Open Source Summit North America 2025
2025-06-23..2025-06-25
Denver, United States
[Open Source Summit North America 2017, Open Source Summit North America 2018, Open Source Summit North America 2022, Open Source Summit North America 2023 - Diversity Empowerment Summit, Open Source Summit North America 2023: Open Source On-Ramp, Open Source Summit North America 2024 - Digital Trust, Open Source Summit North America 2025, Open Source Summit North America 2026]
| title | author | length |
|---|---|---|
| 🚀 Open Source Summit North America 2025 Highlights | (not provided) | 01m |
Relive Denver highlights from Open Source Summit North America 2025 where panels and demos showcase cutting-edge AI models, cloud-native stacks, and… | ||
| How To Put Swift in a Box: Container Images From Scratch With Swift Container Plugin | Euan Harris | 42m |
Demonstrates building Linux container images directly from Swift Package Manager using Swift Container Plugin, cross‑compiling Linux binaries on macOS with… | ||
| Welcome & Opening Remarks | Jim Zemlin | 42m |
Open Source Summit opens with concrete milestones: the Open Infra Foundation joins Linux Foundation; the Open Source Security Foundation releases an AI model… | ||
| State of the CD Foundation | Dadisi Sanyika | 19m |
Yearly CDF update covers concrete work: a new SDLC workflow orchestrator for CD Events, a new branch initial commit CD event and explicit support for DORA… | ||
| Security Vibe Check: Which Malware Are You? | Elitsa Bankova, Jess Lowe | 31m |
A quick quiz maps security habits to four real supply‑chain incidents: the xz‑utils backdoor hidden in release tarballs that achieves remote code execution… | ||
| Harnessing Observability for 5G Performance: eBPF and OpenTelemetry I... | Fatih E. Nar, Jamie Parker | 22m |
Shows how eBPF and OpenTelemetry tie into a Kubernetes-native pipeline: bpfman as a CNCF guardian for loaded eBPF programs, the OpenTelemetry Collector… | ||
| EdgeLake: Extending the Cloud to the Edge – an LF Edge Project | Moshe Shadmon | 48m |
EdgeLake claims to keep edge data in place and run SQL queries where the sensors live, returning aggregated results from distributed nodes (demo returns data… | ||
| Gopher Meets Crab: A Rust Journey in Cloud Native | Phil Estes | 36m |
Built a Rust client that drives containerd lifecycle operations (pull, create, start, stop) using the containerd rust extensions crates and an OCI spec crate… | ||
| FUOTA Using LORAWAN and Zephyr: DFU in the 'Real' World | Sidd Gupta | 42m |
Claims a practical FUOTA path for Zephyr devices sending >500 kB artifacts by treating LoRaWAN as SMP over LoRaWAN and extending intercreate’s smpclient plus… | ||
| Zephyr for Open Source Health Devices | Ashwin Whitchurch | 41m |
Open source patient monitors (HealthyPi 5, HealthyPi 6, HealthyPi Move) run a single Zephyr codebase across nRF, STM32 and RP2040 families, sharing drivers and… | ||
| Heterogeneous Linux and RTOS Software Architecture for Low-Price RISC-V... | Jim Huang, Chi-Kuan Chiu | 32m |
Prototypes show a cheap heterogeneous RISC-V board (two cores on a $9 Micr5 Duo) running Linux on the big core and ThreadX on the little core with firmware… | ||
| Keynote: Rebuilding Trust: A FAIR Path Forward for WordPress and O... | Karim Marucchi, Joost de Valk | 11m |
WordPress builds a FAIR Package Manager protocol plus a client/server reference implementation and an optional central node to remove single points of failure… | ||
| Death by (Python) Pickle: "Betrayal ML" | Kadi McKean, Andy Lewis | 39m |
Claim: Python pickle files can carry trojans that backdoor models; examples include PyTorch supply-chain compromises in 2022 and 2023 and a pandas release… | ||
| Open Collaboration in Action: How We Build RISC-V | Rafael Sene | 45m |
Open collaborative process explains how RISC‑V moves from proposals on GitHub and tracked in Jira to ratified specs, with 40+ specs ratified in two years… | ||
| The Power of Consolidation: A Unified Stack for Business Intelligence, Securi... | Josh Lee, Mya Jaye | 36m |
A reproducible three‑container stack demonstrates a unified backend for observability, security, and BI: ClickHouse as the columnar warehouse, an OpenTelemetry… | ||
| Navigating the Sea of CVEs: Securing Your Linux Distributions | Jess Lowe, Holly Gong | 42m |
OSV.dev aggregates over 300,000 advisories across 31 ecosystems and 21 vulnerability databases and adds an upstream field to map distro trackers (USN, DSA) to… | ||
| COSMIC DE - The First Modular, Composable Desktop Environment | Carl Richell, Jeremy Soller | 39m |
COSMIC DE is a Rust desktop that avoids GTK/Qt and builds UI with iced and the System76 libcosmic library, shipping a file manager, editor, store, settings and… | ||
| AI for Kernel Engineers | Sasha Levin | 46m |
AI generates a full patch that replaces open‑coded hash tables with hashtable.h and lands upstream after seven lines change and a human review, and it writes… | ||
| Optimizing Zephyr for Peak Performance | Jacob Beningo | 40m |
Zephyr optimization focuses on concrete wins: use Percepio Tracealyzer or SEGGER SystemView for CI-friendly tracing, size and combine threads to save RAM, pass… | ||
| Why Rust and Zephyr Are a Good Fit | David Brown | 41m |
Project enables writing Zephyr applications entirely in Rust with only 20 lines of glue and full cargo integration works so cargo builds crates inside Zephyr… | ||
| The State of SBoMs in Embedded | Joshua Watt | 41m |
Embedded builds already contain most SBOM inputs and practical options exist today: Yakto spits out per-step SPDX and merges them into a final SBOM, Buildroot… | ||
| A Brief History of Kubernetes Fleet Controllers & Essential Features | Mickael Alliel | 28m |
Managing hundreds to thousands of clusters forces a shift to platform engineering with a claimed 100:1 cluster-to-engineer ratio, so fleet controllers must… | ||
| Improve Load Balancing With Machine Learning Techniques Based on the Sched_ext Framework | Jim Huang | 47m |
An ML-driven, resource-aware load balancer built on sched_ext + eBPF collects scheduling features (task weight, NUMA distance, cache sharing, P/E core type)… | ||
| BoF: Cameras on Linux | Karthik Poduval | 27m |
Linux camera stacks are now centered on libcamera and the Media Controller graph, with concrete features: libcamera 0.5.1 exposes pipeline handlers, a… | ||
| Real-Time I/O (RTIO) for Developing Real-Time Zephyr Applications | Luis Ubieda | 40m |
RTIO is a Zephyr subsystem that moves sensor and bus I/O to submission/completion queues, cuts context switches and copies, and leverages DMA/FIFO where… | ||
| BoF: State of Linux on ARM Laptops | Manivannan Sadhasivam, Stefan Schmidt | 01h 04m |
Linux on ARM laptops currently breaks at install and hardware support because each OEM ships different DTBs and firmware, so ISOs can’t just boot… | ||
| Extending Power Over Ethernet to the LTC4266 | Kyle Swenson | 20m |
Adds LTC4266 driver RFC to the Linux PoE framework to support the last major PSE chipset used across many Ericsson routers, implements semi‑automatic mode… | ||
| U-Boot's New Standard Boot and What's Next | Simon Glass | 33m |
Standard Boot replaces brittle DRO scripts and messy environment variables with a C-driven system that discovers OS images via bootdev/bootmeth plugins and… | ||
| Keynote: Living on the Edge: From Chicken Sandwiches to the Danger... | Brian Chambers, Michael Henry | 22m |
Chick‑fil‑A runs K3s with one git repo per location to enable versioning, rollback and cloneable configs; edge nodes are tiny Intel NUCs or Raspberry Pi 5s… | ||
| Keynote: The Agent2Agent (A2A) Protocol | Mike Smith | 10m |
An open protocol for agent-to-agent communication defines a JSON agent card that publishes name, description, skills and contact methods; a single-method RPC… | ||
| Keynote: The Economic Value of Open Source | Frank Nagle | 22m |
Claim that global open source embedded in commercial software equals about $9 trillion in replacement value, derived by combining a Cookamo 2 lines-of-code… | ||
