Open Source Summit + Embedded Linux Conference North America 2026: Full Schedule

May 18-20, 2026
Minneapolis, MN
View More Details & Registration
Note: The schedule is subject to change.

The Sched app allows you to build your schedule but is not a substitute for your event registration. You must be registered for Open Source Summit North America 2025 to participate in the sessions. If you have not registered but would like to join us, please go to the event registration page to purchase a registration.

This schedule is automatically displayed in Central DaylightTime (UTC -5). To see the schedule in your preferred timezone, please select from the drop-down menu to the right, above "Filter by Date."

IMPORTANT NOTE: Timing of sessions and room locations are subject to change.

11:20am CDT

The Exploit of Trust: Securing the Open Source Supply Chain - Kadi McKean, ReversingLabs

Monday May 18, 2026 11:20am - 12:00pm CDT

200G (Level Two)

In 2025, the open source supply chain faced a record-breaking escalation in targeted attacks. This talk breaks down the latest research on how attackers exploit the "trust gap" in maintainer workflows, package repositories, and automated publishing pipelines.

Moving beyond the headlines, this session examines the abuse of repository-native features and the rise of dependency compromises. Participants will walk away with a clear understanding of the evolving threat landscape and the defensive strategies—like reproducible builds and continuous validation—essential for modern software resilience. Join us to learn how to maintain the velocity of open source development while building a foundation of verified trust.

Speakers

Kadi McKean

OSS Community Manager, ReversingLabs

Kadi is passionate about the DevOps / DevSecOps community since her days of working with COBOL development and Mainframe solutions. At ReversingLabs she collaborates with developers and security researchers to help entities prioritize their open source risk, reduce technical debt... Read More →

Monday May 18, 2026 11:20am - 12:00pm CDT
200G (Level Two)

Packages + Images + Containers

Audience Experience Level Any

1:30pm CDT

One Signature To Rule Them All: Portable Supply Chain Verification With Zarf - Brandt Keller, Defense Unicorns

Monday May 18, 2026 1:30pm - 2:10pm CDT

200G (Level Two)

Signed software creates assurances around the integrity and authenticity of how it was produced and by whom. But signing alone is not inherently valuable. The ability to verify the signature in a meaningful way elevates the process to complete the trust cycle.

Blend this idea with many disparate signing mechanisms, add the many layers of exchange as software changes hands and where the software ultimately needs to resolve verification, combine it with many different types of artifacts, and you end up with a complex web of requirements that can be difficult to maintain.

Zarf, an OpenSSF Sandbox project, takes a different approach. Rather than requiring each artifact to be independently verified against external infrastructure, Zarf consolidates artifacts into a declarative package that is pre-verified at creation time. A single signature covers the entire package. The trusted root is embedded in the CLI and the package contains the signature, enabling meaningful verification anywhere, including entirely airgapped environments, with no external connectivity or additional tooling required.

Speakers

Brandt Keller

Staff Software Engineer, Defense Unicorns

Brandt is a Staff Software Engineer with a passion for Open Source. He serves as a Maintainer and Technical Lead for the CNCF Security & Compliance Technical Advisory Group, a Cloud Native Ambassador, and a project maintainer within the OpenSSF. He has lead and contributed to multiple... Read More →

Monday May 18, 2026 1:30pm - 2:10pm CDT
200G (Level Two)

Packages + Images + Containers

Audience Experience Level Any

2:25pm CDT

Lightning Talk: Alcoholless: Lightweight Security Sandbox for Homebrew, AI Agents, Etc. - Akihiro Suda, NTT

Monday May 18, 2026 2:25pm - 2:35pm CDT

200G (Level Two)

This presentation introduces "Alcoholless" Homebrew, which protects macOS hosts from potential malicious Homebrew packages by running Homebrew with a separate user account. A command running with this tool is only allowed to read and write its current directory.

While Alcoholless puts focus on Homebrew, it is also applicable to other package managers such as `pip install`, `npm install`, and `go install`. Aside from package management, it is even useful for running AI coding agents that may potentially execute harmful commands.

Alcoholless is also an attempt to reexamine the necessity of Linux-style containers that emerged in this century. It just utilizes 1990s' commands (`su`, `sudo`, `rsync`) and the macOS equivalent of `useradd` to implement container-like environments, without extending the XNU kernel to support Linux-style container syscalls.

Repository: https://github.com/AkihiroSuda/alcless

Speakers

Akihiro Suda

Distinguished Software Engineer, NTT

Akihiro Suda is a software engineer at NTT Corporation. He has been a maintainer of Moby (dockerd), BuildKit, containerd, runc, etc. He is also a founder of nerdctl and Lima (CNCF project).

