OSS + ELC EU 2026

“On the internet, nobody knows you’re a dog,” the famous New Yorker comic goes, and that aphorism couldn’t ring truer today. In a world of AI agents, how can we be sure that we (or our agents) are interacting with other trusted, reputable systems and agents rather than impersonators or scammers? As open source maintainers, how can we be sure that new contributors are responsible, trustworthy individuals rather than adversarial state actors, helping to thwart compromises like the XZUtils attack? More generally, how do we deal with digital identity in the age of AI?

Our proposal is to use cryptographic proofs of personhood. These can be built from a decentralized, privacy-preserving reputation system, which we can build with tools and standards we have developed in several projects in LFDT. The session will cover some background on how proofs of personhood work, including privacy guarantees from cryptography (at a beginner level). Then, we will explain some applications in agentic AI and open source software maintenance. Finally, we will give an end-to-end demo of how our systems work in practice which will include audience participation in a “verifiable trust graph”.

As AI moves from isolated chatbots to autonomous agent ecosystems, the "identity problem" becomes a critical security bottleneck. How does an agent verify the legitimacy of a requestor before executing a sensitive task? Traditional API keys are insufficient for dynamic, decentralized agent interactions.
This session explores a cutting-edge extension to the Linux Foundation A2A protocol that leverages Decentralized Identifiers (DIDs) and Verifiable Credentials (VCs) to establish high-assurance trust and bridges the gap between Decentralized Identity standards and AI, creating a secure backbone for the next generation of agent interoperability.
We will dive into the technical design of integrating OpenID for Verifiable Presentations (OID4VP) into agent communication flows. Attendees will learn how this proposed extension moves beyond static credentials to enable granular, verifiable Authentication (AuthN) and Authorization (AuthZ) for autonomous tasks. Beyond the protocol basics, we will analyze different patterns for VC presentation—comparing interactive vs. automated flows—and evaluate diverse wallet options, ranging from cloud-based agent wallets to secure edge implementations.

Working in telco infrastructure means regulatory compliance isn't optional. When a CVE drops, we can't wait a quarter. We can't backport locally. We have to fix it upstream, and we have to do it fast. This constraint forced us to ask harder questions about how we collaborate with open source projects.

At Ericsson we maintain bare metal Kubernetes using Metal3, Cluster API, and Ironic. Over the past few years, we've learned that regulatory pressure actually makes us better engineers. It forced us to build real relationships with upstream maintainers, contribute more thoughtfully, and think long term instead of short term.

This talk explores what changed in how we work with upstream projects when we couldn't carry local patches. We'll talk about the specific practices that work when your infrastructure depends on fast, reliable upstream collaboration. You'll hear about what changed in how we communicate with maintainers, how we structure our releases, and what we learned about contributing upstream that applies whether you're bound by regulation or not.

We have become highly effective at finding vulnerabilities, accelerated by AI-driven analysis. We can scan at scale, assign scores, and generate reports with unprecedented speed. The breakdown happens after discovery.

For many maintainers, security reports arrive as noise: limited context, unclear expectations, and little support to carry fixes through to completion. Backlogs grow, trust declines, and critical issues remain unresolved.

This panel brings together security and open source leaders from Microsoft, Google and AWS to confront an uncomfortable reality: discovery is the easy part. Remediation, especially in shared infrastructure maintained by a small number of overextended contributors, is where the system fails.

We will explore what actually helps maintainers move from report to resolution. What makes a report actionable? How do we reduce noise and avoid drive-by reporting? How do we support fixes through triage, patching, and downstream adoption without taking over projects?

If you are a struggling maintainer or an industry consumer who wants to support OSS you depend on without overloading it, this session is for you. The focus is simple: fixes that land.

In early 2026 our vulnerability inbox suddenly exploded. Tekton, the Kubernetes-native CI/CD framework we maintain, received more security reports in four months than in all the previous years combined: detailed, with working reproducers and CVSS scores. Many were genuinely valid. They were also, overwhelmingly, AI-generated.

LLM-powered research has changed the game. Tools now audit codebases systematically and surface real bugs humans missed for years: a path traversal reading arbitrary files from the controller pod, an SSRF exfiltrating cloud credentials, a JSON injection enabling RCE. These aren't hallucinations, and they arrive faster than a small team can patch, disclose, and backport.

But the flood carries noise too: variants of fixed CVEs, reports that misunderstand the threat model, duplicates. The challenge has shifted from "find vulnerabilities" to "triage an AI-accelerated firehose without your disclosure process collapsing."

This is an honest, in-progress survival guide from maintainers living through it: how triage holds up under pressure, how we separate signal from noise, what we got right, and what we got wrong.

Open source is the bedrock of European digital sovereignty, but a wave of aggressive new EU legislation is transforming how organizations must build, source, and secure their digital environments. Navigating this shift requires unpacking complex regulatory mandates and understanding their operational impact on modern enterprise and cloud software architecture.

This fast-paced session strips away the legal jargon to deliver a real-time status update on Europe’s changing digital roadmap. We will analyze the mandatory software bill-of-materials (SBOM) rules of the Cyber Resilience Act (CRA) and the open standards driving the Interoperable Europe Act. Crucially, we dive into the European Commission's freshly unveiled Cloud and AI Development Act (CADA) to unpack its cloud sovereignty tiers and its "open-source first" procurement principles.

Moving from compliance theory to practical execution, attendees will gain a concrete framework to audit their own production IT stacks. We will walk through the web-based SUSE Cloud Sovereignty Self-Assessment tool to measure true autonomy using weighted SEAL (Sovereignty Effective Assurance Level) metrics.