| Load Testing Is Complicated: A Case Study of NJ Unemployment Insurance | Rob Bayliss | 42m |
Case study of New Jersey unemployment load testing that replaces protocol scripts with browser-based Playwright tests run under Artillery, executed in AWS… | ||
| Navigating the Challenges of Meeting Government SBOM Regulations in Decoupled Archite... | Tracy Ragan | 32m |
Explains why SBOMs alone fail for cloud‑native, decoupled systems and shows concrete remediation steps: expect 30 to 50 services (conservative, often >100)… | ||
| Guarding the LLM Galaxy: Security, Privacy, and Guardrails in the... | Jigyasa Grover, Rishabh Misra | 46m |
A rapid survey of real failures and concrete defenses: a Samsung engineer pastes proprietary code into GPT and an API key theft leads to LLM jacking that racks… | ||
| EdgeLake-FL: An Automated Federated Learning Platform for the Edge | Ori Shadmon, Moshe Shadmon | 36m |
EdgeLake-FL automates federated learning by using EdgeLake as the data layer and a blockchain shared metadata service to synchronize tasks so data never leaves… | ||
| A Deep Dive Into eBPF Program Loader | Cong Wang | 42m |
Loader walks an ELF-like eBPF binary through four phases: discovery, resolution, kernel interaction, and attachment, using libbpf to parse sections, create… | ||
| The Generative AI Commons: Unlocking Potential Through Collaboration and Transpare... | Arnaud J Le Hors | 41m |
Generative AI Commons describes a concrete Model Openness Framework that grades model distributions by 17 components across code, data and documentation and… | ||
| Through the Looking Glass: Leveraging Overton Window Concepts To Redefin... | Ben Somogyi, Alec Lewis | 27m |
A modular infrastructure-as-code framework that maps declarative modules to interchangeable providers reduces NRE and accelerates deployment: deployed across… | ||
| Securing OIDC Federation in CI/CD Workflows | Billy Lynch | 20m |
Explains how OIDC tokens from GitHub Actions, GitLab and Kubernetes are exchanged via an STS-style federation to get short-lived cloud credentials, and shows a… | ||
| Securing the Software Supply Chain: Integrating OpenSSF Scorecard, Jenkins, and the O... | Tracy Ragan | 27m |
OpenSSF Scorecard scores plus Jenkins CI feed SBOMs into Ortelius which aggregates SBOMs to application level and maps each vulnerability to component and live… | ||
| Disconnected Environments in a Connected World | Daniel Moch, Eddie Zaneski | 40m |
Most modern tools assume always-on internet so deploying into air-gapped networks forces concrete fixes: bundle full dependency trees (Hopper ecosystem creates… | ||
| Universal AI: Execute Your Models Where Your Data (And Users) Are | David Aronchick | 37m |
Claim: run ML next to users and data so pipelines stay fast, cheap and compliant. Platform Bakalao (Expanso) runs on WASM, Docker, Wom and arbitrary binaries… | ||
| Tutorial: From Planni... | Andreas Kollegger, Ezequiel Lanza, Rakshith Krishnappa, Katherine Druckman | 01h 36m |
Hands-on steps deploy a production-ready RAG chatbot atop the OPEA blueprints using a provided EKS cluster (workshop studio access ~3 hours). Architecture… | ||
| Generative AI Model Data Pre-Training on Kubernetes: A Use Case S... | Anish Asthana, Mohammad Nassar | 22m |
Demonstrates a production pipeline that uses Kubeflow Pipelines, KubeRay and Ray to run embarrassingly parallel annotative transforms (deduplication, language… | ||
| What’s New in Valkey | Madelyn Olson, Ping Xie | 36m |
Valkey 8.1 replaces the core hash table to cut per-item overhead (example: small key/value overhead drops from ~112 bytes to ~64 bytes, roughly 20% memory… | ||
| Intuit Journey To Unified Observability at Scale: Challenges, Be... | Kalyan Kolachala, Ashwini Dulam | 50m |
Intuit-level scale observability unifies 320+ Kubernetes clusters, ~8,000 services, 2 billion active time series, 10M trace spans/sec and 1.2PB logs/day peak… | ||
| From Origins To Open Source: The Journey of DreamWorks Animation's Production Path T... | Randy Packer | 44m |
MoonRay is an open-source production path tracer that the studio uses on feature films (How to Train Your Dragon, Puss in Boots, The Wild Robot, Bad Guys 2)… | ||
| How We Progressively Deliver Changes To Kubernetes Using Canary Deployments and Featur... | Bob Walker | 20m |
Octopus Deploy moves 1,600 customer instances to a model of short canary rollouts plus feature flags, using OpenFeature for segmented flags and a built-in… | ||
| Reducing the Risk of Source Tampering With SLSA | Tom Hennen | 20m |
SLSA Source Track defines concrete controls and four levels: Level 1 needs a VCS and revision-identifiers; Level 2 enforces protected-branch history retention… | ||
| Lock the Chef in the Kitchen: Enabling Accurate SBOMs Via Hermetic Builds | Adam Cmiel | 20m |
Hermetto is a CLI that reads manifests, downloads all declared packages (npm/yarn, pip, Cargo, Go modules, bundler, plus generic URL fetches and partial RPM… | ||
| Open Source in the Federal Government | Jordan Kasper | 38m |
Federal agencies run tens of thousands of systems and arguably government is largest consumer of OSS, yet the code inventory required by M‑16‑21 lapses… | ||
| The MODERN Modern Data Stack: Building an Open Distributed Data Warehouse Beyond... | David Aronchick | 36m |
Argues that bringing compute to data cuts egress, latency and compliance risk and shows a working stack: deploys Bacalhau agents on VMs across AWS GCP and… | ||
| Beaconforge.org, Open Agentic AI for Hallucination Mitigation | Diego Gosmar | 30m |
An open JSON spec called Open Floor with a ready Beaconforge Python sandbox lets independent assistants publish manifests, exchange natural-language fields… | ||
| Leveraging the OPEA Platform and GraphRAG Architectures To Drive Cl... | Stephen Chin, Ezequiel Lanza | 38m |
OPEA platform provides Docker/Kubernetes blueprints and composable microservices (LLM, embeddings, vector DB, graph DB, prompt store, UI) and plugs in… | ||
| How To Accelerate Software Defined Vehicle(SDV) With OSS | Yuichi Kusakabe | 50m |
Honda builds an in‑house IVI team that begins with two people and scales into regional software centers, uses AOSP and OSS plus SPDX Lite and achieves… | ||
| Building Trust in ML: Mapping the Model Lifecycle for ML Integrity and Transparency | Marcela Melara | 31m |
Atlas maps end-to-end ML provenance by linking dataset, training script, model and evaluation artifacts with cryptographic hashes and storing signed CTPA… | ||
| Travel Retail Disruption using Open Source | Stu Waldron | 38m |
Argues that travel retail can be rebuilt with open source by publishing a standard offer container plus reference code for publishing, shopping, offer/order… | ||
| BoF: Technical Deep Dive on Challenges getting to the Enterprise E... | Brian Chambers, Michael Henry | 01h 01m |
Deployable patterns and hard rules: build a known hardware “north star” node, tear one down to inventory ports and Redfish IDs, and use Podman and Ansible… | ||
| Ask Anything: CD Foundation Edition | Dadisi Sanyika, Mark Waite | 29m |
CD Foundation updates progress from prototype to a ratified interoperability spec for CD Events spec, with new events added to fully support DORA metrics and a… | ||
| Implementing Zero Trust Security in Jenkins Pipelines With Open Source Tools | Steve Taylor | 21m |
Pipeline enforces concrete zero trust steps: run Mega Liner linting at PR and merge, build the artifact, generate SBOMs with Trivy or sift for repo and image… | ||
| Keynote: Ten Years as a Free, Open, and Automated Certificate Authority | Josh Aas | 06m |
Lets Encrypt issues 7 million certificates per day and serves over 600 million websites, helped push US HTTPS to ~90% and global to ~80%. Infrastructure… | ||
| Keynote: An Open-Source Stack for AI Compute: Kubernetes + Ray + PyTorch + vLLM | Robert Nishihara | 16m |
Slides argue a reproducible stack that wires Kubernetes + Ray + PyTorch + vLLM to handle training, multimodal data processing, and serving at scale. Ray… | ||