Monday May 18, 2026 2:25pm - 2:35pm CDT
200G (Level Two)

Packages + Images + Containers

Audience Experience Level Beginner

2:55pm CDT

Lightning Talk: Artifacts That Explain Themselves: Build Metadata in Practice - Socheat Sou & Prajakta Kashalkar-Joshi, IBM

Monday May 18, 2026 2:55pm - 3:05pm CDT

200G (Level Two)

It's common practice to include the Git commit hash in a container image label to serve as a reference, but are you using container labels (and artifact metadata) to their full potential? By embedding metadata into your artifacts you expand your GitOps capabilities. Implement a simple build-cache-like mechanism when building your artifacts, generate robust changelogs across your multi-repo product, or provide better transparency to your security team for their audits and reports. It's even possible to perform Git Bisect-like problem determination between built images. While this talk will explore real-world examples using container images as portable sources of truth, these concepts can be applied anywhere it's possible to add additional metadata to built artifacts.

Speakers

Socheat Sou

Senior Software Engineer, IBM

Socheat has 20+ years of experience at IBM across test, development, and DevOps teams. As a DevOps lead, has led the redesign of CI/CD pipelines, implemented automation tools, and improved release management processes, significantly increasing efficiency and reliability. Socheat is... Read More →

Prajakta Kashalkar-Joshi

Senior technical Staff Member, IBM

Prajakta is a DevSecOps Architect at IBM with 20+ years of experience. A DevOps practitioner since 2010, she leads secure CI/CD pipeline development and mentors aspiring DevSecOps professionals. Passionate about advancing women in tech, she supports various inclusion initiatives... Read More →

Monday May 18, 2026 2:55pm - 3:05pm CDT
200G (Level Two)

Packages + Images + Containers

Audience Experience Level Any

3:35pm CDT

StageX: Rebuilding Trust Through Multi-Signed, Full-Source Bootstrapped, and Reproducible Builds - Danny Grove, Manifest Cyber & Lance Vick, Distrust

Monday May 18, 2026 3:35pm - 4:15pm CDT

200G (Level Two)

Most Linux distributions trust individual maintainers with complete package control, creating critical supply chain vulnerabilities. StageX rebuilds this trust model from scratch with a radically different approach: no single person or computer can compromise the system.
StageX requires fully bit-for-bit reproducible builds verified and signed by multiple independent parties before release. Built from 181 bytes of machine code, StageX bootstraps modern toolchains that can be used in container-native and static contexts.
This talk demonstrates StageX's approach to full-source bootstrapping, bit-for-bit reproducibility and multi-party verification; contrasts it with other reproducible build efforts like NixOS/Guix, and shows how its container-native design provides practical security guarantees. You'll learn how to implement these approaches in your own infrastructure to build software from toolchain to deployment.

Speakers

Lance Vick

Security Engineer, Distrust

Danny Grove

Lead Infrastructure Engineer, Manifest Cyber

Software and Infrastructure Engineer with 16 years of experience across the web stack. Co-Founder of Hashbang, a decentralized hackerspace. Owner at DR Grove Software LLC and Lead Infrastructure Engineer at Manifest Cyber. Cyborg. Specializes in containerization, building other peoples... Read More →

Monday May 18, 2026 3:35pm - 4:15pm CDT
200G (Level Two)

Packages + Images + Containers

Audience Experience Level Intermediate

4:30pm CDT

Image Composer Tool: Declarative Multi-Distro Linux Image Builds From Packages - Mats Agerstam & Alpesh Rodage, Intel Corporation

Monday May 18, 2026 4:30pm - 5:10pm CDT

200G (Level Two)

Building custom Linux images for edge deployments requires distribution-specific toolchains, manual dependency resolution, and bespoke scripting; resulting in fragile, hard-to-reproduce pipelines.

Image Composer Tool (ICT) is an open-source tool that composes bootable Linux images from pre-built packages using declarative YAML templates. It supports Azure Linux, Ubuntu, Wind River eLxr, and Edge Microvisor Toolkit through a single workflow, with dependency resolution across RPM and DEB ecosystems, GPG signature verification, and deterministic builds for CI/CD.

