libexpat 现已获得慕尼黑市长达 6 个月的资金支持。

libexpat 现已获得慕尼黑市长达 6 个月的资金支持。
libexpat now funded by the City of Munich for up to 6 months

原始链接: https://blog.hartwork.org/posts/libexpat-city-of-munich-open-source-sabbatical/

Expat 是一个广泛使用的、基于 C99 标准的跨平台流式 XML 解析器，以 MIT 许可证发布。在长期将该项目作为副业进行维护后，首席维护者 Sebastian 已经与慕尼黑市的“开源休假”（Open Source Sabbatical）项目签署了一份为期六个月的带薪合同。从 2026 年 8 月 1 日起，Sebastian 将全职专注于 libexpat 的维护工作，优先处理漏洞修复及项目的日常运营。有了这项专门的支持，该项目将能更高效地应对安全问题。Sebastian 鼓励社区提交经过深思熟虑且有理有据的漏洞报告，同时也提醒大家，低质量的人工智能生成内容仍是不受欢迎的。此外，他还欢迎任何成功将基于 Clang 的 MinGW 与 AddressSanitizer 和 Wine 结合使用的人士提供技术援助。

慕尼黑市宣布推出一项全新的“开源休假”（Open Source Sabbatical）计划，旨在资助专业软件开发者投身于开源项目。作为该计划的一部分，XML 解析库 `libexpat` 已获得为期六个月的资金支持。该计划的显著特点是同时向市政员工和外部开发者开放。支持者认为，这是慕尼黑数字政策的一次积极转变；继此前放弃基于 Linux 的“LiMux”桌面项目后，此举标志着该市有望回归对开源软件的历史承诺。这一举措受到开发者社区的广泛欢迎，被视为支持关键基础设施项目的积极方式。

原文

For readers new to Expat:

libexpat is a fast streaming XML parser. Alongside libxml2, Expat is one of the most widely used software libre XML parsers written in C, specifically C99. It is cross-platform and licensed under the MIT license.

Starting 2026-08-01, the "security vacation" of the project has ended and(!) I will be be paid to work on maintaining libexpat for up to 6 months thanks to the City of Munich under the umbrella of their Open Source Sabbatical program.
What does that mean?

For much of the past 10 years, working on libexpat has been competing with my regular occupation as a software engineer, chores, social life and re-creation. For the first time, I am now being employed to work on maintaining libexpat as my "regular job" for a limited period of time. My top priorities will be:

Yesterday and today most of my time went into fixing a vulnerability uncovered by Mozilla.

Technically, I am being employed by digitial@M now for of up 6 months with a regular working contract, including cancellation by either party, remotely from home. There is plenty to do.

Unvalidated AI slop submissions will still not be apprecated, but for everything else: if you want to throw intelligence at finding further vulnerabilities in libexpat and send them my way, the coming months will be the best chance at getting things fixed in reasonable time. Queueing theory and laws of physics still apply.

Wish me luck!

PS: If anyone managed to combine Clang-based MinGW with AddressSanitizer and Wine without crashing at launch, please show me how and drop me an e-mail. Thank you!

Best, Sebastian

libexpat 现已获得慕尼黑市长达 6 个月的资金支持。 libexpat now funded by the City of Munich for up to 6 months

libexpat 现已获得慕尼黑市长达 6 个月的资金支持。
libexpat now funded by the City of Munich for up to 6 months