| TODO Steering Committee - Management & OSPO Ask Anything | Brittany Erica Istenes, Natali Vlatko, Georg Kunz, Ashley Wolf, Stephen Augustus, Annania Melaku | 40m |
The session lists concrete resources and outcomes: an OSPO book published as an open-source project, a public certification course, a published maturity model… | ||
| Docs That Scale: Strategies for Sustainable Documentation in Open Source Projects | Zainab Daodu | 45m |
Shows how to make docs evolve with code by wiring documentation into GitHub: use PR templates and labels to auto-create doc issues, run CI style and link… | ||
| Radical Transparency: Lessons From Open-Sourcing Nearly All Company Documenta... | Victor Lyuboslavsky | 42m |
Company policy makes nearly all docs public—GitHub issues, Figma wireframes, ADRs, sprint demos and a public handbook—so customers can follow issues and… | ||
| D(ocs)&D(evelopment): Finding the Perfect Party for Your Documentation... | Heds Simons, Kim Nylander | 41m |
Grafana documents Tempo (open-source tracing DB) by pairing Field Engineers and Technical Writers, running a bi-weekly 4-hour cadence to turn hands-on demos… | ||
| Lightning Talk: LF Energy SEAPATH: Building an Open Source Ecosystem for the... | Christophe Villemer | 14m |
SEAPATH claims a production-ready, industrial-grade open source platform for virtualized digital substations with V1 release (January 2025) and production… | ||
| Lightning Talk: Lessons Learned From 10 Years of Automotive Grade Linux | Walt Miner | 15m |
Automotive Grade Linux unifies multiple OEMs and Tier‑1s into a single distribution (the UCB) built with Yocto, using systemd, pipewire and wireplumber… | ||
| Enhancing SBOM Generation: Filling the Gaps To Make Actionable SBO... | Ian Dunbar-Hall, Gary O'Neall | 38m |
SBOM reference implementations for Python, Java and JavaScript produce pipelines that augment Syft/Trivy output with top-level metadata, enrich thousands of… | ||
| Sponsored Session: Operational Data Stores for Financial Risk Mitigation | Bryce Curtis | 43m |
Discover builds an operational data store that ingests CycloneDX SBOMs plus CMDB, SCA and community data (pulling scorecards from deps.dev) and refreshes… | ||
| Sponsored Session: Navigating Open Source AI with Guardrails | Stacey Miller, Mandanna Appanderanda | 26m |
Conference slides cite McKinsey: 92% plan heavy AI investment, only 1% reach maturity and 44% of prototypes never hit production, so security is urgent. Two… | ||
| Analyzing The Projects We All Depend On - With LFX Insights | Jonathan Reimer | 41m |
LFX Insights delivers a public dashboard that scores projects 0–100 across 4 dimensions (contributors, popularity, development, security) using benchmarks and… | ||
| Open Source as a Business Imperative: Leveraging PEST Analysis for... | Kazumi Sato, Masayuki Kuwata | 31m |
Sony validates past open source choices using PEST analysis and quantitative signals like OSCI by EPAM, showing Linux adoption (started 2002), WebKit for… | ||
| The Role of Package Managers as Partners in License and Attribution Compliance | Damián Vicino | 36m |
Package managers routinely hide transitive changes so ten or twelve declared dependencies balloon to hundreds of transitive deps and a single version bump can… | ||
| Alignment of Community Contributions and Business Goals - How Can Your OSPO Help? | Masae Shida | 42m |
A program builds a single source of truth in an OSPO wiki portal: a centralized table listing project name, repo link, last updated date, products that use it… | ||
| BoF: Collaboration with Universit... | Sayeed Choudhury, Stephanie Liegg, Nithya A. Ruff, Natali Vlatko | 46m |
Companies describe concrete paths: funding research gifts and targeted sponsorships, running a scholar program that embeds professors part‑time in corporate… | ||
| Documenting the Design of the Linux Kernel | Chuck Wolber, Kate Stewart, Gabriele Paoloni | 53m |
Proposes a machine‑readable requirement template that embeds stable ID/hash key comments in kernel source, auto-generates SPDX‑style IDs, and links each… | ||
| Lower the Barrier of Entry: Empowering Non-writer Contributions To Docs | Manny Silva | 39m |
Argues that removing friction — simpler editors, templates, AI drafting, automated style linting, and content validation — measurably increases non-writer… | ||
| What Do Legislations Have To Do With Tackling Maintainer Burnout? | Ildikó Váncsa | 42m |
Argues that recent laws (EO14028, the US Securing OSS Act draft, EU Cyber Resilience Act) shift legal responsibility onto product manufacturers to report… | ||
| Keynote: OpenSearch 3.0 and Lucene 10, Paving the Way for AI and Vector Innovation | Andrew Ross | 05m |
OpenSearch 3.0 upgrades to Lucene 10 and a newer JDK, yielding an average latency drop from 160 ms to 16 ms across core queries (about 10× faster)… | ||
| Keynote: Open Source as Endurance Infrastructure for Environmental Justice | Shannon Dosemagen | 16m |
Community groups build DIY air monitors using replicated EPA SUMA canisters, odor maps and grab-sample bags to document refinery flares; balloon and kite… | ||
| Keynote: Welcome Back | Jim Zemlin | 02m |
Housekeeping items list attendee activities and prizes: Puppy Palooza 12:35–2:10 p.m. in the forum sponsored by Chronosphere, a women and non-binary lunch… | ||
| Sponsored BoF: Cultivating Quality in Open Source: Modern Strategies for Shared Res... | Lance Willett | 39m |
Maintains quality across WordPress.org’s 55,000+ plugins and 13,000+ themes by combining telemetry (10M sites of data), a dedicated QA team (historically six… | ||
| Panel Discussion: Why the Time Has Come To Disrupt Mobile Application Development | Hilary Carter, Saurabh Goyal, Diego Zuluaga, Richard Sikang Bian, Hyo Chan Jang, Daniel Goldschei | 54m |
Research of 23 expert interviews finds Android and iOS still control ~99% of smartphones but emerging OSs and 1.75 billion installs force costly per-platform… | ||
| Lightning Talk: From Fork To Foundation: The OpenSearch Journey To the Linux Found... | Dotan Horovits | 12m |
OpenSearch starts as a 2021 fork after Elasticsearch relicensing and lands in the Linux Foundation in September 2024, with 650 pull requests, 56,000 files… | ||
| Panel Discussion: The Impact of Funding f... | Georg Link, Andrew Nesbitt, Dawn M Foster, Alyssa P Wright | 40m |
Many critical open source projects run on one person’s shoulders and that matters: 55% of top 10,000 critical projects are single-user-owned, creating huge… | ||
| Panel Discussion: Driving Automotive... | Philipp Ahmann, Kate Stewart, Masato Endo, Wolfgang Gehring | 36m |
Automotive companies report concrete shifts: a modern E‑Class already contains 3,000 FOSS components, Toyota establishes an OSPO in January after 15 years of… | ||
| Panel Discussion: Open... | Tony Wasserman, Stormy Peters, Rao Lakkakula, Nithya A. Ruff, Hilary Carter | 47m |
Panelists say generative AI like Copilot is already producing usable code and correlates with increased contributions from women and novices, yet teams worry… | ||
| Who Will Maintain the Future? Tackling the Graying of Open Source Software | Abigail Cabunoc Mayes | 36m |
Maintainers over 46 double since 2021 while contributors under 26 fall from 25% to 10% — a 60% drop — and 60% of maintainers report quitting or considering it… | ||
| Solving the Phantom Dependency Problem for Python Packages | Seth Michael Larson | 36m |
Phantom dependencies are bundled native libraries that aren’t listed in Python metadata, causing SCA and vulnerability checks to miss them; the concrete fix is… | ||
| Wait, So Now You're Telling Me We Need FGA? | Carla Urrea Stabile | 23m |
Shows a concrete RAG workflow that uses OpenFGA plus the OpenAI SDK and a local vector store to prevent sensitive data leakage by filtering retrieved documents… | ||
| Extending Container Performance Isolation: Regulating Memory Bandwidth & Cache in... | Jonathan Perry | 28m |
