OSS + ELC EU 2026

It all started with the simple question: "Do we have all exceptions for license dependecies for all the projects?"

As you can imagine this is not a question most organizations can answer out of the blue.
To solve this we started not only generating SBOMS for every single project in the CNCF., but also every Subproject that has a release.
Along the way we hit every wall: inconsistent release processes, license resolution dead ends, CVE matching at scale, and the discovery that generation is maybe 20% of the problem.
We will dig into the full pipeline we built. Automated SBOM generation at scale, auto discovery of Repositories, experimenting with differnet SBOM generation tools, hitting Git limits, license enrichment via deps.dev and ClearlyDefined, vulnerability cross-referencing via OSV, and OpenVEX for suppression.
After we finished this we realized that 10,000+ SBOMs are useless if you cannot search, query, or govern them. So we built an open source toolchain for the whole thing.

You will learn how to build a toolchain for Supply Chain at a sclae that supports a foundation and you can also use in organizatiosn that is fully Open Source and Apache 2 licensed.