virtualenv 👍 On Wed, Mar 17, 2021 at 5:30 PM Dustin Ingram wrote:

Hi folks

We're in the final stages of the PyPA becoming an organization that can receive funding via Tidelift (as a fiscal sponsoree of the PSF). We estimate that the PSF may be able to bring in nearly $2K USD per month via this model.

One of the last things we need are a few folks to offer to be designated as "lifters" for the following projects:

- pypa/packaging - pypa/pip - pypa/pipenv - pypa/setuptools - pypa/setuptools-scm - pypa/twine - pypa/virtualenv - pypa/wheel

Being designated as a "lifter" means that you'll have an account on tidelift.com and will receive notifications / requests about the project in question. Ideally, at least one person with the commit bit for a given project will be a lifter.

The sort of things Tidelift may ask of us are listed at https://tidelift.com/about/lifter-tasks. (Note that this page discusses signing a legal agreement, but we don't have to do that as the PSF is entering into this agreement with Tidelift instead.)

I don't imagine the volume of requests here will be very high. (One thing we'll definitely have to do is document a security/vulnerability disclosure policy for all PyPA projects.)

*If you're interested, please respond on-list with the project(s) you want to be responsible for.*

If you have questions, please feel free to ask! Thanks! _______________________________________________ PyPA-Committers mailing list -- pypa-committers@python.org To unsubscribe send an email to pypa-committers-leave@python.org https://mail.python.org/mailman3/lists/pypa-committers.python.org/ Member address: gaborjbernat@gmail.com

Hey Paul, On Wed, Mar 17, 2021 at 7:51 PM Paul Moore wrote:

On Wed, 17 Mar 2021 at 17:30, Dustin Ingram wrote:

...

We're in the final stages of the PyPA becoming an organization that can receive funding via Tidelift (as a fiscal sponsoree of the PSF). We estimate that the PSF may be able to bring in nearly $2K USD per month via this model.

Was this discussed anywhere? It may well have been, and I'm not suggesting there's any problem with doing this, but I'd have expected there to be a discussion about it...

I believe there was a vote about making PSF a fiscal sponsor for PyPA on this ML some time ago [1]. Not sure about Tidelift, though. But AFAIU PSF has some old agreement with Tidelift already (I seem to recall the Flask community taking advantage of it). [1]: https://mail.python.org/archives/list/pypa-committers@python.org/thread/VWE5... -- Warm regards, Sviatoslav Sydorenko Software Hacker @ Ansible Core --- https://useplaintext.email/ () ascii ribbon campaign - against html e-mail /\ www.asciiribbon.org - against proprietary attachments ---

On Wed, Mar 17, 2021 at 6:36 PM Dustin Ingram wrote:

One of the last things we need are a few folks to offer to be designated as "lifters" for the following projects:

pypa/packaging pypa/pip pypa/pipenv pypa/setuptools pypa/setuptools-scm pypa/twine pypa/virtualenv pypa/wheel

[...] Ideally, at least one person with the commit bit for a given project will be a lifter.

AFAIK jaraco has been a lifter for setuptools for the last two or three years. He's even got some automation for auto-uploading release note there. Does it really need more lifters?

I don't imagine the volume of requests here will be very high. (One thing we'll definitely have to do is document a security/vulnerability disclosure policy for all PyPA projects.)

Agreed, from my experience they want the supported releases marked, their marketing texts+links injected into project docs/pages, security set up, each lifter needs to set up 2FA on GH and PyPI. Among higher- maintenance tasks, there's the need to add release notes when publishing new versions, for example. And occasionally they invent new tasks to be performed. FYI they offer using their email for reporting security bugs and AFAIR they can also help facilitate the fixing and disclosure process. I recently had to deal with a security issue in aiohttp but I didn't switch the policy to be routed through them and instead used GitHub's Advisories features to work on the fix, make an advisory and request a CVE (all within GH UI except for the initial report over email). Then, I just went to Tidelift and entered the existing CVE + the range of affected versions. That said, I think PyPA may need to clarify the unified process and decide whether it's worth routing the reports through Tidelift or handle this differently. -- Warm regards, Sviatoslav Sydorenko Software Hacker @ Ansible Core --- https://useplaintext.email/ () ascii ribbon campaign - against html e-mail /\ www.asciiribbon.org - against proprietary attachments ---