Claim: shared last-level caches and memory bandwidth can slow services up to 4–13x and produce millisecond-scale spikes; existing resctrl + cgroup filesystem… | ||
| Simulating Embedded Systems With Zephyr | Mohammed Billoo | 49m |
Demonstrates using Zephyr with Ztest and Twister for unit and integration testing (encourages CI/CD from first push), running native_sim and x86 binaries, and… | ||
| Boot-Time BOF | Tim Bird | 41m |
Boot-time SIG coordinates monthly work on concrete tools and patches: a unified boot log that uses cycle counters to cover firmware→kernel→userspace timing… | ||
| Improving Linux Boot Time for Automotive Use Cases | Brian Masney, Eric Chanudet | 42m |
Kernel bring-up reaches user space in about 350 ms to userspace on the tested aarch64 board after targeted changes: linear map creation drops from 350ms→25ms… | ||
| Regression Testing Boot-time Performance in the Linux Kernel | Tim Bird | 39m |
A boot-time regression test suite is built that collects initcall durations and printk-defined regions, matches run metadata to off-tree reference files, and… | ||
| Unlocking the Full Potential of WPE To Build a Successful Embedded Product | Mario Sanchez-Prada | 43m |
WPE is an embeddable WebKit port optimized for devices; teams report using it on iMX and Raspberry Pi boards, migrating WPE to Skia for 2D rendering and GPU… | ||
| Dynamic VM Memory Resizing daemon (vmrd) | Sudarshan Rajagopalan | 36m |
Guest-driven daemon vmrd uses Linux PSI signals and the virtio-mem interface to proactively request or return memory blocks from the primary VM, implemented in… | ||
| Skip the Wait: Maximizing SPI Throughput in the Linux Kernel With SPI Offloading | David Lechner | 34m |
Adds new SPI core APIs (SPI optimized messages in 6.9, SPI offload landed in 6.15) enabling an offload provider/trigger provider model that registers offload… | ||
| Valkey in Telecom: Leveraging Open Source for Unique Needs and G... | David Östman, Viktor Söderqvist | 33m |
Ericsson describes adopting Valkey (a fast Redis fork) inside 5G core stacks, handling millions of requests per second using a clustered, sharded architecture… | ||
| The Technical Talent Market in 2025: Fortifying for AI, Cybersecurity, and Regulatory Compliance | Anna Hermansen, Clyde Seepersad, Adrienn Lawson, Christopher R Robinson | 42m |
Survey of 556 respondents finds 84% say open source culture helps retain engineers and 68% understaffed in AI/ML while 65% report cybersecurity and compliance… | ||
| Enhancing Scalability of the Vmalloc Mechanism in the Linux Kernel | Adrian Huang | 31m |
Linux vmalloc moves from a single global lock to a distributed vmap node design with per-node red-black trees, lists and locks and a per-node cache pool for… | ||
| “Early Boot and Late Attach” of Remote Processor... | Beleswar Prasad Padhi, Vaishnav Mohandas Achath | 39m |
Bootloader brings real-time rprocs up early so an R5 handles splash and rear‑view capture while Linux boots, then Linux performs a late attach by parsing a… | ||
| ARM64 Linux Laptops Status Report | Stefan Schmidt | 42m |
Since June a wave of Snapdragon X Elite laptops appears with over three dozen devices but Linux does not boot out of the box: ACPI tables are incomplete so… | ||
| Virtio for PCI Endpoint Subsystem in Linux Kernel | Manivannan Sadhasivam | 30m |
Adds Virtio backend support to the PCI Endpoint subsystem by using the virtio message transport instead of legacy PCI Virtio, implementing a host-side Virtio… | ||
| Three Decades in Kernelland | Jonathan Corbet | 44m |
Kernel size reaches 40 million lines of code and development stays monotonic through crashes, lawsuits, and a pandemic; the project moves from BitKeeper → git… | ||
| Composite Video Device Abstraction for Libcamera | Karthik Poduval, Kamalanadh (Kamal) Vedantham | 29m |
Libcamera gains a C++ composite v4l2 video device that presents an ISP plus memory‑to‑memory postprocessors (dewarp, JPEG) as one video node, driving selection… | ||
| Early Ethernet With Linux | Keerthy Jagadeesh | 34m |
Achieves usable Ethernet on a TI DRA821 gateway SOC in about 1.8–2.0 seconds and brings the internal CPSW switch up in ~500 ms by changing the boot and driver… | ||
| Efficient On-Device Core Dump Processing for IoT: A Rusty Implementation | Blake Hildebrand | 38m |
Memfault ships a Rust core-handler that parses ELF cores, extracts PRSTATUS registers and proc maps, copies only program headers and build ID notes, and… | ||
| Bring the Power of Wireshark To Syscalls and Logs With Stratoshark | Gerald Combs | 43m |
Stratoshark brings Wireshark’s dissection engine to system calls and logs, built on libscap/libs and shipping plugins for CloudTrail and GCP audit logs… | ||
| Your Silent Software Saboteur: Open Source Malware | Brian Fox | 33m |
Open source repositories are flooded with intentional malicious packages — about 850,000+ malicious packages detected versus ~762,000 actively used components… | ||
| The Life of a Kernel Bugfix | Thadeu Lima de Souza Cascardo | 39m |
A kernel bugfix follows an upstream-first path: patch submitted to mainline with a Fixes: line and CC: stable triggers automatic backports and inclusion in… | ||
| Rex: Safe and Usable Kernel Extensions in Rust | Jinghao Jia | 39m |
Rex is a Linux kernel-extension framework that lets extensions be written in safe Rust only and eliminates the in-kernel verifier by emitting native code from… | ||
| Make Valkey Multi-threaded With Userspace RCU | Jim Huang | 33m |
Modified Valkey implements a coordinator–worker pattern with per-thread event loops and a single-writer/multiple-reader model using userspace RCU to enable… | ||
| West: Explained in Simple Words | Roy Jamil | 43m |
West is a lightweight, Python-based meta-tool that manages Zephyr’s many git repos via a central manifest west.yaml and three workspace layouts (T1/T2/T3) so… | ||
| Build Zephyr for MicroBlaze-V FPGA Using Yocto Project | Sandeep Gundlupet Raju | 48m |
Yocto uses multiconfig plus meta-zephyr and vendor layers to produce a packaged Zephyr kernel, drivers and apps for MicroBlaze‑V RISC‑V FPGA; workflow converts… | ||
| IREE: An AI Subsystem for Zephyr? | Peter Kourzanov, Anmol Anmol | 37m |
IREE runs on Zephyr POSIX with a new RISC‑V 64-bit BSP, serial driver, filesystem image and a run_module flow, packaged reproducibly with Guix. Benchmarks… | ||
| Sensor Data Acquisition With Linux's IIO Subsystem and Libiio | Robin Getz | 46m |
IIO now supports mainstream sensor stacks with ~700 driver files (~250k LOC) and over 1,000 contributors, exposes in-kernel buffering and triggers, and lets… | ||
| Debugging USB Type-C Power Delivery: Beauty and the Beast | Marcel Ziswiler | 43m |
The RADXA ROCK 5B refuses some Type‑C chargers: it boots fine on upstream Linux v6.13.1 but boot‑loops on Radxa’s downstream v6.1 because PD negotiation often… | ||
| Agents in Action: Advancing Open Source AI Missions | Hema Veeradhi | 40m |
Defines agents as LLMs that plan, call tools and act; demonstrates a working agent built on LlamaStack + Granite 8B that reads OpenShift logs via an OpenShift… | ||
| Open AI (Two Words): The Only Path Forward for AI | Matt White | 25m |
Argues that open-source AI is regaining parity with closed models as the performance gap shrinks to about one to two months, driven by projects like PyTorch… | ||
| Whoops! I Accidentally Leaked My Cloud Keys | Eve Martin-Jones, Hayden Blauzvern | 33m |
A pipeline that scans 6.5 billion files across GitHub, npm, PyPI, Maven, RubyGems and Docker Hub unpacks images layer-by-layer, matches regexes and reports… | ||
| Building InnerSource Community: What Goes Behind the Scenes? | Shanmugapriya Manoharan | 33m |
Maintainers must make a component actually reusable, modularize it, and prepare repository readiness with clear docs, permissions and onboarding steps… | ||
| Keynote: Security, Critical Infrastructure, and Community: How the Three Shall Meet | Phil Robb | 04m |
Ericsson describes concrete security work for telco infrastructure after the 2024 Salt Typhoon attacks, noting those breaches didn’t stem from open source yet… | ||
