libexpat 现已获得慕尼黑市长达 6 个月的资金支持。

libexpat 现已获得慕尼黑市长达 6 个月的资金支持。
libexpat now funded by the City of Munich for up to 6 months

原始链接: https://blog.hartwork.org/posts/libexpat-city-of-munich-open-source-sabbatical/

Expat 是一个广泛使用的、基于 C99 标准的跨平台流式 XML 解析器，以 MIT 许可证发布。在长期将该项目作为副业进行维护后，首席维护者 Sebastian 已经与慕尼黑市的“开源休假”（Open Source Sabbatical）项目签署了一份为期六个月的带薪合同。从 2026 年 8 月 1 日起，Sebastian 将全职专注于 libexpat 的维护工作，优先处理漏洞修复及项目的日常运营。有了这项专门的支持，该项目将能更高效地应对安全问题。Sebastian 鼓励社区提交经过深思熟虑且有理有据的漏洞报告，同时也提醒大家，低质量的人工智能生成内容仍是不受欢迎的。此外，他还欢迎任何成功将基于 Clang 的 MinGW 与 AddressSanitizer 和 Wine 结合使用的人士提供技术援助。

慕尼黑市启动了一项全新的“开源学术假”项目，近期资助了一名开发人员，使其能够全身心投入 `libexpat` XML 解析库的开发工作，为期六个月。这一举措凸显了慕尼黑对“公共资金，公共代码”原则的承诺，旨在鼓励改进该市所依赖的开源软件。此举在 Hacker News 上引发了关于数字主权以及对微软等美国大型供应商依赖程度的广泛讨论。支持者将其视为对本地技术专长和安全性的战略投资，有助于减少对专有软件的长期依赖。相反，批评者则认为这些资源如果用于其他领域可能效果更好，他们质疑替换成熟办公套件的可行性，并指出此类努力往往会导致低效且短命的项目。讨论还触及了 XML 相关技术在 Web 标准中逐渐衰落的话题，一些参与者感叹 XSLT 等工具正被以 JavaScript 为核心的环境所取代。总体而言，该讨论反映了两种观点之间的深刻分歧：一方优先考虑通过开源替代方案实现机构自主，另一方则认为公共资金应优先用于更紧迫的经济或技术需求。

For readers new to Expat:

libexpat is a fast streaming XML parser. Alongside libxml2, Expat is one of the most widely used software libre XML parsers written in C, specifically C99. It is cross-platform and licensed under the MIT license.

Starting 2026-08-01, the "security vacation" of the project has ended and(!) I will be be paid to work on maintaining libexpat for up to 6 months thanks to the City of Munich under the umbrella of their Open Source Sabbatical program.
What does that mean?

For much of the past 10 years, working on libexpat has been competing with my regular occupation as a software engineer, chores, social life and re-creation. For the first time, I am now being employed to work on maintaining libexpat as my "regular job" for a limited period of time. My top priorities will be:

Yesterday and today most of my time went into fixing a vulnerability uncovered by Mozilla.

Technically, I am being employed by digitial@M now for of up 6 months with a regular working contract, including cancellation by either party, remotely from home. There is plenty to do.

Unvalidated AI slop submissions will still not be apprecated, but for everything else: if you want to throw intelligence at finding further vulnerabilities in libexpat and send them my way, the coming months will be the best chance at getting things fixed in reasonable time. Queueing theory and laws of physics still apply.

Wish me luck!

PS: If anyone managed to combine Clang-based MinGW with AddressSanitizer and Wine without crashing at launch, please show me how and drop me an e-mail. Thank you!

Best, Sebastian

libexpat 现已获得慕尼黑市长达 6 个月的资金支持。 libexpat now funded by the City of Munich for up to 6 months

libexpat 现已获得慕尼黑市长达 6 个月的资金支持。
libexpat now funded by the City of Munich for up to 6 months