What's in the SOSS? An OpenSSF Podcast

In this episode of What's in the SOSS, host Sally Cooper sits down with Apple engineers Ev Cheng and Sam Khouri to unpack the evolution of Software Bill of Materials (SBOMs) from external post-build analysis to first-class toolchain integration. As compliance requirements like the EU Cyber Resilience Act demand accurate software inventories, Ev and Sam explain why traditional manifest-scanning tools fail by over or under reporting dependencies. They walk through the open source Swift evolution proposal (SE-0509), detail how native build-graph awareness captures true build-time precision across platform conditions and feature traits, and discuss the future of trust through cryptographic signatures and attestations.
Chapters:
00:23 - Introduction & The 2026 SBOM Inflection Point
03:20 - The Limits of External Tooling
04:49 - Architectural Deep Dive: Native Build-Time Generation
06:04 - Handling Precision: Conditional Dependencies and Feature Traits
07:46 - Specification Standards and CLI Usage
08:44 - Establishing Trust: Cryptographic Signing and Attestations
09:50 - The Paradigm Shift: Security as a First-Class Toolchain Feature
13:10 - Actionable Advice & Next Steps for Practitioners
15:05 - Rapid-Fire Round
Episode links:
Ev Cheng LinkedIn Page
Sam Khouri LinkedIn Page
Swift Website
Install Swift
The Swift Programming Language GitHub 
Software Bill of Materials (SBOM) Generation for Swift Package Manager (SE-0509)
Swift Community & ForumsEv: https://forums.swift.org/u/echeng3805/summary
Sam: https://forums.swift.org/u/bkhouri/summary

CycloneDX
SPDX
Get involved with the OpenSSF
Subscribe to the OpenSSF newsletter
Follow the OpenSSF on LinkedIn

In this episode of What's in the SOSS, host CRob sits down with Chris Aniszczyk, CTO of the Cloud Native Computing Foundation (CNCF), to celebrate a decade of scaling invisible infrastructure. Reflecting on his journey from a Slackware Linux user to leading global open source foundations, Chris dives deep into the evolution of Kubernetes, why it has become the default operating system for AI infrastructure, and how cultural friction has overtaken technical debt as a primary blocker for modern teams. The pair also explore the rise of autonomous agents, the critical need for robust observability via OpenTelemetry, and how initiatives like BOMHort (formerly SeeBOM) and the Kubernetes AI Conformance Program are maintaining vendor neutrality and supply chain integrity across the ecosystem. 
Chapters:
00:00 - Slackware, IRC, and the Origins of Paying It Forward
03:37 - 10 Years of CNCF
08:19 - The Operating System for AI
10:21 - DevOps 2.0: Tackling Cultural Friction in AI Teams
14:32 - Supply Chain Security and the BOMHort (formerly SeeBOM) Initiative
19:23 - AI Sandboxing and the Limits of Traditional Boundaries
23:28 - Autonomous Agents and Ephemeral Evidence Destruction
26:08 - The Economics of AI and the Shift to Hybrid Workloads
30:38 - Preserving Vendor Neutrality with Conformance Programs
35:42 - End-User Innovation: The Future of Open Collaboration
40:01 - Rapid Fire & Global Community Call to Action

Episode links:
Chris Aniszczyk’s LinkedIn Page
OpenSSF Blog: Introducing BOMHort: Kubernetes-Native SBOM Visualization & Governance at Scale Joins the OpenSSF Sandbox
eBook Securing Open Source in the Age of AI
Visualizing Secure MLOps (MLSecOps): A Practical Guide for Building Robust AI/ML Pipeline Security
CNCF Contributor Portal 
Open Container Initiative
KubeCon + CloudNativeCon North America
Open Source SecurityCon North America
Get involved with the OpenSSF
Subscribe to the OpenSSF newsletter
Follow the OpenSSF on LinkedIn

In this episode of What's in the SOSS’s “Big Thoughts, Open Sources,” host CRob sits down with Vincent Danen, Vice President of Product Security at Red Hat, for a deep dive into the evolving landscape of open source vulnerability disclosure. Drawing on over two decades of open source security experience, Vincent reflects on the history and critical role of the CVE program while addressing modern challenges like the rise of alternative advisory systems and the flood of AI-assisted vulnerability disclosures. The conversation explores the shifting dynamics between upstream maintainers and downstream consumers, the practical utility – and missing user experience – of SBOMs, and how emerging regulations like the EU Cyber Resilience Act impact global software supply chain security. 