I'm in the same position, but I had the impression that in this case you'll not receive any compensation. Instead the Tidelift value gets donated to PSF. So the way I see you're not getting any compensation if you sign up for it. I might be missing here something though, Bernat

I need to check with my employer but it's likely this will cause me to have to resign from twine as a maintainer. My contract disallows me from receiving any compensation for F/OSS work and this will likely look an awful like that to the folks in legal. Sent from my phone with my typo-happy thumbs. Please excuse my brevity

That's what I thought but our legal team is somewhat ... aggressively against any appearance of outside business activity Sent from my phone with my typo-happy thumbs. Please excuse my brevity On Wed, Mar 17, 2021, 14:49 Dustin Ingram wrote:

Correct, all funds would go to the PSF, earmarked for the PyPA to distribute as it sees necessary. You would not be required to receive funding as a lifter.

On Wed, Mar 17, 2021 at 2:41 PM Bernat Gabor wrote:

...

I'm in the same position, but I had the impression that in this case you'll not receive any compensation. Instead the Tidelift value gets donated to PSF. So the way I see you're not getting any compensation if you sign up for it. I might be missing here something though,

Bernat

...

I need to check with my employer but it's likely this will cause me to

have to resign from twine as a maintainer. My contract disallows me from receiving any compensation for F/OSS work and this will likely look an awful like that to the folks in legal. Sent from my phone with my typo-happy thumbs. Please excuse my brevity

On Wed, 17 Mar 2021 at 19:16, Dustin Ingram wrote:

Yes, the main goal of making the PyPA a fiscal sponsoree of the PSF was so that we could accept sponsorships/funding via Tidelift and GitHub Sponsors. The Pallets project is similarly a fiscal sponsoree of the PSF and accepts funding via Tidelift and GitHub Sponsors in the same fashion.

Cool, I did remember the fiscal sponsorship discussion, but I wasn't aware of the link to Tidelift. I don't know what the pip project's view is on whether we'd want to be considered a tidelift project, and my concern is that there's an implied assumption here that pip *would* be under tidelift. Personally, I'd have to understand better what this meant in terms of what the pip project might be committing to if we were under tidelift. I'm not (to my knowledge) in Ian's position where I'd have legal problems, but I do feel the need to defend rather strongly my right to simply not do certain things, because I'm a volunteer - and as such, being "asked to do stuff" by Tidelift is something I need to consider quite carefully. I'm certainly not willing to be a "lifter" for pip in the sense of being a named person taking on any Tidelift commitments. Paul PS I'm deliberately not commenting on the topic of actual money right now, as I'm currently too tired to think about how I feel about that.

Fair warning: this email contains “informed speculation”, that might be all wrong. (I still need to check with my employer on whether this affects my involvement with pip/PyPA) I have one kinda-major concern with how Tidelift tracks and counts dependencies. Unless they’ve changed something in their pipeline recently, basically all of our projects are significantly underreported by their pipelines. They don’t account for the fact that projects using requirements.txt/ setup.py/setup.cfg are using pip/setuptools and pyproject.toml build requirements aren’t considered either (at least, last I checked). Similarly, twine and virtualenv aren’t things folks specify in requirements.txt files usually, but are obviously used by basically every package on PyPI (and with anything that looks like PyPI, like Artifactory). IIRC a broken pip release had increased the number of folks who pinned pip in requirements.txt, which increased the $$$ amount for pip. Clearly, that’s not the incentive structure design we wanna go for. :) All this is to say: a _very significant_ portion of PyPA projects’ users are not counted toward those projects by Tidelift. That’s despite the underlying assumptions in most of Tidelift’s dependency tracking tooling (they process requirements.txt files for example). I’m pretty sure whatever numbers they have for PyPA projects right now, would increase significantly if they start accounting for these things. FWIW, they’ve acknowledged this in public Twitter replies to me but I haven’t followed up on this eagerly because there was no good reason to ask them to do development work so that we would hypothetically have a good enough reason to hop on board. Things might’ve changed on their end, but I doubt that given that the numbers aren’t significantly different. For context, the same thing happened when GitHub rolled out their used-by metrics as well (their CEO also acknowledged this in public Twitter replies) so it’s not like Tidelift are the only ones who missed this nuance. It’s just that we now have a good reason to care about their number. :) FWIW, Tidelift’s support still better than nothing, so I’m not complaining or whatever. That said, it’s definitely worthwhile for us to push them on these things, because PyPA projects joining Tidelift is less of a hypothetical now than it was in the past and this might represent a significant chunk of $$$ for us. Cheers, Pradyun PS: yes, I tried looking but Twitter doesn’t make it easy to find old tweets. On Wed, 17 Mar 2021 at 23:47, Sviatoslav Sydorenko wrote:

On Wed, Mar 17, 2021 at 10:09 PM Paul Moore wrote:

...

