The Linux Foundation Member Summit 2025

Open source software is at the heart of innovation, but its complexity often slows developer adoption, limiting impact. Developers need more than great technology—they need intuitive, hands-on experiences that empower them to truly engage.

Sean Lauer, VP of Marketing & Product, will share insights from The State of Developer Adoption 2025, a research report commissioned by Instruqt and conducted by Developer Marketing Alliance, exploring trends in developer enablement. Learn how leaders plan to turn complexity into opportunity—empowering developers, aligning goals, and fostering ecosystems that drive open source innovation.

Key takeaways for attendees:
• Strategic insights into overcoming adoption challenges and engaging developers with open source tools
• How to align open source project goals with organizational enablement strategies for long-term impact
• Emerging trends in developer engagement and the future of open source adoption

This session will examine the importance of developing a strategy for maintenance, growth and development for OSS projects and foundations, and discuss the challenges in doing so. It will consider how to plan strategy development, how to ensure it is inclusive of the community and relevant stakeholders, how to ensure that key organisational and external aspects are considered, and how to track progress meaningfully towards success.

AI is everywhere now whether we like it or not. People want to use it in the workplace, but there are concerns about using this technology. Arm has established an AI Office (AIO) to give employees guidance on how they can use AI in their working lives as the world’s understandings evolve over license and copyright questions. As we stand on the brink of this transformative change, we must ask ourselves: are we ready to embrace the future and unlock the full potential of AI in our professional lives?

Presented by: Dawn Foster, CHAOSS
Additional author/researcher: Matt Germonprez, University of Nebraska Omaha

Over the past few years, there has been an increase in hard forks that have been the result of corporate decisions made regarding OSS project structures. These so-called rug pulls from companies driving OSS projects can impact contribution and user dynamics, resulting in hard forks. This talk and our research is motivated by the growing trend of relicensing events and other structural changes to OSS projects that are resulting in hard forks originating from contributors and users of the original project.

We’ll explore the impact that these rug pulls have on the trajectories of the projects, individuals, and organizations involved through case studies of 3 relicensed projects and their resultant hard forks. We’ve found that hard forks resulting from relicensing events tend to have more organizational diversity than the original projects, especially when the forks are created under a foundation, rather than by a single company. The talk will dive into the data and implications to help the audience understand the consequences of relicensing both for the company driving the relicense and the risks of disruption to individuals and organizations contributing to and using the projects.

Unless your project explicitly becomes a Certification Numbering Authority (CNA), it is possible for almost anyone else to create a random CVE entry against your project. With the upcoming responsibility that projects have due to laws like the CRA in Europe, it is getting more and more important for all open source projects to handle the tracking of security bugs and identifiers themselves, instead of assuming others will do it for them.

cve.org now allows all open source projects to be their own CNA, so there is no excuse not to take ownership of this for your project. Groups like curl, the Linux Kernel, Kubernetes, and Python have all done this already, and OpenSSF has produced information explaining how you too can do it.

This talk will go into why you want to become a CNA, the steps involved, and tips learned from the Linux kernel CVE team in handling their 8 CVEs issued a day, alone with other information about other country's numbering authorities which will be coming online in the next few years.

The EU Cyber Resilience Act (CRA) has been adopted, and the new obligations for manufacturers and open source software stewards will come into effect in 2026 and 2027. This joint session between Linux Foundation Europe, LF Research, and the OpenSSF will describe how the Linux Foundation is seizing the opportunity for an improved state of the union in cybersecurity that the CRA offers, and is steering necessary adaptations for the benefit of our members, projects, and contributors.

Specifically, this session will describe CRA implementation progress, commencing with the Linux Foundation's stewards and manufacturers workshop in December 2024, new working groups at the OpenSSF, and research projects, to provide guidance and raise awareness within our ecosystem. It will end with an interactive panel discussion where questions about the impact of the CRA on our collaborative development efforts will be addressed.