The contract you are required to agree to view the source code [0] is unreasonable:

It requires that you work for free if you think you find a problem (i.e. you are not allowed to just stop):

> Participants who have found or believe they have found a vulnerability are obliged to submit a report in the GitLab platform as an issue set explicitly to confidential

> Researchers shall provide sufficient information to reproduce the Vulnerability so that the Owners can act as quickly as possible. Usually, a vulnerability description is sufficient, but for more complex vulnerabilities, more detailed information may be needed.

> The Researcher accepts to provide support to the Owners to verify the potential Vulnerability,

It requires that you agree to an indefinite NDA, that extends to not disclosing issues you discover:

> No Vulnerability shall be published within a period of forty five (45) days since the last communication exchanged with the Owners with regards to such potential Vulnerability, unless the Owners have agreed to a shorter period or defined a longer period.

(In other words they can extend the NDA indefinitely by pinging you every 45 days, and the last sentence means they might not even need to bother pinging you every 45 days). Also:

> the information received in the Researcher e-mail account must not be shared with or forwarded to any other e-mail account.

It requires that you are not a company (or government) or acting on behalf of one, despite various companies providing, for free, some of the best security research (see project zero)

> Registration for the Program is open to all natural persons willing to comply with the Agreement, with the exception of natural persons who do not act under their own responsibility, but as employees, civil servants, officers or any other subordinate capacity. Registration is therefore not open to organizations, associations, institutions, administrations, governments, government agencies, foreign states, or any other entity that is not a natural person.

On the contrary to the article (which currently states "The source code is published permanently to ensure Swiss Post meets the legal requirements."), source code access is not permanent, but only until the end of the production release. I.e. research into past vulnerabilities appears to be forbidden:

> The Agreement and Source Code Access expires at the termination of the productive use of the release to which the Program is dedicated.

I'm not a lawyer, I'm certainly not a Swiss lawyer, but it is my understanding that the purpose of this program is to comply with article 7a and 7b of [1] (which is linked from [0]). I hope someone who is a Swiss lawyer (some equivalent of the EFF) is looking closely at this, because I don't see how it complies. I don't see how it can be said that "The source code for the system software must [has] be[en] made public" when companies are not allowed to view it and access is temporary. I don't see how it can be said that "Anyone is entitled to examine, modify, compile and execute the source code for ideational purposes, and to write and publish studies thereon." when you aren't allowed to publish vulnerabilities until they choose to release you from the indefinite NDA you signed.

[0] https://www.post.ch/-/media/post/evoting/dokumente/nutzungsb...

[1] https://www.bk.admin.ch/dam/bk/de/dokumente/pore/Federal_Cha...