OSS + ELC EU 2026

With the advent of large language models, looking up human-made software documentation might seem like an antiquated and inefficient way of getting information. On top of that, Claude Code and similar tools can now crunch information straight from your JIRAs and conjure new pull requests at speeds that cannot be matched by even the most veteran documentation maker.

So where does this leave you as a technical writer?

Let us come together as professional technical communicators to grumble and bellyache, but mainly to share tips and insights on how to make the best of the paradigm shifts and upheavals that AI advancements now introduce to our work-life on a regular basis.

Many communities reach a point where knowledge has naturally concentrated in the hands of a few dedicated people. It happens organically. Someone steps up, carries the weight, and keeps things moving. But without a process to capture and distribute that knowledge, the community becomes fragile without ever meaning to. Contributors arrive eager and leave quietly. Decisions get made but are never recorded. Onboarding repeats itself because nothing was ever written down.
This talk is about what happens when a community decides to change that. Drawing on experience as a maintainer and community manager, I will walk through the journey of building a documentation process from the ground up, not by writing more docs, but by shifting how the community thinks about knowledge itself. From auditing where knowledge lived, to creating structures for knowledge capture and decision documentation, forming a working group that distributed ownership, and building triage and mentorship pathways that made contribution genuinely accessible.

Producing documentation in multiple languages and formats often sounds like a simple promise... until it is time to maintain translations, review changes, publish consistent versions, and avoid diverging copy-pastes.

Drawing from the real-world experience of building a structured multilingual glossary for embedded AI, we will explore how to apply a Docs-as-Code approach to documentation using AsciiDoc. We will cover modular design, conditional content, preprocessing, and automated HTML and PDF generation, all while leveraging the full power of Git for versioning, reviews, and reproducible deployment pipelines.

The goal isn't merely to "write multilingual docs," but to treat documentation as a fully-fledged software artifact. Through this concrete example, we will demonstrate how to organise and maintain a shared structure across languages, centralise common elements, and automate the production of your deliverables.

We will highlight the core principles, best practices, and reusable patterns required to build an industrialised, multilingual technical documentation system, completely freeing you from word processors and manual publishing workflows.

For 4 years, the documentation team of Red Hat Czech has been teaching the fundamentals of technical writing to university students in Brno.

The courses have been attended by students of IT as well as non-technical majors, and have been well received by both

In this talk, we will share how we approached constructing the courses, what worked, what didn't, and how we refined the syllabus year-over-year to adapt to the recent turbulence in the world of technology.

AI-powered security models have fundamentally changed vulnerability discovery. What once took months of expert auditing now runs continuously at scale, flooding maintainers with vulnerability reports, coordinated disclosure requirements, patch demands, and CVE assignments. The industry celebrates AI finding more bugs; maintainers are drowning in the reports.

This talk examines how maintainers of critical open-source infrastructure can adapt to handle the incoming wave. This requires new processes at all levels of the development process. Maintainers can use AI tooling to help differentiate slop requests from genuine vulnerabilities, use them to help automate and coordinate disclosures, and start proactively searching for these vulnerabilities so they never entered production in the first place. We'll give concrete examples and patterns that you can use to apply to your own works as a maintainer or security researcher.

Quietly over the course of 25 years, open source software evolved from a domain perceived as that of only hobbyists into the invaluable backbone of modern digital infrastructure. Sustaining that success for the future will require more than code. It requires resilience: a trait not of technology. but of people. Of community. With increasing regulation around the world, evolving cybersecurity requirements, burnt out contributors, and stagnant corporate participation and funding, how do we ensure the ecosystem’s continued success? The things that have worked for the first decades will not be the things that keep us going. Let’s look together at sustainability not only as a funding problem, but also from the perspectives of global policy changes, security, and other intertwined issues that face open source in the coming years.

“On the internet, nobody knows you’re a dog,” the famous New Yorker comic goes, and that aphorism couldn’t ring truer today. In a world of AI agents, how can we be sure that we (or our agents) are interacting with other trusted, reputable systems and agents rather than impersonators or scammers? As open source maintainers, how can we be sure that new contributors are responsible, trustworthy individuals rather than adversarial state actors, helping to thwart compromises like the XZUtils attack? More generally, how do we deal with digital identity in the age of AI?

Our proposal is to use cryptographic proofs of personhood. These can be built from a decentralized, privacy-preserving reputation system, which we can build with tools and standards we have developed in several projects in LFDT. The session will cover some background on how proofs of personhood work, including privacy guarantees from cryptography (at a beginner level). Then, we will explain some applications in agentic AI and open source software maintenance. Finally, we will give an end-to-end demo of how our systems work in practice which will include audience participation in a “verifiable trust graph”.

