OSS + ELC EU 2026

Somewhere along the way, the security ecosystem started asking maintainers to add more steps, update more plugins, and generate more outputs, without asking what it costs them. At cdCon, the OpenSSF DevRel community ran two back-to-back sessions to fix that: first an open, no-pitches roundtable where practitioners told us where tools miss the mark, then a maintainer lightning round where the people who could act on that feedback were already in the room.

This talk distills what came out of both. We'll cover the adoption gap (lots of awareness, far less implementation), why a year on this community still doesn't trust the SBOMs it generates, the recurring "I have one security engineer — where do I start?" problem, and the confusion created by too many badges and not enough wayfinding. Then we'll show how a wave of OpenSSF projects — from gittuf and Sigstore to OpenVEX, SBOMit, and the OSPS Baseline — are responding, including where there is work to do.