A funding.json manifest, because the audit still needs paying for #84

Merged

extant2000git merged 1 commits from feat/funding-manifest into main 2026-10-15 20:27:22 +00:00

Conversation 0 Commits 1 Files Changed 1

+78

extant2000git commented 2026-10-15 20:04:50 +00:00

Owner

Copy Link

Copy Source

OSTIF declined on 2026-10-15, the same day as the request. The reason was adoption rather than the code: "strong candidates for security funding are generally widely used or adopted projects, projects used for infrastructure or widely contributed projects that are about to release security-relevant changes." Eleven users does not meet that and no rewrite of the letter changes it. They left a re-open path for when the project's status changes, and sent a list of funders, which is where FLOSS/fund came from.

FLOSS/fund takes applications as a funding.json manifest in the repository rather than a proposal, reviewed from a public directory, open to any country, rolling, in tiers from $10,000 to $100,000. They placed $1M across 30 projects in their first year.

Two plans: $50,000 one-time for an independent cryptography audit, which is one of their tiers and the low end of the $30,000 to $200,000 OSTIF quoted for an initial audit, plus an any-amount plan. Paid by bank transfer, with account details on request rather than in a public file.

Both projects point at the Codeberg mirror, because the primary host denies the EU, the EEA and the UK. The manifest claims flamenetmessenger.com while being served from a code host, so every URL carries a wellKnown pointing at .well-known/funding-manifest-urls on that domain. The relay serves that path when FN_FUNDING_MANIFESTS is set, in extant2000/flamenet-relay.

Validated against the v1.1.0 schema fetched from fundingjson.org with no constraint violations, and both cited pages return 200.

🤖 Generated with Claude Code

OSTIF declined on 2026-10-15, the same day as the request. The reason was adoption rather than the code: "strong candidates for security funding are generally widely used or adopted projects, projects used for infrastructure or widely contributed projects that are about to release security-relevant changes." Eleven users does not meet that and no rewrite of the letter changes it. They left a re-open path for when the project's status changes, and sent a list of funders, which is where FLOSS/fund came from. FLOSS/fund takes applications as a `funding.json` manifest in the repository rather than a proposal, reviewed from a public directory, open to any country, rolling, in tiers from $10,000 to $100,000. They placed $1M across 30 projects in their first year. Two plans: **$50,000 one-time** for an independent cryptography audit, which is one of their tiers and the low end of the $30,000 to $200,000 OSTIF quoted for an initial audit, plus an any-amount plan. Paid by bank transfer, with account details on request rather than in a public file. Both projects point at the Codeberg mirror, because the primary host denies the EU, the EEA and the UK. The manifest claims flamenetmessenger.com while being served from a code host, so every URL carries a `wellKnown` pointing at `.well-known/funding-manifest-urls` on that domain. The relay serves that path when `FN_FUNDING_MANIFESTS` is set, in extant2000/flamenet-relay. Validated against the v1.1.0 schema fetched from fundingjson.org with no constraint violations, and both cited pages return 200. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

extant2000git added 1 commit 2026-10-15 20:04:50 +00:00

A funding.json manifest, because the audit still needs paying for ... 4759916ecc

OSTIF declined on 2026-10-15, same day as the request. Their reason was
adoption, not the code: "strong candidates for security funding are generally
widely used or adopted projects, projects used for infrastructure or widely
contributed projects that are about to release security-relevant changes."
Eleven users does not meet that, and no rewrite of the letter changes it. They
left a re-open path for when the project's status changes, and they sent a list
of funders, which is where FLOSS/fund came from.

FLOSS/fund takes applications as a funding.json manifest in the repository
rather than a proposal, reviewed from a public directory, open to any country,
rolling, in tiers from $10,000 to $100,000. They placed $1M across 30 projects
in their first year.

Two plans: $50,000 one-time for an independent cryptography audit, which is a
tier of theirs and the low end of the $30,000 to $200,000 OSTIF quoted for an
initial audit, and an any-amount plan. Paid by bank transfer, with account
details on request rather than in a public file.

Both projects point at the Codeberg mirror, because the primary host denies the
EU, the EEA and the UK. The manifest claims flamenetmessenger.com while being
served from a code host, so each URL carries a wellKnown pointing at
.well-known/funding-manifest-urls on that domain, which the relay serves when
FN_FUNDING_MANIFESTS is set.

Validated against the v1.1.0 schema fetched from fundingjson.org: no constraint
violations. Both cited pages return 200.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

extant2000git merged commit 82ed31cdf9 into main 2026-10-15 20:27:22 +00:00

Sign in to join this conversation.

Reviewers

No Reviewers

Labels

Clear labels

accuracy

A public page or doc claims something the code does not do

blocked:apple

Waiting on App Store review

docs

ops

Deploy, CI, infrastructure

parity

One platform has it and the other does not

privacy

Changes what is stored, or what we say is stored

protocol

unwired

Built in the engine, not reachable from the UI

verification

No labels

Milestone

No items

No Milestone

Projects

Clear projects

No projects

Assignees

Clear assignees

extant2000git

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: extant2000/flamenet-e2e#84