Personally, I'd have to understand better what this meant in terms of what the pip project might be committing to if we were under tidelift. [...] being "asked to do stuff" by Tidelift is something I need to consider quite carefully.

IIRC the agreement is that you keep maintaining the project as you did before. They won't demand any features. But they will want you to keep the metadata up-to-date (like confirming that they parsed the license properly, publishing the security policy, enabling 2FA for all the maintainer accounts, and so on).

-- Warm regards, Sviatoslav Sydorenko

Software Hacker @ Ansible Core

--- https://useplaintext.email/ () ascii ribbon campaign - against html e-mail /\ www.asciiribbon.org - against proprietary attachments ---

_______________________________________________ PyPA-Committers mailing list -- pypa-committers@python.org To unsubscribe send an email to pypa-committers-leave@python.org https://mail.python.org/mailman3/lists/pypa-committers.python.org/ Member address: pradyunsg@gmail.com

On Thu, Mar 18, 2021 at 10:07 AM Pradyun Gedam wrote:

I have one kinda-major concern with how Tidelift tracks and counts dependencies. Unless they’ve changed something in their pipeline recently, basically all of our projects are significantly underreported by their pipelines.

They don’t account for the fact that projects using requirements.txt/setup.py/setup.cfg are using pip/setuptools and pyproject.toml build requirements aren’t considered either (at least, last I checked). Similarly, twine and virtualenv aren’t things folks specify in requirements.txt files usually, but are obviously used by basically every package on PyPI (and with anything that looks like PyPI, like Artifactory).

IIRC a broken pip release had increased the number of folks who pinned pip in requirements.txt, which increased the $$$ amount for pip. Clearly, that’s not the incentive structure design we wanna go for. :)

All this is to say: a _very significant_ portion of PyPA projects’ users are not counted toward those projects by Tidelift. That’s despite the underlying assumptions in most of Tidelift’s dependency tracking tooling (they process requirements.txt files for example). I’m pretty sure whatever numbers they have for PyPA projects right now, would increase significantly if they start accounting for these things.

Yep, the projection is not $50 anymore: https://tidelift.com/lifter/package/pypi/pip/. Although, I must add that the "dependents on GitHub" numbers aren't directly taken into account. They account their direct customers' requirements only AFAIK (and maybe the transitive deps of those).

For context, the same thing happened when GitHub rolled out their used-by metrics as well (their CEO also acknowledged this in public Twitter replies) so it’s not like Tidelift are the only ones who missed this nuance. It’s just that we now have a good reason to care about their number. :)

[...] it’s definitely worthwhile for us to push them on these things, because PyPA projects joining Tidelift is less of a hypothetical now than it was in the past and this might represent a significant chunk of $$$ for us.

Agreed. It's a good idea to negotiate with them fixing their tooling before we hop on this train. I think we may be in a good position to inspire the change.

FWIW, they’ve acknowledged this in public Twitter replies to me but I haven’t followed up on this eagerly because there was no good reason to ask them to do development work so that we would hypothetically have a good enough reason to hop on board. [...] PS: yes, I tried looking but Twitter doesn’t make it easy to find old tweets.

Here you go https://twitter.com/katzj/status/1216842962895802373. -- Warm regards, Sviatoslav Sydorenko Software Hacker @ Ansible Core --- https://useplaintext.email/ () ascii ribbon campaign - against html e-mail /\ www.asciiribbon.org - against proprietary attachments ---

On Thu, 18 Mar 2021, 09:41 Sviatoslav Sydorenko, wrote:

On Thu, Mar 18, 2021 at 10:07 AM Pradyun Gedam wrote:

...

I have one kinda-major concern with how Tidelift tracks and counts dependencies. Unless they’ve changed something in their pipeline recently, basically all of our projects are significantly underreported by their pipelines.

