The Linux Foundation Member Summit 2025

The SBOM (Software Bill of Materials) for a single automotive vehicle is in high demand. Modern vehicles are advanced information systems that constantly evolve, with frequently changing software configurations. This trend is even more pronounced in Software Defined Vehicles (SDVs). Open source supports this evolution. Understanding the software components that make up a vehicle is crucial for asset and risk management, making it a valuable endeavor in the software supply chain. The introduction of process management standards like ISO 5230 and ISO 18974, and the adoption of standard data formats through SPDX Lite (ISO 5962 (SPDX 2.2.1) and the annex of SPDX 2.3), are expected to yield significant results. Meanwhile, there is growing interest in more effective SBOM content and how to share and handle this information. In this session, we will share insights and challenges gained through the development of IVI.

Microsoft's Open Source Programs Office (OSPO) has been building tools and resources to increase visibility of risk according to a set of metrics (Rubrics) in our open source dependencies.

Like many things open source, the path to resolving risk through investment, is a 'learn by doing' exercise. Simply saying 'this project needs funds' isn't helpful to decision makers. What *is*helpful is being able to describe risk, who shares that risk, and what type of investment is most likely to have impact (and ways of tracking that investment over time).

In this talk, I'll share with you our new learn by doing 'investing in open source dependencies framework' to help those advocating for funding, build business cases to advocate strategically for those outcomes. I'll also share a couple of case studies to show how it might work in your company.

We’re learning here too, and look forward to expanding some of the ways we can experiment together and empower every employee to advocate for the need that they see in their dependencies to ultimately contribute to a more secure healthy ecosystem.

This Ask Me Anything session connects attendees to the TODO Group Steering Committee. The TODO Group is an open community of practitioners who aim to create, share knowledge and collaborate on best practices on open source management in organizations to run successful Open Source Program Offices.

Members of the steering committee will assist the audience through the best practices, guides, and tools made by and for open source managers to help them in their day-to-day responsibilities, as well as share their first-hand experiences and lessons learned in building and operating OSPOs. Additionally, attendees will learn ways to connect with the TODO Group – the largest OSPO community dedicated to building best practices in open source management. The session will also provide insights into what OSPOs are facing within the compliance and policy space as well as how people can partner with the ToDo Group.

Ant Group established its Open Source Program Office (OSPO) over three years ago, initially focused on compliance and project support. Over the years, the team has evolved into a full-fledged business unit with dedicated emphasis on strategy, growth, developer experience, and internationalization. As the team has matured, one key insight we've gained is the critical importance of development tooling and "OSPO infra" to systematically support our growing portfolio of more than 20 internal projects—a number that continues to expand.

Operating without dedicated developer or product resources, we have pioneered a unique approach to building and scaling our infrastructure. In this session, we will share our perspective for "OSPO infra" and the toolkit we've developed so far. We will also explore a specialized area of focus for Ant Group—graph technology—and how it plays a critical role in this initiative.

The second half of the presentation will delve into a case study demonstrating how our OSPO collaborates with the Graph team (https://github.com/tugraph-family) to build open-source tools that have proven valuable in supporting and serving OSS teams.

Research has shown that diversity is not just a buzzword but a critical factor that significantly impacts the effectiveness and success of open-source communities. Building an inclusive environment requires more than recognizing the importance of diversity; it demands concrete actions, tangible outcomes, and a genuine commitment to creating a welcoming space for all contributors. This talk draws from an in-depth study of the GNOME Project's diversity and inclusion strategies, examining the opportunities and challenges in fostering inclusiveness. By exploring these experiences, the aim of this talk is to provide actionable recommendations for improving diversity efforts.

While some open-source projects have implemented strategies to create a diverse and inclusive environment, they often struggle to achieve impactful outcomes. How can we move beyond setting diversity and inclusion strategies to achieve measurable results? Are policies and initiatives enough to foster true inclusiveness? In this talk, I will share recommended strategies to foster contributions from diverse groups.

Open source is everywhere. Anyone can use it and anyone can contribute codes to the community regardless of the countries and regions. It is inherently borderless.In the meantime, it is also true that most of the critical open source projects are English speaking communities. This actually creates a gap between English speaking regions and non-English speaking regions in terms of the knowledge about the technologies as well as opportunity to get involved in the community development. There has to be a “Bridge” to fill the gap.

The Linux Foundation Japan office launched a program to solve this issue by launching the Japan Evangelist Program, which has been a big success so far. The evangelists can also become a community by itself, they become a force to connect multiple communities to co-work to create larger values as well as sharing best practice to run meetup etc, which has been a nice side effect of the program.

In this session, through the discussion with the panelists (they are all Japan Evangelists) we would like to elaborate how the program is actually working.