
• CNCF has been the most successful "graduate to neutrally-governed" pipeline of the last decade.
• The xz-utils 2024 backdoor revealed how thinly stretched many foundation-adjacent maintainers are; foundations don't automatically equal funded.
• Apache remains the gold standard for "company-neutral, permissively-licensed."

Pick this if…

• Default permissive, neutral, multi-company project: Apache (incubator → top-level).
• Cloud-native stack: CNCF.
• JavaScript/Node ecosystem: OpenJS.
• Scientific Python: NumFOCUS.
• Linux distribution / classic OSS project: SPI.
• Just need a fiscal host fast: Open Source Collective.
• You want the strictest "free software" framing: Software Freedom Conservancy + GPL-family license.