They don’t account for the fact that projects using requirements.txt/setup.py/setup.cfg are using pip/setuptools and pyproject.toml build requirements aren’t considered either (at least, last I checked). Similarly, twine and virtualenv aren’t things folks specify in requirements.txt files usually, but are obviously used by basically every package on PyPI (and with anything that looks like PyPI, like Artifactory).

IIRC a broken pip release had increased the number of folks who pinned pip in requirements.txt, which increased the $$$ amount for pip. Clearly, that’s not the incentive structure design we wanna go for. :)

All this is to say: a _very significant_ portion of PyPA projects’ users are not counted toward those projects by Tidelift. That’s despite the underlying assumptions in most of Tidelift’s dependency tracking tooling (they process requirements.txt files for example). I’m pretty sure whatever numbers they have for PyPA projects right now, would increase significantly if they start accounting for these things.

Yep, the projection is not $50 anymore: https://tidelift.com/lifter/package/pypi/pip/.

I'm pretty sure it was at 50 USD quite a while back. pip 20.0 is the broken release I'm talking about here. And even at ~500 USD, it's also nowhere close to what other reasonably major projects in the ecosystem have. Although, I must add that the "dependents on GitHub" numbers aren't

directly taken into account. They account their direct customers' requirements only AFAIK (and maybe the transitive deps of those).

Yea, IIUC, it's only for the businesses that have subscribed and the transitive dependencies of their codebase. Tidelift's model is kinda perfect for us, as long as they count our users (which happens to be basically everyone in the Python ecosystem 😅).

For context, the same thing happened when GitHub rolled out their used-by metrics as well (their CEO also acknowledged this in public Twitter replies) so it’s not like Tidelift are the only ones who missed this nuance. It’s just that we now have a good reason to care about their number. :)

...

[...] it’s definitely worthwhile for us to push them on these things, because PyPA projects joining Tidelift is less of a hypothetical now than it was in the past and this might represent a significant chunk of $$$ for us.

Agreed. It's a good idea to negotiate with them fixing their tooling before we hop on this train. I think we may be in a good position to inspire the change.

...

FWIW, they’ve acknowledged this in public Twitter replies to me but I haven’t followed up on this eagerly because there was no good reason to ask them to do development work so that we would hypothetically have a good enough reason to hop on board. [...] PS: yes, I tried looking but Twitter doesn’t make it easy to find old tweets.

Here you go https://twitter.com/katzj/status/1216842962895802373.

Thanks! <3 For anyone wondering what the $$$ numbers look like for some of the major projects in the ecosystem, this thread is a worthwhile read.

-- Warm regards, Sviatoslav Sydorenko

Software Hacker @ Ansible Core

--- https://useplaintext.email/ () ascii ribbon campaign - against html e-mail /\ www.asciiribbon.org - against proprietary attachments ---

On Thu, Mar 18, 2021 at 11:10 AM Paul Moore wrote:

One thing I'm not clear on from this proposal is *who* would get this money. Would it go to the PSF as a "fiscal sponsor"? [...] how transparent we are being about how people's contributions are getting converted into money.

I think Dustin covered this here: https://mail.python.org/archives/list/pypa-committers@python.org/message/JVH.... My understanding is that PSF will get the money but PyPA may decide on how to use it. Are you asking for anything beyond that reply? -- Warm regards, Sviatoslav Sydorenko Software Hacker @ Ansible Core --- https://useplaintext.email/ () ascii ribbon campaign - against html e-mail /\ www.asciiribbon.org - against proprietary attachments ---

To be clear, I don't see myself as critical to Twine. If I were, that would be a huge issue. Brian does an excellent job and Jason is available to help a lot of the time. Regardless, I have meeting with senior legal counsel for my employer Friday. So I'll know more then. All of this is to say, go ahead. I'll know more about whether I'm still a maintainer this weekend. Sent from my phone with my typo-happy thumbs. Please excuse my brevity On Wed, Mar 17, 2021, 14:56 Dustin Ingram wrote:

I don't think this is much different than the PSF accepting funding from organizations like CZI on behalf of projects like pip, but I would definitely recommend checking with your employer. We can just exclude twine from this for now, I'd hate to potentially lose you as a maintainer.

