Why not simply mandate providing code? It doesn't make any sense to wait until the vendor dies to buy.

Because the perfect is the enemy of the good.

Escrow triggered by insolvency or product termination would substantially improve on the status quo.

Mandating source code isn't remotely near perfect either. In an ideal world we wouldn't need currency to organize an economy. People gotta demand more.

I'm not against the idea. I don't want HP-ificiation or Samsung-ification or FAANG-ificiation or any other form of enshittification. Just require _everything_ to be open source to be fully certified. Without open source hardware and software, you're just buying future e-waste. I don't want some workaround like "oh yeah the certificate is for the initial release but you need to update for security and oh by the way the update is not certified".

Otherwise, imagine this scenario:

Company release a product and pushes out the version for the certification. Updates require new versions to be signed with a particular key. A couple months later, the key is leaked! Okay, so keys are rotated and a new update is pushed and the old key is blocked.

What happens to the certification? What use is the certified key? What use is the certified source code? The certification should mandate a user-activatable factory-reset to the certified keys and code, which can't be tampered with by firmware to block or modify a different firmware from being installed.

open to it. perhaps granting an escrow service readonly permission to web server box (not DB) would suffice, as then it could all be pulled down, versus closed source on GH?

i'm new to this but we do want to demonstrate sincerity and put our $ where our mouth is.

see WP: Source code escrow [0]

[0] https://en.wikipedia.org/wiki/Source_code_escrow

these seem to be more about archival after the fact. I would like to see a commercial certification & commitment right from the start, similar to OU for food, UL / ECE for electronics

Currently Software Heritage only preserve publicly available source code, but I think they are thinking about a future source code escrow service too.

https://www.softwareheritage.org/