2025 FAIR Recap

Establish.

From discussions early in 2025, FAIR was founded under the Linux Foundation and publicly announced at the AltCtrl.org conference in Basel, Switzerland on June 6, 2025. At the event, it was presented shortly after Matt Leach’s demonstration of the AspirePress project to launch a public mirror of the WordPress repository, served by AspireCloud, with support by Fastly. A LF press release was distributed to media outlets for publication at the same time.

Early 2025 involved adopting a governance model, setting objectives, and engaging with the Linux Foundation for oversight and support. In addition to drafting the FAIR Protocol, we prepared the FAIR Connect plugin for release at this event as a proof of concept for technical independence. Working closely with AspirePress, the plugin connects to AspireCloud for software updates.

The announcement was very well-received, with media coverage beyond the WordPress community to the broader tech industry. In the WordPress space, media coverage came from The Repository, with a followup on AspirePress, as well as WP-Content.co and other WordPress news sites as well as blogs and opinion pieces. In the wider tech media, it was covered by outlets like Fast Company, The Register, Search Engine Journal, Web Hosting Today, Silicon Republic, Undercode News, Techspot, Linux Security, CMS Critic, and others.

What They’re Saying

Extend.

In the midst of all the other efforts during mid-2025, we also launched a basic website. We created and published initial documentation, which we extended to include our moderation spec and began work on a trust model for applying it. Following the initial release announcement, several new projects were initiated or adopted from AspirePress.

We worked on improving AspireCloud‘ search queries and its API, extending it to incorporate some initial FAIR Protocol requirements. This done, we began aggregating several software sources outside of the WordPress.org mirror. These sources are served by by FAIR Beacon, which we launched mid-year. Meanwhile, FAIR’s flagship Connect plugin saw ongoing updates, including the addition of WP-CLI support.

As we were shipping more software, we renamed most of them in late 2025 to avoid confusion. By this time, the software suite included:

FAIR Connect

Formerly “The Fair Plugin”, Connect is a WordPress plugin that improves performance and privacy by disconnecting services from wordpress.org, replacing them with local functions or third-party APIs, and serving software updates from AspireCloud.

FAIR Beacon

Beacon is a WordPress plugin (formerly “Mini-Fair”) that creates API endpoints to serve metadata for federated plugins, including package update URIs on Git platforms such as GitHub, GitLab, and Gitea.

FAIR Explorer

Formerly AspireExplorer, this WordPress plugin provides a publicly browseable and searchable index of available plugins and themes indexed by AspireCloud. See it in action by exploring packages on fair.pm.

AspireCloud

AspireCloud will retain its original name to honour the work done by the AspirePress project to launch a public mirror of the software from the official WordPress repository. As a package aggregator, it indexes available software and offers an API for discovering package information and download locations.

FAIR Forge

Newly launched in late 2025, Forge is itself a suite of tools to be used in reformatting WordPress packages to meet FAIR specifications, and to verify that all federated packages meet minimum standards for security and best practices. In addition to confirming guideline compliance, the tools will be able to gather specific signals used for calculating a trust score for each package FAIR distributes.

Engage.

Several FAIR developers and advocates made podcast appearances and gave interviews, as well as presentations at a number of events, from local meetups to larger conferences. These include Ryan McCue’s excellent talk at LoopConf in September and Brent Toderash’s presentation on supply chain security at WordCamp Canada in October. (Material from that talk is included in our post on rethinking how WordPress software is distributed.)

In November 2025, FAIR partnered with Patchstack in a one-day “hackathon”, delivering proofs-of-concept for bringing software vulnerability information directly to WordPress administrators’ dashboards. To do this, a Labeller was developed to apply specific labels to packages using Patchstack’s API for CVE (Common Vulnerabilities and Exposures) reporting. When integrated, searches for packages in the FAIR network can proactively label vulnerable packages. Next, a Policy Engine was developed which can enforce a security policy to prevent installing packages with known critical vulnerabilities. This work will soon converge with FAIR Forge to implement FAIR’s Moderation (Labelling) Specification and apply a robust new Trust Model.

The event was an unqualified success. In addition to CloudFest’s own report, it was reported on by WP-Content.co and by The Repository. CloudFest media partners were on hand as well, with Mark Szymanski recording an interview with hackathon project leads Elliot Taylor (Patchstack), Carrie Dils (FAIR TSC Co-Chair), and Brent Toderash (FAIR TSC).

Envision.

2025 ended on a high note for FAIR. A scant six months from its public announcement, FAIR has been represented at many regional and global events. FAIR Connect went through a number of releases during that time, with a number of other software and documentation projects being picked up in the process. By the time the year ended, the FAIR TSC had adopted a planned release cadence and roadmap for 2026, which promises more major steps on the road to federated software distribution.

One year on, FAIR has gone from a conceptual discussion to a suite of at least nine software products in active development with project contributors in time zones all around the globe.