Register for Open Source SecurityCon North America 2026

Tag

OpenSSF Community

Sep 30
Love0

OpenSSF Newsletter – September 2026

By Newsletter

September brings a commitment to sustainable package registries, practical Cyber Resilience Act (CRA) guidance, new community security work, and three conversations on AI, regulation, and dependency risk. Join us in Prague for OpenSSF Community Day Europe on October 6.

TL;DR

  • 🏗️ Sustainable Package Registries → OpenSSF’s Governing Board supports durable funding models for public registries.
  • 🌱 Grow CRA Readiness → A role-specific community garden journey for maintainers, stewards, and manufacturers.
  • 🔐 Security Slam 2026 → OpenSSF and CNCF TAG Security team up for a fall security challenge.
  • 🎙️ Podcast: Three September Episodes → CRA guidance with Madalin Neag, AI and security with Mark Russinovich, and dependency debt with Abby Kearns.
  • 🛠️ Project Releases → Updates from OpenSSF Scorecard, OpenBao, gittuf, Zarf, protobom, Gemara, and Sigstore.
  • 📅 OpenSSF Community Day Europe → Join us October 6 in Prague; project demos  and booth volunteers are welcome.

5 min read

We’re In: Enterprise Commitment to Sustainable Package Registries

Public package registries face rising security and operating costs. OpenSSF’s Governing Board commits to supporting sustainable funding models as enterprise customers while keeping access available to individual developers. Read the commitment.

Case Study: How Does IBM Turn Open Source Participation Into Enterprise and Career Value?

IBM Enterprise Security Executive Jamie Thomas discusses how IBM’s historical journey with Java, Linux, and Red Hat shaped its strategy for turning open source software consumption into intentional stewardship, enterprise value, and career growth for developers. Through OpenSSF, that participation brings enterprise experience into a community working to secure the software upon which everyone depends. Learn more.

Security Slam 2026 – Fall Edition

OpenSSF and CNCF TAG Security are partnering on the fall Security Slam around KubeCon + CloudNativeCon North America. Learn how projects and contributors can take part.

Summer Mentorship Showcase

Meet emerging developers contributing to stronger software supply chain security through OpenSSF’s summer mentorship program. Read their stories.

Grow CRA Readiness: Find Your Path Through the European Union Cyber Resilience Act

OpenSSF’s community garden journey helps maintainers, open source software stewards, and manufacturers identify the CRA guidance and resources relevant to their roles. Explore the journey and the community guide to the September 11 manufacturer reporting deadline. 

Empowering Open Source Security with Scalable Infrastructure

AWS describes how funding and scalable compute can support maintainers’ CI, fuzzing, testing, and artifact distribution. Read the guest blog.

A Community Guide to the EU CRA September 11 Deadline for Manufacturers

Discover key insights into the European Union Cyber Resilience Act (CRA) September 11, 2026 reporting obligations for manufacturers, alongside practical guidance enabling open source maintainers and stewards to streamline security response workflows. Read the community guide.

Open by Default After AI: The GDS Guidance and the Enforcement Question

The Government Digital Service (GDS) issued guidance reaffirming that public sector code should remain “open by default,” refuting NHS England’s decision to hide GitHub repositories over AI-driven vulnerability concerns by clarifying that opacity is not a valid substitute for proper security hygiene and rapid patching. Read here

What’s in the SOSS? An OpenSSF Podcast

#71 – S3E23 Navigating the New Era: The EU Cyber Resilience Act Explained with Madalin Neag
OpenSSF EU Policy Advisor Madalin Neag demystifies the EU Cyber Resilience Act (CRA). Learn how the CRA establishes a horizontal cybersecurity baseline for digital products. Listen now

#72 – S3E24 Balancing AI’s Double-Edged Sword: Software Engineering, Unlearning, and Ecosystem Sustainability with Mark Russinovich

Join Azure CTO and OpenSSF Board Chair Mark Russinovich as he discusses AI’s impact on software engineering, supply chain security, and vulnerability management. Listen now

#73 – S3E25 Securing the Source: Navigating AI Velocity, CRA Compliance, and Dependency Debt with Abby Kearns 

In this episode of What’s in the SOSS, ActiveState CEO Abby Kearns breaks down the rapidly evolving open source security landscape. Listen now

