Vouch is a project by Mitchell Hashimoto, hosted on GitHub, that implements an explicit trust management system for open-source projects in which contributors must be vouched for by trusted maintainers before they can participate. GitHub’s Director of Open Source Programs cites it in Welcome to the Eternal September of open source. Here’s what we plan to do for maintainers. as an interesting example of the community building its own responses to the flood of low-effort contributions described as open source’s Eternal September, while noting that it is experimental and that some aspects of it will be debated.
Adoption & Ecosystem
The post places Vouch in a longer lineage of trust mechanisms in open source — Advogato’s trust metric,
Drupal’s credit system and the Linux kernel’s Signed-off-by chain — and alongside other community
approaches such as invitation-only workflows and custom GitHub Actions for contributor triage and
reputation scoring.