Lessons worth learning from the NixOS governance crisis
When we talk about digital autonomy and open source within government, the conversation quickly turns to source code, licences and technical architecture. But recent events in the NixOS community are a sharp reminder that the strongest foundation of open software is not code, but people and the way they work together.
A few days ago it became known that the Nixpkgs Core Team has decided to disband with immediate effect. Over the past ten months this team carried an enormous responsibility for streamlining decision-making, appointing new maintainers and handling security incidents in the NixOS ecosystem. The reasons for their departure are as recognisable as they are worrying: an unsustainable workload, friction with the Steering Committee and an exhausting culture within the wider community.
We use NixOS as the foundation for our work on a digitally autonomous workplace. With Nix Flakes we can build an environment that is exactly reproducible and independent. So the news that the Core Team was disbanding immediately raised questions among the community members involved. Is our foundation still sound, and will the software we build on hold up?
Technically there is no reason to panic
Our infrastructure and configurations will keep working exactly as they did yesterday. Because we pin dependencies through lockfiles, we are shielded from sudden upstream movements. The code does not disappear and the repositories remain available. The DAWO blueprint deliberately avoids depending on any single solution or supplier; in IT, one is none.
Even so, the impact of this decision reaches well beyond the technology. In the longer term, stalled decision-making upstream can lead to slower security updates and delays in approving new packages, if nothing changes. It shows that depending on open source is not without risk when we position ourselves purely as consumers.
Sovereignty is more than source code
Real digital sovereignty means that we do not only build on open source, but that we also feel jointly responsible for the health and the governance of the ecosystems that produce it.
This situation underlines that government should take a more active role in the open source landscape. We cannot settle for freely picking the fruits of volunteers’ efforts and then building critical government infrastructure on top of them. If we build on open source ecosystems, we have to be willing to contribute to the maintenance, the documentation and the human organisation behind them.
The governance crisis at NixOS is a lesson worth learning. It reminds us that lasting innovation in government does not stop at picking a good Linux distribution model, but starts with investing in the people who make it possible.