The Linux Foundation Member Summit

For many years, the landscape of open source licensing seemed stable and predictable. However, the advent of large language models (LLMs) has introduced new licenses and raised numerous questions about the application of existing open source licenses. At Fidelity, our Open Source Program Office (OSPO) and legal team have evolved our processes to navigate these changes and better understand what they require of us. This session will provide a practical case study and an accessible discussion on how OSPOs and legal teams can collaborate effectively in this evolving landscape.

The licensing of open source software, as embodied in source code and package metadata, has long suffered from lack of clarity and consistency. This has become more evident with the use of sophisticated license scanning tools. Discussions among open source legal and compliance experts often express the desirability of having such problems addressed upstream.

We will describe the progress on an initiative driven by Red Hat and the Fedora Project community to revitalize its traditional role of curating a distribution with careful attention to licensing. This initiative includes: improved documentation and explanation of license policies, evolution of "allowed" and "not allowed" license lists from a project wiki to a repository of machine-readable data; the use of SPDX identifiers in package license metadata, including close collaboration with the SPDX-legal community; and traceable license review process. We will cover an overview of the process, challenges faced and overcome, and planned next steps.

By sharing the Fedora approach, we hope others can learn or borrow from this work and also contribute to improving license information upstream.

Have you ever found yourself trying to justify a commitment to an open source project and struggled to communicate the value beyond the usual suspects, such as increased influence or attracting talent? You are not alone. In today’s economic climate, organizations are looking for more concrete returns; they want to know how their investment impacts their business goals. In this talk, Bob will go over some proven successful strategies and tools to help you convey the impact of your organization’s open source investment and provide a lightweight framework that can be used to continue to tell this story over-time and in a sustainable way.

In the evolving landscape of GenAI, open strategies are key drivers of innovation and widespread adoption. This preso explores how transparency, collaboration, and shared resources shape the future of GenAI. We will highlight fundamental principles, successful initiatives, and real-world case studies demonstrating how open-source models and datasets accelerate research and democratize access to cutting-edge AI capabilities. The discussion will address the challenges and opportunities of open strategies, balancing openness with security, and the impact on IP and community governance. Insights from recent research and industry trends will shed light on the implications for enterprise AI deployment and the broader AI ecosystem. Attendees will gain a comprehensive understanding of how open strategies in GenAI can unlock potential, foster innovation, and drive sustainable growth. This session is valuable for developers, researchers, policymakers, and business leaders seeking to harness the power of openness in AI.

Open source software is ubiquitous and forms the backbone of modern digital infrastructure, yet it often hides dependency risks that can impact organizations significantly. At GitHub, where we depend on tens of thousands of open source packages, we have leveraged open source frameworks from OpenSSF and other communities and created strategies to assess and mitigate these risks. Join us as we explore how OSPOs can use open source tools and standards to create plans for identifying and addressing dependency risks to improve their overall risk profile and improve project health. The talk will cover strategies for engaging with key stakeholders, including security teams, and funding opportunities to build resilient and sustainable open source ecosystems.

Last year, the Linux Foundational's Technical Advisory Board published the Linux Kernel Contribution Maturity Model (CMM). The goal of the CMM is to encourage companies to allow and encourage their engineersto contribute to upstream development in ways that allow them to grow into leadership roles, improving the overall health of the Linux Kernel ecosystem.  This talk explores how companies can improve their overall upstream community maturity, and how this benefits the company; their engineers, and the upstream development community.

The rapid evolution of AI has outstripped traditional open source licensing, creating legal uncertainties around copyrightability of model weights, fair use in training, and liability. This session will begin with an overview of the Model Openness Framework, which breaks AI models into 17 components, offering tailored open licensing strategies. However, its complexity has hindered broad adoption.

To that end we will present the OpenMDW License, a permissive license designed specifically for AI models. Covering architecture, data, weights, tools, and documentation, it addresses gaps in existing frameworks and incorporates AI-specific liability considerations. This license offers a standardized solution to the challenges faced by model creators and users.

This session will equip attorneys with critical insights into AI model artifacts, the limitations of current licensing practices, and practical tools for handling openness and completeness in the evolving AI landscape.

W3C Verifiable Credentials are spreading like wildfire, fed by a growing number of governments who are piloting and putting VC-based systems into production. The EU will be mandating their use by the end of 2025 for certain key citizen services. VCs and Digital Wallets can be used in privacy-preserving ways, opening the door to a different, better, more decentralized paradigm for granting access and permissions to web sites, apps, and key services. Come to hear about the use cases, the regulations, and the underlying technology that will likely emerge as a requirement for most meaningful open source projects to adopt at some point soon.

The release of v.1.0 of the Open Source AI Definition answers a lot of questions and leaves a few more open. This session will briefly cover the 2+ years of the co-design process that led to the Open Source AI Definition and highlight the unanswered questions. leaving time for a brainstorming session.

Ant Group (fintech company with 25K employees) founded Open Source Program Office (OSPO) in 2021. It has been a roller coaster journey to nurture it as the company features primarily a B2B2C business model which doesn't rely heavily on Open Source successes. Building long-lasting open source engagement can be a really challenging, yet rewarding journey. It all began as a technical strategic initiative with 1 individual working on it part time. After 3+ years, the company now has a dedicated OSPO team of 6+ people, a full fledged Open Source Technical Committee, featuring Open Source as a long term Technical Strategy, and starting this year began the global outreach work very seriously in 2024. In this duo-speaker session, we'll share our learnings and reflections of building OSPO in a highly dynamic environment with constant challenges from leadership, peers, and difficulties for building sustainable ecosystem. It aims to provide valuable insights for foundation members, ecosystem players and project leads to work with large corporations, even more useful if there are cultural boundaries to break through.

Trust Over IP Foundation, a JDF project under the Linux Foundation Decentralize Trust umbrella, has long been known for its “dual stack” that combines technical protocols with the governance models and artifacts required to create interoperable decentralized digital trust ecosystems. Starting with our ToIP Governance Architecture Specifications (2021) and ToIP Technology Architecture Specification (2022), this year we have published Implementers Drafts of our Trust Spanning Protocol (TSP) and Trust Registry Query Protocol (TQRP). This session will explain how this decentralized digital trust architecture is being implemented in an ecosystem of ecosystems model to produce Internet-scale solutions to urgent security, privacy, and data governance problems around the world such as content authenticity to protect against AI deep fakes.

We’ve been doing source level license scans for LF projects for a long time including generating SPDX formatted files, but what about SBOMs that can meet (and exceed) the government minimum specification? Here at the LF, we are now leveraging our existing scanning capabilities to generate SBOMs for these same critical open source projects.

In the LF spirit, we are using existing open source tools to scan project dependencies to produce an SBOM that meets the minimum spec. We are also producing dependency level license data to compliment our source level scans. In the near future we will be combining these to produce a grand unified SBOM that will meet a newly defined LF minimum specification for SBOMs.

We will talk about our process to generate these SBOMs, the challenges we faced, our future plans, and share more about how you can make use of these for the projects you care about most.

This proposed session is a panel discussion covering recent developments and likely future directions for open source software, particularly as it applies to companies that are developing and/or using open source software in their products. The invited panelists all have extensive experience that cover the most significant issues facing open source today, including licensing, security, AI, and OSPOs.