Sponsoring / Donations

[MartinThoma]

We recently started to receive a couple of issue tickets with private PDF messages that are clearly from companies. It also looks like those companies are probably not tiny startups.

While I enjoy contributing to open source for free, there are some things that I would like to buy / share with core contributors like @pubpub-zz.

pypdf is under a free license (BSD). That will not change.

Funding Goals

1. pypdf only really can support PDF 1.7 because we don't have access to the PDF 2.0 standard. It would be nice if we could change that. ISO 32000-2 (208 CHF = about 210 EUR = about 222 USD + shipping, I guess): @pubpub-zz you are the most active contributor. If we collect enough money, this is something I would like to send you. To keep things simple + to officially show the appreciation of the pypdf community for your work, I would like to gift it to you ❤️
2. Issue bounties: I love the idea that companies could donate to pypdf and basically hint at a specific issue. Once that issue is solved, we would give the bounty / bounties connected to it to the people who solved the issue.
3. Contributor rewards: Software Engineers are typically highly paid. People who contribute here do this for free. It would be nice to be able to give them some form of reward. Very likely it would not match their salaries, but maybe we can find something that they feel appreciated (simplest: stickers / hoodies)

How can people donate to pypdf?

I actually don't know how to do this best. I only see two options. Both seem not ideal. I would be happy about alternatives (which I would add here to keep the overview)

A) Registered association (in Germany)

One way that would work would be to officially found a non-profit organization in Germany (Registered association - "Eingetragener Verein").

Requirements:

• ⚠️ We would need to have 7 members.
• We would need to meet at least once a year (not necessarily in person)
• We would need to create some legal paperwork (I could do that)
• At least 3 people would actually need to be active (keeping records over money, inviting people once a year)

Advantages / Disadvantages

• PRO: If we manage to do that for 3+ years, we can very likely keep pypdf maintained (and reduce the dependence on single people a little bit)
• PRO: Companies could make donations. Very likely they would even be tax-deductable
• CON: We likely don't find 7 people
• CON: quite a lot of overhead

B) Me as intermediary

• CON: I'm uncertain how that would work legally. Very likely I would need to pay income tax on the money I would receive. Even if I don't keep anything for myself, but just give it away again (I'll talk with a freelancer friend about that; maybe I could write-off for what we spend it so that it would be tax-neutral for me)
• CON: We couldn't give any receipts - most German companies would need that.
• CON: People would need to trust me personally that I use the money for pypdf.

Other resources

• I've also asked via Twitter: https://twitter.com/_martinthoma/status/1629152284721438720
• Hints about how to found a registered association in Germany

[MartinThoma]

Github Sponsors would a channel for us to collect money, but still leave (A) and (B) on the table:

That is the fiscal host link: https://docs.github.com/en/sponsors/receiving-sponsorships-through-github-sponsors/using-a-fiscal-host-to-receive-github-sponsors-payouts

[MartinThoma]

https://www.oscollective.org/ looks interesting. Does anybody have any experience with it?

[MartinThoma]

Just stumbled over https://app.bountysource.com/teams/pypdf / https://app.bountysource.com/teams/pypdf2 - does anybody know that?

[scdub]

Another service I'm aware of (but not currently using) is Tidelift: https://tidelift.com/ I know a number of other Python projects such as Pillow use that service. There's NumFocus but think they are focused on scientific packages and from reading their requirements it doesn't look like pypdf would be aligned with what they're doing.

Different businesses have different models of how they can support open source, be that developer time, ongoing support, or one-time support. Developer time is covered by having an active community, I think it makes sense to engage both the ongoing support and one-time support channels. Services like GitHub sponsors and Tidelift cover the ongoing support case, and additionally developing an approach for paid features or bounties would also be useful. For example, I know that my employer has interest in Optional Content Groups (OGCs) listed on the moonshot list and I could investigate getting funding for that particular feature.

[MartinThoma]

Thank you 🙏

Regarding support by dev time (no matter if it's one-shot or ongoing): I typically accept PRs if I think they improve pypdf. A typical blocker is uncertainty about the public interface. Another one is breaking changes that people introduce while working on a feature.

Meaning if there is interest in implementing OCGs, people should probably first chat a bit with me to clarify how the interface could look like.

[JustADetailer]

I'm not sure if I'm over-simplifying but in the short term, I'm happy to just send some money. On the other hand I'd gladly pay bounties for any of the questions that I have or even just for 30 minutes of q&a.

[rassie]

For completeness sake: PDF 2.0 standard has been "liberated" by PDF Association: https://pdfa.org/sponsored-standards/

[stefan6419846]

In theory, Tidelift could provide us a monthly payment of $100: https://tidelift.com/lifter/search/pypi/pypdf Given the current missing clarity regarding the EU Cyber Resilience Act and possibly paid FOSS work, I am hesitant about this.

[shartzog]

@stefan6419846, in a typically American fashion, I wasn't even aware of the CRA or its implications until stumbling upon this thread, but I've done a fair bit of reading today. I found this github article to be a great jumping off point. Given that Tidelift purports to assist with vulnerability management and does not represent direct compensation for commercial use, I'd think you'd be good after a bit of up front headache, especially considering the new 'lighter touch' treatment of maintainers outlined in the linked github article.

I'm sure we could establish a cybersecurity policy without too much difficulty as I'm sure ChatGPT and its ilk have read enough of them to give us a good start at this point, and most of the steward's obligation beyond that centers on threats known to the steward. If someone created an issue stating 'we got hacked by the blahblah ransomware and traced the attack vector to a pdf and an associated vulnerability in pypdf', the steward would be responsible for communicating that threat to the authorities and community, but wouldn't we want to do that anyways???

That said, I'd be shocked if there weren't a few unique attack vectors available in the PDF standard, so I understand your hesitation.

In any event, I'd love to see you get something back for all the hours you put in around here... Your dedication is much appreciated, and I receive all the compensation I need through my use of pypdf. ;)

[stefan6419846]

I have no final opinion and if considering this, I would still need to sort out some stuff before actually deciding to do so. Nevertheless, rest assured that I know my limits of maintaining pypdf and that my employer is supportive in this regard.