Drupal's download infrastructure carries three unsolved problems: sovereignty, governance and cost. Today, drupal.org is a single point of distribution for the entire ecosystem, and a small group of people carries the weight of keeping it running.

FAIR (Federated Autonomous Infrastructure Repository) started in WordPress and has since moved into working code in TYPO3, where the CloudFest Hackathon 2026 produced a real prototype with Composer integration, an aggregator, signing and trust. Drupal already ships through Composer, so our lift may well be lighter.

This BoF is a facilitated working session, not a presentation. Nobody comes with answers. Together we want to map:

What problems do the people who provide Drupal's infrastructure carry today, the ones few others see?
What problems do the people and organisations who depend on that infrastructure carry, likely a different list entirely?
Which solution directions exist once both lists are on the table?
Can FAIR help with any of them, and what would the consequences and side effects be, good and bad?

We especially welcome people from WordPress and TYPO3 who have seen FAIR move from spec to production, drupal.org infrastructure maintainers, hosting providers, governance and neutrality experts, and public sector organisations running Drupal at scale.

Bring your experience, your concerns and your doubts. Let's have the open, slightly uncomfortable conversation about who should carry this weight, and how.