The Linux Foundation Member Summit

The success of an open source project is directly related to the utility it provides its community and to benefit from a project, people must know of it as well as how to either contribute to or use it. Many projects are launched with great promise but die a painful and public death from a dearth of developers and/or users. In this talk we take a pragmatic look at growing open source project success through education programs. We cover the ways training can drive awareness and create 'pull' for people to get involved as users or developers. This talk will expose attendees to the open source training and certification landscape, discussing resources available to projects, such as courseware development, self paced learning, open enrollment, and, in more mature projects, skills testing and certification. Upon completion, attendees will have a clear understanding of the possibilities and benefits of having a comprehensive education agenda for their open source project.

For members of the Linux Foundation, open-source software is recognized as critically essential to modern software development. Without it, the breadth and pace of innovation would plummet, and the costs to develop products and services based on software would skyrocket. Over the past several years, we've seen a destabilization of the open-source supply chain. Projects with poor security practices, malicious repo takeovers, and license rug-pulls are a small sample of the growing list of threats facing open-source users. As the largest commercial benefactors of this software supply chain, we have the most to lose. Efforts to address these issues have begun but are under-resourced and moving slowly. This is a Prisoner’s Dilemma & Free-Rider problem that needs a solution, or we are all worse off. This presentation will explore what methods can be brought to bear to increase development, oversight, and quality assurance in the open-source software supply chain to break out of the prisoner’s dilemma. How do those who invest in such work get an appropriate ROI? Can industry and governments work together to find a solution?

After XZ, OpenJS came the realisation within the community that we don't really understand how trust works within the ecosystem of open source projects, their contributors, maintainers and consumers. This is a socio-technical problem, and in order to understand it and to work out how to build stronger, more secure ties across the ecosystem, we don't just need to engage in technical innovation but also delve in the fields of sociology, behaviour psychology, organisational theory and beyond. This talk will discuss some of the existing work in the field in a relatable (not overly academic!) way and consider plausible research directions and topics. It aims to be a strongly interactive session and the hope is to encourage formation and involvement in this important work.

Mentorship is a powerful way to invite new contributors to the table – or repo, in the world of open source. An effective mentor can share their professional network, model problem solving skills, and offer advice on-demand for a wide range of topics – for example, writing issues and PRs, submitting conference proposals, or navigating a vast and unfamiliar codebase. Mentorship can also help grow communities; by integrating new contributors into the social and technical fabric of a project, they may be more likely to stick around. For those marginalized in tech, mentorship can also help cultivate a sense of belonging. Our academic OSPO has grown two very different mentorship programs in recent years: one pairs a globally distributed community of new contributors with academic open source research projects, and the other offers a high-touch contribution onramp to Historically Black College and University (HBCU) students via a hybrid in-person/remote format. Along the way, we’ve learned a number of lessons about what works… and also, what doesn’t! This talk will synthesize and share highlights in a generalizable way, while offering space for others to share their experiences, too.

Linux functions as the foundational infrastructure within mission-critical systems across sectors such as energy, transportation, healthcare, and industrial automation. These systems are essential to our society and must operate reliably for decades while adapting to the evolving landscapes of Smart Cities and IoT. Interconnectivity, while enriching our lives, presents significant challenges in managing vulnerabilities and system upgrades, necessitating adherence to international standards and the maintenance of system compatibility and integrity. The Civil Infrastructure Platform (CIP) project addresses these challenges by providing Industrial Grade Linux that enables robust, secure, and sustainable operations. Over the past seven years, CIP has demonstrated a commitment to meeting current operational needs and addressing future threats and challenges. This presentation will explore the value of CIP, focusing on its pivotal role in strengthening cyber resilience while enhancing system reliability. Attendees will gain insights into how utilizing CIP can help build sustainable systems, ensuring they are well-equipped to meet future challenges.

All votes have passed on the EU CRA. It will now become the law after a short transition period. As the neutral steward of many essential small and large open source projects, the Linux Foundation aims to lead the way for the open source ecosystem in implementing the CRA. Beginning from an assessment of the state of the art of cybersecurity best practises in leading open source projects and an analysis of the gaps to the requirements of the CRA, the Linux Foundation is driving three multi-year work streams that reflect the required adaptation of the open source ecosystem - formalizing community best practices into standards, building awareness within the open source community, and implementing updated processes and tooling. Many of these changes will require deeper collaboration between the manufacturers of products with digital elements and the upstream communities and stewards.


This presentation will provide an overview of the CRA implementation roadmap developed by the Linux Foundation. It will also dive into how the CRA shapes the future of the relationship between manufacturers and upstream communities.