| Toward Usable Open-Source Remote Attestation for Cloud and Edge | Lily Sturmann, Michael Peters | 46m |
Demonstrates an integration between Keylime and flightctl that replaces Keylime’s pull model with a Keylime verifier push API so flightctl’s agent sends TPM… | ||
| Gotta Cache 'em All: Scaling AI Workloads With Model Caching in a Hybrid... | Rituraj Singh, Jin Dong | 31m |
Bloomberg implements a GPU-local model cache using KServe model-cache CRD and a node agent to auto-redownload missing models, plus a Karmada propagation policy… | ||
| Lightning Talk: Future-Proofing Compliance: Leveraging Knowledge Graphs and AI in Cybe... | Zeyno Dodd | 15m |
An open-source proof of concept combines knowledge graphs with Retrieval Augmented Generation and a community‑edition LLM to automate mapping between NIST CSF… | ||
| Noisy Neighbor Detection: A New OSS Collector | Jonathan Perry | 34m |
Latency can jump 4–13x from memory contention and garbage collection, and second‑scale collectors miss it. The project builds an OSS collector that samples… | ||
| Let’s Farm Out Our Image Builds! | Urvashi Mohnani | 27m |
Podman farm uses the Podman unix socket over SSH to send a single build to remote nodes of different CPU architectures, run native builds in parallel on those… | ||
| BoF: Meet and Chat about Open Source in Automotive! | Walt Miner | 39m |
Room-style discussion format focused on concrete problems and solutions: progress on an AGL SOV reference platform with Honda and Toyota involvement, ELISA… | ||
| The Power of "AND": A New Template for Open Source Sustainability | Alyssa P Wright, Francesca Romano | 42m |
Bloomberg reports a concrete template: embed philanthropy into OSPO work and measure project, business, participant and public impact. Built programs include a… | ||
| The Responsible Generative AI Framework (RGAF) : An Introduction | Jim Schreckengast | 26m |
The Responsible Generative AI Framework (RGAF) lays out 9 Dimensions for ethical systems, backed by a ~47‑page white paper and a community of over 80… | ||
| The Open Source Solution That Actually Works | Syed Usman Ahmad | 27m |
Claims a single open-source stack collects logs, metrics, traces and CPU profiles and shows them together; demo runs Grafana in Docker with Prometheus, Loki… | ||
| Linux Networking: Key Understanding and Practical Troubleshooting | Muna Nwaiwu | 23m |
Covers concrete Linux commands and a one‑file troubleshooting workflow: persistent configs via nmcli and netplan YAML, quick state checks with ip address show… | ||
| Breaking and Fixing the Kernel: Crashes, Debugging & Performance Tun... | Hardik Garg, Thomas Ballasi | 37m |
Covers four concrete kernel crash classes—null pointer dereference, stack overflow, use after free and divide by zero—reproduced on Azure Linux VMs and… | ||
| Cross-cloud App Splitting With WebAssembly Components | Matt Butcher | 52m |
Claim: one codebase compiles to WebAssembly and is split at deploy time so pieces run in different Kubernetes clusters, clouds, or edge locations. Uses Rust… | ||
| Effortless Secure and Control Traffic Using Kubernetes Gateway API for Ingress, Egress an... | Lin Sun | 41m |
Live demo uses Kubernetes Gateway API + Istio Ambient Mesh, Kgateway, Argo CD, Kiali and Prometheus to manage ingress, egress and service-to-service traffic… | ||
| Apache Gravitino: A Multi-regional, Geo-distributed Meta Datalake | Justin Mclean, Lisa Cao | 31m |
Apache Gravitino presents a geo-distributed metadata lake that discovers schemas automatically, propagates schema changes back to sources, and runs… | ||
| Mock Me If You Can: Using Mocks in Container Applications for Integration Testing | John Coyne | 33m |
A practical demo shows using Wiremock sidecar containers (Docker image copied into a pod) to run narrow integration tests for a small "issues-handler" app that… | ||
| Standards and Specifications at the Linux Foundation | Jory Burson | 22m |
Linux Foundation hosts about 200 open projects with spec components, six ISO standards, 36 traditional consortia and roughly 3,500 contributors from 500… | ||
| Making EU CRA (Cyber Resilience Act) Simplified and Non-scary for OSS Contributors | Roman Zhukov | 42m |
EU CRA largely excludes individual contributors (recital 18) but places potential obligations on maintainers who charge beyond cost or whose code is monetized… | ||
| New Leadership and Roles | Jonathan Bryce, Chris Aniszczyk | 02m |
The announcement formalizes joint leadership between The Linux Foundation and CNCF to broaden Cloud & Infrastructure scope, consolidate roles, and scale… | ||
| Building the Future Developer: Trends in Open Source, Education... | Phoebe Quincy, Kim Schlesinger | 40m |
Recent studies show one human using AI beats a team without it (776 Procter & Gamble participants), and GitHub Copilot users write 12% more code and 24% less… | ||
| Lightning Talk: Serving Guardrail Detectors on Vllm | Evaline Ju | 07m |
An open-sourced vLLM detector adapter adds detector endpoints to a vLLM server so Granite Guardian, Llama Guard or simple regex/encoder detectors run through… | ||
| Lightning Talk: Streaming and Processing Edge Vision Data in Real Time | Joyce Lin | 09m |
Edge vision systems run lightweight models locally and send only events or metadata upstream, claiming up to ~25% revenue loss from empty shelves and solving… | ||
| A Beginner's Guide To Programming Quantum Computers With Open-... | Sagar Kesarpu, Harikrishna Muriki | 51m |
Begins with a live demo using Qiskit (also mentions Cirq and PennyLane) to create two qubits, apply a Hadamard then a CNOT, run thousands of shots on a… | ||
| Steps Towards Achieving a Secure Linux Server | Karissa Sanchez, Angelina Vu | 30m |
An Ubuntu web server with a deliberate code‑injection flaw allows arbitrary shell commands, letting the attacker overwrite index.html with "you've been hacked"… | ||
| Unveiling Arm Confidential Computing Architecture Software Stack | Kevin Zhao | 38m |
Arm CCA spec hits mainline (released Sep 2024) and firmware lands as TF-A 2.20 with IMM 0.6; EDK2 staging is merging but DMA and hugepage support remain… | ||
| Towards Confidential AI for the Masses! | Julian Stephen, Michael Le | 47m |
Shows a working end-to-end confidential inference service that boots a CVM, attests CPU and GPU, mounts an encrypted volume, downloads an encrypted model from… | ||
| Virtio-msg: Making Virtio Work Where It Does Not Today | Bill Mills | 34m |
A new transport called virtio‑msg converts MMIO reads and writes to messages so virtio works on AMP cores, secure world TEEs, and devices that cannot… | ||
| Test Harness: Continuous Testing on Hardware | Julia Anjanet Pineda | 35m |
A fully automated board farm runs continuous hardware tests on every commit or PR: artifacts from Artifactory get pulled, flashed and validated, and results… | ||
| Transforming Software Development and Engineering Velocity at EBay With AI/ML in C... | Aravind Kannan | 20m |
eBay describes an internal AI/ML CI/CD platform that measurably speeds delivery: 1,600+ daily commits across 4,000 apps, commit‑to‑prod down to ~45 minutes… | ||
| Telemetry Showdown: Fluent Bit vs. OpenTelemetry Collector - A Comprehensive Benchma... | Henrik Rexed | 19m |
Benchmarks run with logs only, logs+traces, and logs+traces+metrics show Fluent Bit using 15–20 MB vs OpenTelemetry Collector 80–120 MB for simple log… | ||
| Unleashing the Power of Mutation Testing: Supercharging Software Quality and Resilien... | Emma Taylor | 20m |
Mutation testing intentionally mutates code to prove test suites actually catch faults, demonstrated by a simple C++ mutant example: plus→multiply that leaves… | ||
| Architecting for the Long Haul: Technical Strategies for Sustainable Open-Source Support Models | Andrew Sullivan, Mark Asselstine, Megan Knight, Katherine Druckman | 41m |
Open-source projects need concrete plans: Yocto runs a four-year LTS but teams still lack a post‑LTS place to collaborate; one project reports doing roughly… | ||
