Rocky Enterprise Software Foundation (RESF) Due Diligence

Run due diligence on Rocky Enterprise Software Foundation (RESF): check compliance and get alerts when suppliers change.

United States · rockylinux.org · 11 vendors

The Rocky Enterprise Software Foundation (RESF) is an organization that manages and develops open-source projects, primarily the Rocky Linux operating system. It aims to provide a stable foundation of enterprise-grade open-source software that is freely available and community-controlled.

Resilience scores

Technology vendors

Services catalogue

1 service in catalogue across 1 category; runs on 11 sub-vendors.

Insights

Last updated 2026-07-30 · revision 1

11 direct vendors, 135 subvendors

Direct vendors by controlling owner country (sample)

Subvendors by controlling owner country (sample)

Compliance

7 in-scope frameworks identified; showing 3.

GDPR (source) — Evidence found

Evidence: https://rockylinux.org/legal/privacy, https://rockylinux.org/

US Export Controls — No public evidence

Evidence: https://rockylinux.org/, https://rockylinux.org/legal/licensing

Open Source License Compliance — Evidence found

Evidence: https://rockylinux.org/legal/licensing, https://digitalpublicgoods.net/

Financials

Three-year financials

Financial Resilience Score: 5/10

The Rocky Enterprise Software Foundation (RESF) is a Delaware Public Benefit Corporation that does not publish audited financial statements, IRS Form 990, or SEC filings. As a result, quantitative financial resilience cannot be independently verified. The organization is funded primarily through corporate sponsorships and in-kind contributions rather than product revenue, and it operates with a lean paid staff supplemented by volunteer contributors and seconded engineers from sponsor companies (notably CIQ). Strengths include a diverse sponsor base spanning hyperscalers (AWS, Google Cloud), silicon vendors (ARM, Supermicro), and enterprise software firms, alongside a low fixed cost base due to volunteer contributions and donated infrastructure. Cost-optimization initiatives such as the 2026 Infrastructure v2 program and self-hosting at Fibertown in Texas further support sustainability. The Delaware PBC form and Digital Public Good status insulate the project from single-vendor capture. However, meaningful risks exist: financial opacity, likely sponsor concentration around CIQ, upstream dependency on Red Hat/RHEL source availability, key-person risk highlighted by the June 2026 departure of co-founder Louis Abel, and the absence of any revenue-generating product to offset sponsorship shortfalls. Overall the entity appears operationally stable but its financial resilience remains unverifiable from public sources.

Key strengths: Diverse corporate sponsor base including AWS, Google Cloud, ARM, Microsoft/VMware, Rakuten Symphony, NAVER Cloud, Equinix, Fastly, and Supermicro, Low fixed cost base driven by volunteer contributors and donated cloud/hardware infrastructure, Strong commercial ecosystem partner CIQ providing indirect financial and engineering support, Delaware Public Benefit Corporation structure and Digital Public Good status prevent single-vendor capture, Infrastructure v2 cost-optimization initiative and move to self-hosted Fibertown (Texas) infrastructure, Participation in OpenELA (with SUSE and Oracle) securing long-term RHEL source availability

Risk factors: No published audited financials, IRS Form 990, or SEC filings — full financial opacity, Likely sponsor concentration risk with CIQ believed to be the largest single contributor, Upstream dependency on Red Hat/IBM RHEL source access policies, Key-person risk highlighted by June 2026 departure of co-founder Louis Abel, No revenue-generating product; shortfalls must be closed by new sponsorship, Volunteer contributor onboarding gaps identified in 2026 community survey

Revenue by product/service

Signed-in users can see whether their own company is exposed to this vendor's disruption, plus the full sub-vendor list and country breakdowns, every in-scope compliance framework plus gaps and next steps, and alerts when any of it changes.

View the full interactive report