Maintainer

Software consists of text that programmers have written. This text is repeatedly changed over the years, because bugs turn up or new features need to be added. A maintainer is the person who takes on exactly this upkeep. They review other people’s proposed changes, accept or reject them, and make sure the program as a whole keeps working. The name comes from the English “to maintain,” meaning to service or keep in working order. You can picture a maintainer like the caretaker of a large building: he isn’t constantly building something new, but without him everything falls into disrepair.

Why entire supply chains depend on individual people

Hardly any program is written completely from scratch. Instead, developers build on ready-made building blocks, so-called libraries. These building blocks are often freely available, which is called open source: the source code is public, and anyone may use and modify it. A single modern app can contain several hundred such foreign building blocks.

Many of these building blocks are maintained by one or two people in their spare time. At the same time, corporations earn billions with software that runs on exactly these building blocks. A well-known image from the industry shows a wobbly tower of blocks whose bottommost block has been carried unpaid by a single person since 2003. This imbalance is no joke — it’s the everyday reality of many projects.

This becomes dangerous when a maintainer quits, falls ill, or loses interest. Security vulnerabilities then remain open, affecting millions of users. In 2021, a vulnerability in a widely used Java library brought systems worldwide to a standstill; the project was maintained by a handful of volunteers. Since then, companies and government agencies have been investing money specifically to pay important maintainers.

Everyday life between pull requests and issues

Most projects are hosted on platforms like GitHub, a kind of public repository for source code. Anyone who wants to improve something sends a proposed change, a pull request. The maintainer reads this proposal, tests it, and decides. Only once they approve does the change become part of the official project.

Alongside this, bug reports come in, called issues. Users describe there what isn’t working for them. A maintainer has to sort these reports, ask follow-up questions, and set priorities. A large part of the work is thus not programming but communication and organization.

In larger projects, the work is divided up. There are maintainers for individual sub-areas and a small inner circle with the final say. In the Linux operating system kernel, for instance, thousands of contributors work together, but only a few are allowed to give final approval to changes. The distinction matters here: a contributor supplies individual contributions, while a maintainer bears ongoing responsibility for the whole.

Maintainers in AI projects and in the news

The AI world, too, runs on open source. Tools like PyTorch or the libraries from Hugging Face, used to train and run language models, have their own maintainer teams. Anyone who downloads an AI model is relying on someone maintaining this code and closing security issues.

In business news, maintainers tend to show up in three situations. First, when a security vulnerability reveals how thin the staffing of an important project really is. Second, when a company changes a project’s license and the maintainers fall out with the community. Third, when corporations hire well-known maintainers and thereby gain indirect influence over a project.

A common misconception is that maintainers are employees of a company behind the project. Often there is no company at all, just volunteers and donations. A second misconception: AI assistants that write code make maintainers superfluous. So far, the opposite tends to be observed, since machine-generated change proposals also have to be reviewed and thus increase the workload.