This session covers:

Package management abstraction across RPM and DEB via a unified interface

Reproducible, template-driven builds producing identical outputs from identical inputs

Supply chain security: GPG verification, TLS-secured fetches, minimal attack surface

Extensible provider architecture enabling contributors to add new distributions

Live demo: composing a bootable image from a YAML template in minutes

Attendees will learn how declarative image composition simplifies multi-distribution package management and produces reproducible, secure OS images

Speakers

Mats Agerstam

Senior Principal Engineer, Intel Corporation

Mats Agerstam is a Senior Principal Engineer at Intel, leading architecture for the Open Edge Platform, Edge Microvisor Toolkit, and OS Image Composer to simplify AI and edge‑native workload deployment. With deep experience in edge computing, device lifecycle management, and platform... Read More →

Alpesh Rodage

Cloud Software Architect, Intel Corporation

Alpesh Rodage is a Cloud Software Architect at Intel with 20+ years in platform engineering and distributed systems. He architects and leads development of the OS Image Composer, an open-source tool for declarative, multi-distribution Linux image builds. Previously, he designed multi-cluster... Read More →

Monday May 18, 2026 4:30pm - 5:10pm CDT
200G (Level Two)

Packages + Images + Containers

Audience Experience Level Intermediate

5:25pm CDT

Verified Debian Packaging at Scale - Frederick Lawler, Cloudflare

Monday May 18, 2026 5:25pm - 6:05pm CDT

200G (Level Two)

Cloudflare’s global network relies on Debian Linux machines across 330+ cities. To enhance production security we wanted to ensure that our servers can only run authorized software. For this we leverage Linux Kernel's IMA-Measurement to validate binary signatures before execution. Our system encompasses first-party software, Docker containers, and open-source Debian packages.

This talk illustrates how we successfully injected digital signatures into every Debian package installed on our fleet. This involved deep dives into the Linux Kernel, modifying dpkg, and building a mirroring system that could sign upstream repositories. Learn about our journey enhancing software integrity on a massive scale. This session is ideal for those interested in Linux security, package management, and Internet-scale system administration.

Speakers

Frederick Lawler

Systems Engineer, Cloudflare

Fred is a backend web developer turned kernel developer. He previously focused on the PCIe subsystem since 2018 as a hobbyist. Now he works for Cloudflare on the Linux team with a focus on securing systems and production reliability.

Monday May 18, 2026 5:25pm - 6:05pm CDT
200G (Level Two)

Packages + Images + Containers

Audience Experience Level Advanced

11:00am CDT

Trusted Publishing: Eliminating Credentials From Your Release Workflow - Mike Fiedler, Python Software

Tuesday May 19, 2026 11:00am - 11:40am CDT

200G (Level Two)

In February 2024, about 10% of PyPI uploads used Trusted Publishers. By October 2025, that number exceeded 25%, a massive shift toward eliminating long-lived credentials. For maintainers still using stored API tokens, this talk demonstrates why and how to modernize.

Trusted Publishing uses OpenID Connect (OIDC) to generate short-lived, automatically-scoped tokens from CI/CD environments. No passwords. No API tokens to rotate. No secrets stored in repositories.

This talk walks through setting up Trusted Publishers for GitHub Actions (as an example, but others are available), explains the security model in accessible terms, and shares case studies, including how Sigstore integration enabled forensic investigation of the 2024 Ultralytics compromise.

Attendees will learn the step-by-step setup process, common pitfalls and troubleshooting, and migration strategies for maintainers with many packages. The session also covers why token removal is critical when Trusted Publishing in place, and when restricted API tokens remain the appropriate fallback. Whether maintaining one package or a hundred, attendees will leave with everything needed to adopt credential-free publishing.

Speakers

Mike Fiedler

PyPI Safety & Security Engineer, Python Software Foundation

Mike’s been in the engineering game for 30+ years, leading teams at Datadog, MongoDB, LeafLink, Warby Parker, and Capital One. He’s a big believer in learning from every peer and helping others navigate tech’s complexities. An AWS Hero and Awesome Community Chef, Mike loves... Read More →

Tuesday May 19, 2026 11:00am - 11:40am CDT
200G (Level Two)

Packages + Images + Containers

Audience Experience Level Beginner

11:55am CDT

Package Testing Across Distributions and Architectures at Scale: A Molecule and QEMU Approach - Yash Panchal, Percona

Tuesday May 19, 2026 11:55am - 12:35pm CDT

200G (Level Two)

This session will demonstrate a scalable approach to testing Linux packages across multiple distributions and architectures using Molecule and QEMU/KVM.

Attendees will learn how to build automated testing pipelines that validate linux packages on diverse platforms including x86_64, ARM64, RHEL, Ubuntu, and Debian.

We'll cover practical implementation of Molecule test scenarios, integration with Jenkins CI/CD pipelines, efficient use of QEMU/KVM for multi-architecture testing, and image pre-baking strategies to significantly reduce test execution time.

The talk includes real-world examples from database and toolkit package testing at Percona, demonstration of creating optimized base images, comparisons with cloud instances, Docker and Firecracker alternatives, and best practices for maintaining test infrastructure.

Key takeaways: Setting up Molecule package testing frameworks, managing QEMU instances, implementing image pre-baking workflows, handling cross-architecture testing challenges, and achieving speed and cost savings in testing linux packages.

