Panel: Why is the CRA worth a FOSS maintainer’s attention?
UA2.114 (Baudoux) | Day 1 | 18:30 - 18:55 | Speakers: Piotr P. Karwasz, Michael Schuster, Philippe Ombredanne, Elizabeth Mattijsen
Abstract
For FOSS maintainers, many of whom contribute voluntarily and without formal organizational backing, the CRA raises urgent questions: What exactly changes for my project? What responsibilities - if any - apply to me? And how can I prepare without being overwhelmed? This panel puts FOSS maintainers at the center of the conversation. Joined by industry practitioners for complementary perspectives, maintainers will discuss what the CRA means for day-to-day project work, long-term sustainability, and collaborative development practices. Key topics include: Which CRA obligations might touch volunteer-driven FOSS projects - and which clearly do not What are those tools you use right now or plan using to get closer to the CRA readiness and what you’re missing How maintainers can proactively position their projects without needing formal compliance How industry stakeholders can step up to support the FOSS components they rely on Practical guidance on documentation, secure development practices, and project governance How the CRA could catalyze a healthier relationship between FOSS communities and commercial users
Speakers
Piotr has contributed to Open Source since 2002, progressing from forum support to coding and project maintenance. After Log4Shell he joined Apache Logging Services and became a full-time maintainer in 2023. He works on ECMA TC54 and other security initiatives, applying them to Apache Commons, Log4j, and the wider OSS community.
Philippe Ombredanne is a FOSS hacker passionate about enabling easier and safer reuse of open source code. He is the lead maintainer of the AboutCode stack of open source tools for Software Composition Analysis and license and security compliance, including the industry-leading ScanCode, DejaCode, PurlDB, Package-URL, and VulnerableCode. Philippe contributes to other open source projects, including the Linux kernel SPDX-ification, SPDX, ClearlyDefined, strace, ORT, and several Python tools.
Links
External Links
Notice: The placeholder video image is licensed under CC BY-SA 4.0. The original image can be found hereChanges made to the image are: Cropped the image to a new ratio, part of the image was cut off.