On Wed, Mar 17, 2021 at 2:52 PM Ian Stapleton Cordasco wrote:

...

That's what I thought but our legal team is somewhat ... aggressively

against any appearance of outside business activity

...

Sent from my phone with my typo-happy thumbs. Please excuse my brevity

On Wed, Mar 17, 2021, 14:49 Dustin Ingram wrote:

...

Correct, all funds would go to the PSF, earmarked for the PyPA to distribute as it sees necessary. You would not be required to receive funding as a lifter.

On Wed, Mar 17, 2021 at 2:41 PM Bernat Gabor

wrote:

...

...

...

I'm in the same position, but I had the impression that in this case you'll not receive any compensation. Instead the Tidelift value gets donated to PSF. So the way I see you're not getting any compensation if you sign up for it. I might be missing here something though,

Bernat

...

I need to check with my employer but it's likely this will cause me

to have to resign from twine as a maintainer. My contract disallows me from receiving any compensation for F/OSS work and this will likely look an awful like that to the folks in legal. Sent from my phone with my typo-happy thumbs. Please excuse my brevity

As others have alluded earlier, I have extensive involvement and opinions on this matter. I joined Tidelift as part of the initial batch of maintainers on the system. I joined after having a conversation with the CEO Donald Fischer. That conversation left me extremely excited about the prospects that Tidelift is creating for the open source ecosystem. I’ve long dreamt of there being a system that supports financially what has traditionally been a mostly volunteer effort. I’d even drafted some ideas around a system similar to Tidelift where content producers (more generally than open source software) could reap rewards, similar to royalties, proportional to the value they provide downstream. Tidelift implements a similar model, acting as a champion and broker for open source maintainers and attempting to create a fair and equitable platform for distribution of sponsorship from commercial interests deriving value from the otherwise free projects. One of the features I appreciate most about Tidelift is how it works with each project and its maintainers directly to create a simple and uncomplicated process for achieving its goals. And while I appreciate the efforts Tidelift is making to enroll groups like Python Devs and PyPA, I am concerned that sponsoring a group and thus sponsorship through a large entity like the PSF will fail to create the most basic incentive - to compensate and reward maintainers for the vigilance on the project. It will open up other opportunities, such the potential for grants for larger, more rigorously-planned projects. I say all of this with full transparency that I have hundreds of projects registered with Tidelift, 12 of which are funded, Setuptools being the most prominent. Tidelift has incentivized me to work more on open source and specifically heightened the response to security incidents. Moreover, I take Tidelift very seriously and have plans to build my financial future around continued maintenance of these projects. My preference would be for these projects to enroll individually, and for those maintainers that wish to direct the project’s compensation to the PSF or another entity should do so, and those that wish to distribute the compensation to contributors or co-maintainers should do so. For example, in the CherryPy projects, I share compensation with a co-maintainer and on Setuptools, I’ve offered equal shares to those aiding substantially with the maintenance. All this to say, I’m enthusiastic about PyPA projects coming on board with Tidelift and I would certainly encourage and offer guidance to any projects joining, but I’d be mildly opposed to the funding being directed away from the maintainers (lifters). If we wish for PyPA projects to provide contributions to PSF, I’d recommend to separate that concern from sponsorships. On 18 Mar, 2021, at 06:10, Paul Moore mailto:p.f.moore@gmail.com> wrote: On Thu, 18 Mar 2021 at 09:52, Pradyun Gedam mailto:pradyunsg@gmail.com> wrote: For anyone wondering what the $$$ numbers look like for some of the major projects in the ecosystem, this thread is a worthwhile read. One thing I'm not clear on from this proposal is *who* would get this money. Would it go to the PSF as a "fiscal sponsor"? To be clear, I'm not asking from the POV of "I want to be paid for stuff", or "I don't want someone else to profit from my work" - I'm simply interested from the practical point of view of who benefits, and the (ethical, I guess?) POV of how transparent we are being about how people's contributions are getting converted into money. Paul PS To be clear, I know that what I'm doing is massively over-thinking something that's fundamentally just "yay, free money!" But I can't help feeling an additional level of responsibility when money's involved. Sorry. _______________________________________________ PyPA-Committers mailing list -- pypa-committers@python.orgmailto:pypa-committers@python.org To unsubscribe send an email to pypa-committers-leave@python.orgmailto:pypa-committers-leave@python.org https://mail.python.org/mailman3/lists/pypa-committers.python.org/ Member address: jaraco@jaraco.com

My preference would be for these projects to enroll individually, and for those maintainers that wish to direct the project’s compensation to the PSF or another entity should do so, and those that wish to distribute the compensation to contributors or co-maintainers should do so. For example, in the CherryPy projects, I share compensation with a co-maintainer and on Setuptools, I’ve offered equal shares to those aiding substantially with the maintenance.