Chapters
00:00 – Introduction & Open Source Origins
04:26 – The Evolution of CVE and Vulnerability Data
11:02 – Coordinated Vulnerability Disclosure in a Fast-Paced World
17:53 – AI’s Impact on Vulnerability Discovery & Response
27:20 – Realizing the Value of SBOMs and VEX
35:05 – Contextualizing Risk and Exploitability
42:55 – Regulatory Expectations and the Future of Supply Chain Security

Episode links:
Vincent Danen’s LinkedIn page
Red Hat 
CVE Program
National Vulnerability Database (NVD)
EU Cyber Resilience Act (CRA) Information
Get involved with the OpenSSF
Subscribe to the OpenSSF newsletter
Follow the OpenSSF on LinkedIn

In this episode of What’s in the SOSS?, host Sally Cooper interviews Angie Jones, VP of Developer Experience at the Agentic AI Foundation (AAIF). Angie shares her career journey from software engineering and holding 27 patents at IBM to leading open source protocol and developer relations initiatives. She details the mission of the Agentic AI Foundation as a neutral home for governing open source standards and technologies such as the Model Context Protocol (MCP), Goose, Agents.md, and Google's Agent-to-Agent (A2A) protocol. The conversation explores how cross-industry collaboration addresses the reliability and security of AI agents in production, key considerations for the shift toward agentic engineering, and what attendees can expect at the upcoming AgentCon and MCPCon North America.

Chapters:
00:00 - Introduction
00:28 - Welcome Angie Jones
01:47 - Angie’s Career Journey: From IBM Patents to Open Source
06:56 - Mission of the Agentic AI Foundation & Governing Open Standards
11:47 - Preparing for the Era of Agentic Engineering
13:20 - Preview of AgentCon and MCPCon North America
17:32 - Rapid Fire Questions
18:36 - Wrap-up & OpenSSF Resources

Episode links:
Angie Jones’ LinkedIn
Angie Jones’ Blog
Agentic AI Foundation (AAIF)
Model Context Protocol (MCP)
goose: Open source AI agent
AGENTS.md
Agent2Agent (A2A) Protocol
AAIF Working Groups
AAIF Agentic Commerce Working Group
OpenSSF AI/ML Security Working Group
Secure Agentic Framework (SAF)
Register for AGNTCon + MCPCon North America
AGNTCon + MCPCon North America: Full Schedule
Let’s Play the Agentic AI Supply Chain Game! — Sarah Evans and Christopher Robinson (CRob) 
Workshop: Secure Agentic Framework (SAF) for Agentic AI — Sarah Evans, Jautau “Jay” White, Frederick Kautz, and Laura Guazzelli
GitHub Octodex: Meet the Octocats
Linux Foundation Projects
Get involved with the OpenSSF
Subscribe to the OpenSSF newsletter
Follow the OpenSSF on LinkedIn

In this episode of What’s in the SOSS, host Sally Cooper sits down with technology executive and ActiveState CEO Abby Kearns to break down the rapidly evolving open source security landscape. Together, they dissect why reactive post-build scanning fails to prevent dependency debt, how machine-speed AI ingestion is overwhelming human maintainers, and what the impending EU Cyber Resilience Act (CRA) mandates mean for enterprise software supply chains. Abby offers actionable insights into why building a "start secure, stay secure" paradigm is essential for modern software pipelines and why open source communities must unite to redefine repository economics in an AI-dominated world.

Chapters:
00:00 - Introduction: Sally Cooper welcomes Active State CEO Abby Kearns to discuss AI, vulnerability management, and open source security.
01:27 - The Limits of Reactive Scanning: Why controlling components at the build source beats post-build scanners.
04:26 - AI Agents and Ingestion Risk: Managing governance and dependency debt when code moves at automated machine speed.
07:27 - Regulatory Pressures & The CRA: Preparing for 24-hour vulnerability reporting deadlines and mandatory SBOM provenance.
11:00 - Upstream Package Repository Economics: Addressing maintainer burnout and the influx of AI-generated PRs.
14:02 - The True Cost of Exposure: Mitigating enterprise risk across foundational open source language libraries.
16:27 - Rapid Fire Round: Tux the Penguin, favorite emojis, time travel, and key takeaways for the community.

Episode links:
Abby Kearns’ LinkedIn Page
Active State Website
EU Cyber Resilience Act (CRA) Overview
Linux Foundation Projects
Get involved with the OpenSSF
Subscribe to the OpenSSF newsletter
Follow the OpenSSF on LinkedIn