As AI moves from isolated chatbots to autonomous agent ecosystems, the "identity problem" becomes a critical security bottleneck. How does an agent verify the legitimacy of a requestor before executing a sensitive task? Traditional API keys are insufficient for dynamic, decentralized agent interactions.
This session explores a cutting-edge extension to the Linux Foundation A2A protocol that leverages Decentralized Identifiers (DIDs) and Verifiable Credentials (VCs) to establish high-assurance trust and bridges the gap between Decentralized Identity standards and AI, creating a secure backbone for the next generation of agent interoperability.
We will dive into the technical design of integrating OpenID for Verifiable Presentations (OID4VP) into agent communication flows. Attendees will learn how this proposed extension moves beyond static credentials to enable granular, verifiable Authentication (AuthN) and Authorization (AuthZ) for autonomous tasks. Beyond the protocol basics, we will analyze different patterns for VC presentation—comparing interactive vs. automated flows—and evaluate diverse wallet options, ranging from cloud-based agent wallets to secure edge implementations.

Working in telco infrastructure means regulatory compliance isn't optional. When a CVE drops, we can't wait a quarter. We can't backport locally. We have to fix it upstream, and we have to do it fast. This constraint forced us to ask harder questions about how we collaborate with open source projects.

At Ericsson we maintain bare metal Kubernetes using Metal3, Cluster API, and Ironic. Over the past few years, we've learned that regulatory pressure actually makes us better engineers. It forced us to build real relationships with upstream maintainers, contribute more thoughtfully, and think long term instead of short term.

This talk explores what changed in how we work with upstream projects when we couldn't carry local patches. We'll talk about the specific practices that work when your infrastructure depends on fast, reliable upstream collaboration. You'll hear about what changed in how we communicate with maintainers, how we structure our releases, and what we learned about contributing upstream that applies whether you're bound by regulation or not.

We have become highly effective at finding vulnerabilities, accelerated by AI-driven analysis. We can scan at scale, assign scores, and generate reports with unprecedented speed. The breakdown happens after discovery.

For many maintainers, security reports arrive as noise: limited context, unclear expectations, and little support to carry fixes through to completion. Backlogs grow, trust declines, and critical issues remain unresolved.

This panel brings together security and open source leaders from Microsoft, Google and AWS to confront an uncomfortable reality: discovery is the easy part. Remediation, especially in shared infrastructure maintained by a small number of overextended contributors, is where the system fails.

We will explore what actually helps maintainers move from report to resolution. What makes a report actionable? How do we reduce noise and avoid drive-by reporting? How do we support fixes through triage, patching, and downstream adoption without taking over projects?

If you are a struggling maintainer or an industry consumer who wants to support OSS you depend on without overloading it, this session is for you. The focus is simple: fixes that land.

In early 2026 our vulnerability inbox suddenly exploded. Tekton, the Kubernetes-native CI/CD framework we maintain, received more security reports in four months than in all the previous years combined: detailed, with working reproducers and CVSS scores. Many were genuinely valid. They were also, overwhelmingly, AI-generated.

LLM-powered research has changed the game. Tools now audit codebases systematically and surface real bugs humans missed for years: a path traversal reading arbitrary files from the controller pod, an SSRF exfiltrating cloud credentials, a JSON injection enabling RCE. These aren't hallucinations, and they arrive faster than a small team can patch, disclose, and backport.

But the flood carries noise too: variants of fixed CVEs, reports that misunderstand the threat model, duplicates. The challenge has shifted from "find vulnerabilities" to "triage an AI-accelerated firehose without your disclosure process collapsing."

This is an honest, in-progress survival guide from maintainers living through it: how triage holds up under pressure, how we separate signal from noise, what we got right, and what we got wrong.

Open source is the bedrock of European digital sovereignty, but a wave of aggressive new EU legislation is transforming how organizations must build, source, and secure their digital environments. Navigating this shift requires unpacking complex regulatory mandates and understanding their operational impact on modern enterprise and cloud software architecture.

This fast-paced session strips away the legal jargon to deliver a real-time status update on Europe’s changing digital roadmap. We will analyze the mandatory software bill-of-materials (SBOM) rules of the Cyber Resilience Act (CRA) and the open standards driving the Interoperable Europe Act. Crucially, we dive into the European Commission's freshly unveiled Cloud and AI Development Act (CADA) to unpack its cloud sovereignty tiers and its "open-source first" procurement principles.

Moving from compliance theory to practical execution, attendees will gain a concrete framework to audit their own production IT stacks. We will walk through the web-based SUSE Cloud Sovereignty Self-Assessment tool to measure true autonomy using weighted SEAL (Sovereignty Effective Assurance Level) metrics.