| Navigating FINTECH’s Regulatory Waters With InnerSource | Brittany Erica Istenes, Russell Rutledge | 40m |
Claim: InnerSource reduces regulatory friction in FINTECH by creating searchable, centrally maintained components that auditors can inspect instead of auditing… | ||
| Panel Discussion: It Takes a Village - The Case for a Versatile Open Source Workforce | Ildikó Váncsa, Charles Eckel, Ray Paik, Ria Farrell Schalnat | 42m |
Panel describes concrete practices: running an IETF hackathon: 4 projects, 40 people to ship reference implementations; using TiDB and Chaos Mesh inside CNCF… | ||
| Recipe for Discovery: Building the UC Open Source Repository Browser From Scratch | Juanita Gomez | 33m |
Built a relational database from GitHub REST API queries and campus keyword combinations, collecting metadata, READMEs, contributor info and community files… | ||
| DEI Is Dead: What Happens Next? | Jennifer Madriaga | 40m |
Claims that DEI programs are being cut but the issues persist, supported by cited numbers: 91% of workers report discrimination, 94% value belonging, support… | ||
| CD Demands Continuous Testing: Why We Built a Testing Platform Layer on ECS Usin... | Jaime G. O'Byrne | 11m |
JPMorgan builds a testing platform layer on ECS that runs functional suites inside a controlled ECS task with kitchen-sync image, removing manual secret… | ||
| A Secure Tekton Task by Using Confidential Containers | Tatsushi Inagaki | 18m |
Protects a Tekton task and its artifact signing key even if the cluster administrator is compromised by running the task pod inside a trusted execution… | ||
| Cybersecurity with CDF & OpenSSF Focus Group | 01h 16m | |
Less than half of companies generate SBOMs today, yet SBOMs attached to revenue are already forcing adoption for government contracts; some teams produce both… | ||
| Practitioners' Panel | Bob Walker, Brett Smith, Kate Scarcella, Ben Powell, Melissa McKay | 41m |
Panelists give concrete wins: consolidation to a monorepo of 12 services cuts PR complexity and infra cost; an event‑driven, asynchronous pipeline shifts left… | ||
| Lightning Talk: One Year In: The State of the DataOps Initiative | Lisa Cao | 09m |
One year after launching the DataOps Initiative under the CD Foundation the project defines core principles, runs biweekly community meetings with several core… | ||
| Your Deployments Are Lying. AI Knows | Seema Saharan, Aditya Soni | 21m |
CI/CD shows green while 10% of users see checkout or cart failures; logs show slight wording shifts and one trace span slows by ~150 ms. The demonstration ties… | ||
| Who Are You Building For: Pipelines Have a Purpose | Andrew McNamara, Julen Landa Alustiza | 19m |
Red Hat builds a Tekton-based platform called Conflux that produces Tekton Chains SLSA provenance at build-level 3, signs provenance with isolated keys, and… | ||
| Sponsored Session: Unlock Growth and Talent: Effectiveness of Mentorship in Open... | Nate Waddington | 40m |
CNCF runs 3 terms per year of the LFX mentoring program with 12‑week, project‑scoped placements and recommends two mentors per mentee; projects expect roughly… | ||
| Defining Open Source AI: Can the “Judgement of Solomon” Help the Open Source Commu... | Arnaud J Le Hors | 19m |
OSI publishes a first Open Source AI definition but adoption stalls and critics call it too rigid; debate centers on license mismatches (software licenses vs… | ||
| Security, Privacy & Authenticity on the Web | Daniel Appelquist | 22m |
W3C publishes ethical web principles and a parallel set of privacy principles that require purpose specification, data minimization and machine‑readable… | ||
| Tutorial: Guarding the Gates: Understanding and Mitigating OWA... | Neetu Jain, Kimberly Nowell-Berry | 55m |
OWASP lists the Top 10 LLM risks and ranks prompt injection as the most critical, demonstrated by live Gandalf capture-the-flag lab and Viz/MLLDoc exercises… | ||
| Lightning Talk: Shift Left With AI: Smarter Code Reviews for DevOps... | Vaibhav Tupe, Shrinath Thube | 07m |
AI-powered assistants run real-time IDE reviews and pre-commit hooks that flag bugs, secrets, security flaws, test coverage gaps and policy violations before… | ||
| Standardizing CI/CD Observability: Insights From the OpenTelemetry CI/CD SIG | Dotan Horovits | 20m |
Standardizes CI/CD telemetry via the OpenTelemetry CI/CD SIG with published semantic conventions for pipeline, deployment, VCS, test and artifact attributes so… | ||
| Sponsored Session: Unifying Observability at DoorDash using Open Stand... | Owen Zhang, Victor Soares | 25m |
DoorDash replaces an ETL batch pipeline with an OpenTelemetry → Chronosphere pipeline for mobile metrics, cutting volume and cost and improving alert… | ||
| Sponsored Session: Lessons Learned from Moving 2 Million Engineers from AngularJS t... | Stephen Fluin | 33m |
Claims that Google migrates about 2 million engineers off AngularJS and that Angular now has over 3 million developers; adoption relies on automation rather… | ||
| Stories From the Trenches: Effective Collaboration Between OSPOs and R&... | Georg Kunz, David Östman | 40m |
Ericsson describes a central four-person OSPO in the CTO office working with an engineering center of excellence to push upstream contributions: two-year… | ||
| Empowering Asian Contributions: The Rise of Regional User Groups in... | Naomichi Shima, Norio Kobota | 41m |
OpenChain Japan launches in 2017 and runs 33 all member meetings, eight sub work groups and a mailing list with over 100 entities and 230+ subscribers… | ||
| Six Years of Empowering Open Source Communities | Shuah Khan | 41m |
Six years of Linux Foundation mentorships scale from three kernel graduates in 2019 to 253 graduates from 213 programs last year, drawn from 13,840… | ||
| FLOSS Mentorship Unconference: A Community Event to Share, Shape, & Scale Mentoring Efforts in Op... | 01h 58m | |
Unconference builds the agenda live and breaks into working sessions that actually produce notes on a public GitHub repo (ossna.flossmentoring.org); attendees… | ||
| Panel Discussion: Contribute with Clarity: Choosing Your... | Joanna Lee, Scott Nicholas, Jory Burson | 32m |
Linux Foundation now hosts over 200 projects and adds 150–250 a year while offering a Community Specification License designed to let GitHub workflows produce… | ||
| Effortlessly Build, Run, Secure, and Manage Traffic for a Generative AI Application From... | Lin Sun | 42m |
A runnable GenAI demo is built: a Streamlit web app that chats with local LLaMA models (Nama 3.2 and Nava for images) and uses RAG with ChromaDB; it deploys to… | ||
| Tutorial: Take Control of Git: Beyond the Basics | Kim Schlesinger, Kyle Coberly | 01h 33m |
Five short repo-based games (Hike Disaster, Research, Plan, Packing, Redux) teach concrete commands and workflows: use git reflog to recover personal history… | ||
| Traefik V4: What We’re Cooking for You | Nicolas Mengin, Emile Vauge | 42m |
Traefik v4 targets an end-of-2026 release and promises concrete changes: a new plugin system with WASM plugins and planned gRPC plugin support, a pre-routing… | ||
| If I Could Turn Back Time - What Open Source and Tech History Tells Us About the F... | Shirley Bailes | 42m |
Traces a clear pattern: Linux becomes infrastructure and the LAMP stack enables garage projects to run production; SDN (OpenFlow, ONOS, OpenDaylight) separates… | ||
| Building an Open Source System Design Interview Coach With Interactive Simulations | Sriram Panyam | 40m |
An open source tool called SDL models systems with a simple DSL, runs steady state simulations (not full DES), and uses discrete outcome distributions instead… | ||
| Software Supply Chain for the SDV Future — Logistics, Cybersecurity and Compliance | Hasan Yasar | 40m |
Claim: SDVs push OEMs to treat software like hardware with component-level SBOMs and automated CI/CD certification; many teams build pipelines that generate… | ||
| Building a Safe and Open Vehicle Core With Open Source | Philipp Ahmann | 36m |
