Community stance on paywalled 'Accelerated bug fixes and security updates via our "soft fork" approach'

[RandomUsernameThatIsNotYetTaken]

I got some uninvited sales mails from codefresh recently:

https://codefresh.io/enterprise-argo-support/

Whats the community stance on this practice?
Will argo pivot to a 'pay to fix' model?
Is this a salesperson gone rogue?
Given that there are only 2 CodeFresh maintainers, how do other affiliated companies loook upon this practice?
https://github.com/argoproj/argoproj/blob/main/MAINTAINERS.md

Disclaimer, i'm also moving away from Octopus due to their last license change causing massive increase in cost.

[andrii-korotkov-verkada]

From what I can tell, there's a lot of work being done to fix and improve things in the open source repo by various contributors, so I don't think we are moving towards "pay to fix". Getting contributions into the open source repo usually takes time, up to weeks or months. So I can understand the soft fork approach. Overall, I think you can achieve a lot just by building a custom image from Argo CD master (which is what I do).

[jannfis]

Sorry for the lengthy reply ahead.

Argo is a FOSS project under the CNCF's umbrella, maintained by a diverse set of people all around the world and having a wonderful and thriving community. The software the project produces is available under a permissive license that basically allows people to do whatever they want to with it, and that includes building commercial products off its code base.

To be absolutely clear: Although there are a few companies (including my current employer) involved and heavily invested in developing and maintaining the Argo project, there will be no pivot to a "pay to fix" model. It will just not happen. If it would, I'm certain that most maintainers and the majority of the community would just step away from the project and it would die. Or forked and revived.

However, and this my personal opinion only, as with every Open Source project out there, maintainers and other contributors may have priorities that doesn't match yours. So, if you have an urgent bug that needs to be fixed, or a rad feature you would love to see implemented, you have mostly the following three options:

1. You contribute the bug fix or new feature yourself. Depending on the quality and complexity of the contribution, and the priorities of those who are able to review and merge, it might be a lengthy process until the change makes it into the code base.
2. You wait until someone in the community picks up your bug report or feature requests, and goes on to implement it - out of their own curiosity or desire to do it. Open Source maintainers usually do stuff not because you want them to do it, but because they want to do it - and that's totally fair. It's their time they choose to spend, after all.
3. You persuade someone else into working on your bug report or feature request. This might include someone is writing the code for you, interacting with others in the community on your behalf, reviewing code you have submitted, etc etc. Now, to shift someones priorities that way and persuade them into doing something for you, money is usually a good incentive in exchange for that.

So with all that being said, I think what Codefresh/Octopus (who, in my opinion, are excellent members of the Argo community and have very good standing) and other companies offer in terms of extended or "enterprise" support is fair game. Companies that invest in Open Source must be able to make some revenue from that or they wouldn't invest anymore.

Last but not least, I do not appreciate nor endorse unsolicited mails. But that is an issue you should clarify directly with the sender, not with the Argo community. I assume you received that mail because you had a business relationship with them, not because you are a part of the Argo community (i.e. your data was not scraped off GitHub).

Anyway, that's just my very personal 2 cents on this issue.