The issue is that with the exception of setuptools (more than $800/mo) we haven't done this already and currently have a total of nearly $1,000/mo that we're just leaving on the table, which we could be using to pay for infrastructure / have bug bounties / hire contractors / pay maintainers at the PyPA's discretion. I'm personally fine with you continuing to accept all the Tidelift funding on behalf of the setuptools project, as long as the other maintainers are in agreement and we have a plan to disperse that funding in the event of another more active maintainer joining or you deciding to wind down down your maintainership. I think that's one of the advantages of the PyPA accepting funding for the projects under its umbrella instead, though. On Sat, Mar 20, 2021 at 11:40 AM Ian Stapleton Cordasco < graffatcolmingov@gmail.com> wrote:

So long as I don't take any funding, my company's legal team is fine with me continuing to work on Twine.

Sent from my phone with my typo-happy thumbs. Please excuse my brevity

On Thu, Mar 18, 2021, 06:59 Ian Stapleton Cordasco < graffatcolmingov@gmail.com> wrote:

...

To be clear, I don't see myself as critical to Twine. If I were, that would be a huge issue.

Brian does an excellent job and Jason is available to help a lot of the time. Regardless, I have meeting with senior legal counsel for my employer Friday. So I'll know more then.

All of this is to say, go ahead. I'll know more about whether I'm still a maintainer this weekend.

Sent from my phone with my typo-happy thumbs. Please excuse my brevity

On Wed, Mar 17, 2021, 14:56 Dustin Ingram wrote:

...

I don't think this is much different than the PSF accepting funding from organizations like CZI on behalf of projects like pip, but I would definitely recommend checking with your employer. We can just exclude twine from this for now, I'd hate to potentially lose you as a maintainer.

On Wed, Mar 17, 2021 at 2:52 PM Ian Stapleton Cordasco wrote:

...

That's what I thought but our legal team is somewhat ... aggressively

against any appearance of outside business activity

...

Sent from my phone with my typo-happy thumbs. Please excuse my brevity

On Wed, Mar 17, 2021, 14:49 Dustin Ingram wrote:

...

Correct, all funds would go to the PSF, earmarked for the PyPA to distribute as it sees necessary. You would not be required to receive funding as a lifter.

On Wed, Mar 17, 2021 at 2:41 PM Bernat Gabor

wrote:

...

...

...

I'm in the same position, but I had the impression that in this case you'll not receive any compensation. Instead the Tidelift value gets donated to PSF. So the way I see you're not getting any compensation if you sign up for it. I might be missing here something though,

Bernat

> I need to check with my employer but it's likely this will cause

me to have to resign from twine as a maintainer. My contract disallows me from receiving any compensation for F/OSS work and this will likely look an awful like that to the folks in legal. Sent from my phone with my typo-happy thumbs. Please excuse my brevity

On Sun, 21 Mar 2021 at 02:27, Jason R. Coombs wrote:

My preference would be for these projects to enroll individually, and for those maintainers that wish to direct the project’s compensation to the PSF or another entity should do so, and those that wish to distribute the compensation to contributors or co-maintainers should do so. For example, in the CherryPy projects, I share compensation with a co-maintainer and on Setuptools, I’ve offered equal shares to those aiding substantially with the maintenance.

I think this is a good way to look at it. For setuptools, you're happy to take on the responsibility of accepting the funds directly and deciding how they should be spent/distributed, and your co-maintainers are happy with the way you're handling that, so it isn't necessary to mess with that approach. For the other PyPA projects in Dustin's list that *aren't* already registered with Tidelift, the maintainers now have the option of directing the PSF to take on the fiscal responsibilities of joining Tidelift, while nominating one or more people to take on the technical responsibilities. Cheers, Nick. -- Nick Coghlan | ncoghlan@gmail.com | Brisbane, Australia