Safe Open Vehicle Core (S‑Core) builds a safety-certifiable middleware stack for high‑performance ECUs, targeting ISO 26262, ASPICE and ISO 21434 compliance… | ||
| Enhancing Data Integrity in Linux | Anuj Gupta | 34m |
Describes three main kernel changes: a new io_uring PI pointer SQE fields API (merged in v6.14) that lets applications attach per-I/O protection metadata; a PI… | ||
| Rusty OP-TEE Trusted Applications | Sumit Garg | 34m |
OP-TEE Trusted Applications get a Rust toolchain path that uses no_std support, the OP-TEE C libraries and three Rust crates (opt, opt_build and a protocol… | ||
| Billy and Eddie's Declassified Git Survival Guide | Billy Lynch, Eddie Zaneski | 39m |
Covers concrete rescue steps: use git reflog as safety net to recover dropped commits, run git fetch vs git pull to see origin/main, resolve conflicts with git… | ||
| FoundationDB, the Black Knight | Peter Boros | 34m |
A FoundationDB cluster on Kubernetes with 72 storage processes plus 16 stateless and 12 logs runs a Go YCSB benchmark at 50k QPS on a half terabyte dataset… | ||
| SBOMs in the Real World: Practical Guidance for Managing Three Common SBOM Sce... | Cortez Frazier Jr. | 20m |
Based on experience supporting SBOM programs across industries including managing 1,800 repositories and 600 applications with a three-person team, practical… | ||
| The Xen Safety Concept, a Major Milestone Toward Certification | Stefano Stabellini | 40m |
Xen achieves a concrete milestone: Safety Concept Approval (Q4 2024) from third‑party assessors, committing to ISO 26262 and IEC 61508 certification paths… | ||
| Welcome Back | (not provided) | 02m |
Announces schedule updates and on-site logistics: lists Ask the Expert sessions and speaker office hours at foyer breaks, details raffle prizes including a… | ||
| Expanding the OpenChain Standards Portfolio - More Sister Standards? | Shane Martin Coughlan | 32m |
OpenChain states it is not launching new ISO standards right now but is turning market gaps into concrete guides that can evolve into specs and standards: a… | ||
| Continuous Compliance in Open Source: Safety Assurance Through S... | Rinat Shagisultanov, Troy Sabin | 30m |
Claims that an SBOM-driven pipeline turns safety compliance from weeks of manual review into minutes of automated action, using SPDX 3.1 annotations and… | ||
| Can File Systems Survive in Data-centric World? | Viacheslav Dubeyko | 42m |
File systems introduce measurable overhead as byte‑addressable persistent memory, kernel bypass and hardware accelerators converge; the question is whether to… | ||
| Self-Driving DAMON/S: Controlled and Automated Access-aware Efficient Systems | SeongJae Park | 45m |
Kernel subsystem DAMON provides controlled data‑access monitoring with dynamic monitoring intervals autotuning, dynamic space granularity (merge/split regions)… | ||
| V4L2 Media Controller Request API | Karthik Poduval | 20m |
V4L2 Media Controller Request API provides per-frame controls tied to a media request FD so user space can set volatile parameters and receive exact per-frame… | ||
| Strengthening Software Supply Chains: Harmonizing SLSA Provenance and SPDX SBOM for Better Adoption | Mihai Maruseac, Kate Stewart, Hasan Yasar | 40m |
SLSA provenance ties each build to its workflow while SPDX SBOM lists every component; together they pinpoint what went into an artifact, who built it, and how… | ||
| We Need a Standard for Open Source Package Requirements | Elitsa Bankova, Eve Martin-Jones | 40m |
Argument: current ecosystems lack a common requirement spec, so Deps.dev analyzes millions of packages across npm, Cargo, Maven, PyPI and RubyGems and… | ||
| Developing a Community-Driven Standard for Open Source Software... | Philipp Ahmann, Gabriele Paoloni | 44m |
Proposal to create a community standard that maps code‑centric CI/CD open source practices to regulated industry needs, backed by a literature review (33… | ||
| Unlocking Telco APIs: How Open Source Is Driving Standardization & Interoperabili... | Markus Kummerle | 17m |
CAMARA builds concrete telco APIs (example SIM swap API) with full docs, YAML/Swagger and code samples, and a GSMA public map to find commercial endpoints at… | ||
| Turning Policies, Standards, and Governance Into Enablers for Open-Source Innovation | Mark Paulsen | 18m |
Three concrete governance patterns: right-size guard rails, frequency reduces difficulty, and no conflict. A bank-level example injects standards, controls and… | ||
| Towards a Better Adoption Model | Nigel Brown | 23m |
Proposal: create an LF-wide system to surface compatible projects so forks and drop‑in replacements gain adoption. Concrete ideas: functionality tagging (an… | ||
| Open Source Software: Hollywood’s Secret Sauce for Visual Effects and A... | David Morin, Larry Gritz | 51m |
Academy Software Foundation runs 15 projects used across production pipelines, hosts ~350 meetings per year, and counts ~5,000 Slack members with ~1,000… | ||
| Verifying the Rust Standard Library | Carolyn Zech | 33m |
Amazon and the Rust Foundation run a verification contest that aims to formally prove the Rust standard library’s unsafe code cannot cause undefined behavior… | ||
| The Big-endian RISC-V Linux Adventure | Ben Dooks | 42m |
Prototype implements RISC-V runtime data endianness via MSTATUS MBE bits (bit 37/36), modifies QEMU (about 120 LOC in target/riscv and translation), updates… | ||
| Overlay Images To the Rescue | Frank Vasquez | 45m |
Yocto images break the rootfs into composable layers and the talk shows a working workflow that uses systemd-sysext (systemd 248) plus overlayfs and btrfs… | ||
| Becoming a Stronger Ally: Handling Difficult Situations and... | Satyendra (Sat) Agrawal, Li He, Spencer Desmond | 38m |
Describes a Discover Dojo coaching program adapted into scenario exercises that teach concrete moves: run 10–minute pre-meeting check‑ins, schedule virtual… | ||
| Newcomer… but Not New | Emily Shaffer | 43m |
Practical checklist for senior internal engineers moving code upstream: expect social and process friction, not technical gaps; use pre-review with a mentor… | ||
| Contributor Catalyst: New Contributor Perspectives From an HBCU Mento... | Emily Lovell, Silas Morgan | 40m |
A pilot eight-week hybrid cohort (one week remote, four weeks in-person, three weeks remote) trains HBCU students on git, GitHub workflows, community research… | ||
| Harnessing Event-Driven and Multi-Agent Architectures for Complex Workflows in Gen... | Mary Grygleski | 50m |
Proposes combining event-driven streaming (Apache Kafka, Pulsar, brokers) with multi-agent orchestration (Autogen, CrewAI, Strands) and RAG backed by vector… | ||
| The Work No One Notices—Until It’s Missing: Scaling Open Source Community Teams | Elizabeth Barron | 41m |
Proposes a four-part staffing model—Community Caretakers, Content Creators, Growth Drivers, Organizers—with care first to reduce burnout and single points of… | ||
| Event Provenance Registry: Continuous Delivery Events for the Electric Sheep | Brett Smith | 22m |
Event Provenance Registry is an open source, event-driven provenance service that records receipts in Postgres and publishes a single source of truth to Kafka… | ||
| Keynote: eBPF: Unlocking Innovation in the Linux Kernel | Daniel Borkmann | 15m |
eBPF turns multi‑year kernel changes into days by letting small verified bytecode modules load at runtime with a verifier and JIT pipeline, supporting LLVM/GCC… | ||
| Keynote: Your Core Infrastructure Should Be Vendor Neutral and Open Source | Madelyn Olson | 05m |
A team forks Reddus and forms Valky under the Linux Foundation to regain vendor-neutral governance, implements an observability metrics system after Reddus… | ||
| Keynote: All Your Base Are Belong to Us | Christopher R Robinson, Eddie Knight | 14m |
OpenSSF’s Open Source Project Security Baseline builds a machine‑readable control catalog mapped to CRA, NIS, NIST SDLC and other frameworks, shares a Gamara… | ||