Speakers

Yash Panchal

SDET III, Percona

Yash Panchal is an SDET III at Percona, where he specializes in automating and testing database and toolkit packages across supported linux distributions and architectures.

A seasoned open-source speaker, Yash presented a session on package testing with Molecule and Jenkins at... Read More →

Tuesday May 19, 2026 11:55am - 12:35pm CDT
200G (Level Two)

Packages + Images + Containers

Audience Experience Level Intermediate

2:10pm CDT

Package Managers Metadata and Cross Ecosystem Projects in the Era of SBOMs - Damián Vicino, Datadog

Tuesday May 19, 2026 2:10pm - 2:50pm CDT

200G (Level Two)

Package managers do more than resolve dependencies—they shape how software and its metadata are distributed across the ecosystem. While they simplify development, they also introduce large, fast-moving transitive dependency trees that are rarely inspected in depth.
Despite evolving independently, most package managers share a common model: distributing artifacts alongside metadata. Yet metadata formats, completeness, and quality vary widely across ecosystems, creating challenges for security analysis, compliance, and supply chain risk management—especially in today’s hybrid, multi-language environments.
This talk examines how package metadata is increasingly used beyond builds, powering vulnerability management, license compliance, and Software Bill of Materials (SBOM) generation through standards such as SPDX and CycloneDX.
Based on the results from the first year of work from the CHAOSS Package Metadata Working Group—an analysis of more than 40 package managers—we’ll share emerging best practices, gaps we’ve identified, and recommendations for both new and existing ecosystems to improve metadata quality, interoperability, and transparency.

Speakers

Damián Vicino

Senior Open Source Specialist, Datadog

Damian Vicino is a Senior Open Source Specialist at Datadog’s OSPO and an Adjunct Research Professor at Carleton University. He began contributing to open source in the early 2000s, leading a local BSD user group and collaborating with a team on five BSDday Argentina events. He... Read More →

Tuesday May 19, 2026 2:10pm - 2:50pm CDT
200G (Level Two)

Packages + Images + Containers

Audience Experience Level Any

3:05pm CDT

What Are You Willing To Digest? Multi Arch Container Image Security and Best Practice - Evans Yeboah Jr., VideoAmp

Tuesday May 19, 2026 3:05pm - 3:45pm CDT

200G (Level Two)

Deploying apps in containers is easier than ever, but securing the image these containers come from is a dynamic security problem that on its surface has no single best answer. So when it comes to what risk you may face and what risk you are willing to accept, one of the questions that may come up is if snowflake-y multi architecture risks are something you are willing to digest?

With multi arch images, based on the system it is deployed to, its vulnerabilities profile may look different than any of the other supported systems. So in this talk I will be demonstrating a security tool agnostic way to handle identifying and remediating these threats. I will go through how anyone (at any level of security experience) can automate container security across pipelines without slowing down development. Attendees will walk away with a new understanding of the importance of minimizing exposure to these risks, as well as a clearer understanding of the layered setup of multi arch container images (index manifest, platform manifest, and image manifest). And without a doubt, walk away with container image security and not unmanaged risk, something they are willing to digest.

Speakers

Evans Yeboah Jr.

Senior Security Engineer, VideoAmp

Cyber security and AI security enthusiasts who likes to build stuff but also make sure it's secure. Engineer by day and baker by night, honing both crafts by failing forward every day.

Tuesday May 19, 2026 3:05pm - 3:45pm CDT
200G (Level Two)

Packages + Images + Containers

Audience Experience Level Beginner

4:20pm CDT

NixOS for Deterministic Distributed-System Benchmarking - B. Cameron Gain, ReveCom

Tuesday May 19, 2026 4:20pm - 5:00pm CDT

200G (Level Two)

Reproducibility remains one of the largest challenges in benchmarking distributed systems, especially when hardware, kernel-level parameters and dependency versions vary between tests. This talk presents a NixOS-based approach for constructing deterministic, portable benchmark environments for large-scale data infrastructure. We show how Nix’s declarative system configuration, content-addressed builds and reproducible packaging model allow engineers to isolate performance variables.

We look at how Nix offers a much more reproducible environment when producing different applications for testing. While Docker containers isolate user-space dependencies, they remain tied to the host kernel's version and configuration.

Using Apache Cassandra as the primary case study, the talk demonstrates how NixOS can define and reproduce complete cluster environments. Attendees will learn practical patterns for packaging workloads, pinning dependencies, and generating ephemeral benchmark nodes.

The session concludes with a live demo of how we can initiate benchmark tests on Nix and then kill the entire infrastructure in just a few seconds.

Speakers