News from OpenSSF Community Meetings and Projects

  • Contribute in Prague: Project maintainers and contributors can lead 30-minute Lightning Learning sessions during OpenSSF Community Day Europe on October 6. Sign up for a session.
  • Volunteers at Open Source Summit Europe can take short shifts at the OpenSSF booth for demos and questions. Sign up for a booth shift.
  • OpenSSF Scorecard migrated its public infrastructure with AboutCode to AWS and published the scorecard-infra repository. Community-hosted Allstar ended in August; users should move to self-hosted Allstar.
  • Self-hosted Allstar instructions.
  • The TAC approved the sandbox application for a new SBOM & VEX Working Group. Read the application.
  • OpenBao released v2.7.0 beta with external KMS-backed keys, post-quantum support, and PostgreSQL read scalability; v2.6.2 includes security fixes. Beta release; stable release.
  • OpenBao v2.6.2 release.
  • gittuf v0.16.0 adds SHA-256 repository support, storage and TUI improvements, and key inspection tools. Release notes.
  • Zarf v0.85.0 adds v1beta1 component config publishing, OCI source prefixing, and Helm retry controls. Release notes.
  • Protobom v0.6.0 expanded SPDX support and serialization; v0.6.1 followed. v0.6.0; v0.6.1.
  • Gemara released go-gemara v0.10.0 and established repositories for GRC Store capabilities. Explore Gemara.
  • The Securing Software Repositories WG discussed npm’s post-quantum package-signature plans with Sigstore. Sigstore also released Rekor v1.5.4, including a hashedrekord CLI default and request hardening. Rekor release.
  • The AI/ML Security and Best Practices WGs completed an initial draft of Finding and Fixing Vulnerabilities using AI (LFD126). Course draft.
  • Security Insights launched a web-based Form & Wizard Editor for maintainers. Open the editor.
  • Model Signing merged its Open Model Signing Conformance Suite and is developing dataset-signing and multi-signature logging proposals.
  • Alpha-Omega continues its Security Engineer in Residence work with the Apache Software Foundation, Erlang Ecosystem Foundation, and OSTIF. ASF update; Erlang update; OSTIF update.
  • OpenSSF’s CRA community garden journey offers role-specific paths for maintainers, stewards, and manufacturers. Explore it.
  • Recap and resources from the recent Global Cyber Policy Working Group’s CRA Tech Talk:
  • Upcoming community meetings.

Cybersecurity Policy & Regulatory Updates

Meet OpenSSF at These Upcoming Events!

  • OpenSSF Community Day Europe — October 6, Prague. Event details and registration.
  • Open Source Summit Europe — October 7–9, Prague. Event page.
    • Join the OpenSSF Global Cyber Policy Working Group for an interactive workshop (and boxed lunch!) at Open Source Summit Europe + Embedded Linux Conference, Friday October 9, 2026 12:45 – 14:00 CEST | Chamber Hall (Floor 3)
  • AGNTCon + MCPCon North America — October 20–23, San Jose. OpenSSF preview.
  • Open Source SecurityCon North America — November 9, Salt Lake City. Event page.
  • KubeCon + CloudNativeCon North America — November 9–12, Salt Lake City. Security Slam preview.
    • Meet OpenSSF & Zarf at Zarfest — November 11 | 6:30–9:30 p.m. Register

Ways to Participate

There are a number of ways for individuals and organizations to participate in OpenSSF. Learn more here.

You’re invited to…

Join a Working Group or Project

Chat with us on Slack

Follow us on X, Mastodon, Bluesky, and LinkedIn

Join OpenSSF

See You Next Month!

Missed an issue? Browse the newsletter archive. Send ideas for next month to marketing@openssf.org.

Regards,

The OpenSSF Team

Aug 11
Love0
Tech Talk: CRA Readiness: A Practitioner’s Guide to Compliance

CRA Readiness: A Practitioner’s Guide to Compliance

By Blog, EU Cyber Resilience Act, Global Cyber Policy

The EU Cyber Resilience Act (CRA) is no longer a future regulatory discussion; it is an immediate operational reality. With the September 2026 reporting deadline rapidly approaching and full compliance required by December 2027, software manufacturers, commercial entities, open source stewards, and foundations must establish a clear, pragmatic path forward.

If your organization builds, distributes, or commercializes software with digital elements, now is the time to shift from policy interpretation to operational execution.

To help you navigate this transition, OpenSSF is hosting an upcoming Tech Talk: CRA Readiness: A Practitioner’s Guide to Compliance. Join industry leaders and security architects as they share real-world implementation strategies, empirical research, and actionable guidance for software supply chain transparency.

Event Details

What will you learn?

This interactive session moves beyond theoretical compliance to address how organizations are actively operationalizing CRA alignment on the ground. Key highlights include:

  • 2026 CRA Research Insights: A deep dive into empirical findings from the 2026 CRA Awareness and Readiness Report, highlighting ecosystem trends, persistent readiness gaps, and major compliance friction points.
  • Member Case Studies & Milestone Guidance: Real-world examples of how OpenSSF member companies are preparing for upcoming reporting deadlines while strengthening software supply chain transparency and upstream open source engagement.
  • OpenSSF Community Collaboration: An inside look at the newly launched Launchpad SIG under the Global Cyber Policy Working Group, exploring how open source communities collaborate to share actionable resources, tools, and best practices.

What’s in this Tech Talk?

  • Introduction: Opening remarks by session moderator Megan Knight.
  • Understanding the CRA: What It Requires and Why It Matters: Roman Zhukov breaks down core CRA obligations, defining “products with digital elements,” mapping critical timelines, and analyzing data from the 2026 CRA Awareness and Readiness Report.
  • Insights from Implementing Organizations: John Kjell and Nicole Bates present case studies on how their respective organizations are operationalizing supply chain frameworks, hardening SBOM/provenance practices, and utilizing the Launchpad SIG.
  • Panel Discussion and Live Q&A: The panel addresses top questions submitted by attendees. We will also address common questions regarding upstream engagement strategies, implementation hurdles, and open source tooling.

Who are the speakers?

  • Megan Knight (Moderator) – Director of Software Communities, Arm
  • Roman Zhukov – Principal Architect – Security Communities Lead, Red Hat
  • John Kjell – Principal Cloud-Native Consultant, ControlPlane
  • Nicole Bates – Principal Technical Program Manager, Microsoft

Secure Your Spot Today

Whether you are auditing your software supply chain, implementing SBOM practices, or determining how CRA impacts your open source contributions, this session will provide concrete, peer-tested strategies to guide your roadmap.

Click here to register for the Tech Talk now