| Implementing Zero Trust in Government Settings: Strategies, Challenges, and Best Pra... | Steve Taylor | 42m |
Argues that government Zero Trust requires concrete engineering: a CI/CD pipeline with ephemeral runners, SBOMs signed and attested into OCI layers using… | ||
| The O[S]PO Organization for the Age of AI | Paul Holland | 38m |
Argues that existing OSPOs should become OPOs to cover software, models, weights and data, citing HPE’s decision to place the team in legal for IP alignment… | ||
| Panel Discussion: From First PR To Lifelong Impact: Helping People Thrive in Open Source | Dawn M Foster, Ruth Ikegah, Shuah Khan, Matt Denny | 40m |
CHAOSS Africa (est. 2022) scales newcomer onboarding by running workshops, creating beginner-friendly working groups (design, docs, dev), and running social… | ||
| Trust but Verify: Uncovering the Hidden Risks of Inaccurate SBOMs With J... | Yue Xiao, Dhilung Kirat | 39m |
JBomAudit is an open-source verifier that scans jar bytecode and compares declared dependency trees to actually referenced classes using a binary analyzer… | ||
| Dynamo: Supporting Next-Generation AI Workloads | Olga Andreeva, Ryan McCormick | 40m |
Dynamo is an open-source, Rust-native inference framework with Python bindings that targets multi-node generative AI serving and ships with a separate… | ||
| Panel Discussion: Build a Great Business on Open Source Without Selling Your Soul | Robert Hodges, Ann Schlemmer, Tatiana Krupenya | 42m |
Altinity runs ClickHouse support and cloud operations for 250 customers and reports 600 PRs submitted to ClickHouse over the years; its business mixes cloud… | ||
| cdCon Closing Session | Jeremy Meiss | 16m |
Closing session announces distribution of five "CI/CD Design Patterns" books, publication of a new SAS case study plus user stories from Fidelity, Autodesk and… | ||
| Navigating Compliance: What Developers Can Learn From Driving | Kadi McKean, Charlie Jones | 20m |
Manufacturers take the bulk of CRA obligations while individual contributors are explicitly exempt and maintainers are largely out of scope unless monetized… | ||
| How To Stay Compliant With and Take Benefits From the EU CRA (Cyber Resilience Act) | Roman Zhukov | 53m |
EU CRA casts a wide net over software and open source by redefining roles like Manufacturer, Steward, Individual developer and by making concrete demands… | ||
| Accelerating GenAI Innovation: Lessons From Intuit's Agents an... | Shradha Ambekar, Conrad De Peuter | 29m |
Intuit built a centralized Genos framework of reusable agents and tools that plugs into product engines (QuickBooks, TurboTax) and uses open source like… | ||
| Keynote: How Open Protocols Unleash AI’s Next Wave of Creativity and Impact | Jessica Forrester | 05m |
Argues that the next wave of AI is agentic systems that plan, reason, and execute multi-step tasks and that model context protocol plus agent-to-agent… | ||
| Building Trust Through Proactive Security - Key Parts of the Trus... | Przemysław Roguski, Ralph Bean | 43m |
Red Hat claims that shifting security left and producing cryptographically-signed provenance and SBOMs inside an open-source pipeline actually reduces risk… | ||
| In From the Cold - Open Source as Part of Mainstream Software Asset Management | Shane Martin Coughlan | 25m |
Open source moves from fringe to mainstream software asset management with concrete artifacts: SPDX (2010) and SPDX3, ISO standards like ISO/IEC 5230, 18974… | ||
| From Classroom To Cloud: Bridging Academia and the Open Sou... | Andy Anderson, Professor Corey Leong | 32m |
Program called Interns for Open Source (IFOS) places students into real projects using GitHub, VS Code, Slack and LFX workflows; one cohort gets 420… | ||
| Securing Software Supply Chains for the Public Good | Daniel Moch, William Crum | 24m |
A CNCF public sector white paper lays out a deployable architecture that uses OCI-compliant registries to store artifacts, pushes sbombs and attestations into… | ||
| Funding Security in Open Source: Insights From FreeBSD’s Audit Journ... | Deb Goodkin, Michael Winser | 43m |
Alpha Omega funds a FreeBSD security audit that targets two subsystems, Beehive and Capsicum, after outreach in November 2023 and approval in early February… | ||
| The Accidental Maintainer: Sideways Stories Into Open Source Leadersh... | Divya Mohan, Natali Vlatko | 40m |
Co-chairs of the Kubernetes docs SIG describe concrete paths from contributor to maintainer: starting a weekly bug triage that converts newcomers into… | ||
| Builds You (and Others) Can Trust: Meet the AMPEL Policy Engine | Adolfo García Veytia | 17m |
Ampel is an open source policy engine that embeds into CI/CD or a CLI, verifies keyless Sigstore verification and in-toto attestations, and evaluates predicate… | ||
| Managing Resources To Lower Costs | Mark Waite, Melissa McKay | 19m |
Jenkins uses donated JROG Artifactory and discovers 10 TB of storage and 50 TB/month bandwidth waste, costing thousands; access logs convert to SQL so queries… | ||
| From CDEvents To Actions: Designing the Workflow Conductor | Dadisi Sanyika, Ben Powell | 19m |
Conduit converts CDEvents into actionable orchestration by mapping normalized events from Jenkins, GitHub Actions, CircleCI, Argo CD, Datadog, PagerDuty, Jira… | ||
| The Open Ecosystem for the Agentic Age | Kumaran Siva, Joohi Mittal | 15m |
AMD unveils an open AI stack centered on Rockom 7 that adds distributed inference, training with data/pipeline/tensor parallelism, and MI350/MI355 series… | ||
| Using SBOMs for Linux Foundation Projects | Jeff Shapiro, Gary O'Neall | 43m |
Linux Foundation generates a unified SBOM that combines source scanning and dependency analysis for ~260 projects out of ~1,200, finding a 40% rate of key… | ||
| Finally! A New Trademark Policy | Rebecca Rumbul, Gracie Gregory | 41m |
Rust Foundation updates its trademark policy after an initial draft draws 3–4k responses and widespread backlash that causes reputational harm. The process… | ||
| Let's Play AI Supply Chain Candyland! | Sarah Evans, Christopher R Robinson | 43m |
A board-game style framework called AI Supply Chain Candyland is built to map end-to-end AI/ML development, highlighting that data and models must join code in… | ||
| Not Just Ticking a Box – Establishing Trust in Artifacts with Proven... | Andrew McNamara, Ralph Bean | 20m |
Compares concrete provenance outputs from GitHub Actions, Witness, and Tekton: GitHub Actions produces only repo+commit only metadata and exposes signing keys… | ||
| Scalable and Efficient LLM Serving With the VLLM Production Stack | Junchen Jiang, Yue Zhu | 40m |
Open source vLLM Production Stack combines vLLM Production Stack router, an LMCache KV cache backend, Kubernetes + Helm deployment and SkyPilot for cross‑cloud… | ||
| Building Your (Local) LLM Second Brain | Olivia Buzek | 41m |
A fully local “second brain” runs on a laptop using Ollama + Granite models served via OpenWebUI, with LangChain/llama_index for RAG and CrewAI/Autogen-style… | ||
| Following the Golden Image Road: Best Practices and Pitfalls | Natalie Somersall | 39m |
Describes a Chainguard-based golden image program that standardizes SSL certs, internal package repos and OCI labels, enforces declarative builds and… | ||
| AI Pipelines With OPEA: Best Practices for Cloud Native ML Operati... | Ezequiel Lanza, Melissa McKay | 43m |
Opia turns a Jupyter proof‑of‑concept RAG notebook into deployable microservices: chunking PDFs (~1,000-token chunks with overlap), embedding with a Hugging… | ||
| Fast Inference, Furious Scaling: Leveraging VLLM With KServe | Rafael Vasquez | 33m |
vLLM claims major inference gains by cutting KV‑cache waste from roughly 60–80% down to ~4% using PagedAttention, plus speedups from continuous batching and… | ||
| Keynote: Announcements & Raffle Drawing | Jim Zemlin | 02m |
Organizer reads winning ticket numbers and calls out four prizes: the Colorado themed gift box (9568192), a Nebula Capsule Air Google TV projector (95608193… | ||
| nothing matches | ||