BEGIN:VCALENDAR
VERSION:2.0
PRODID:-//pretalx//pretalx.com//open-source-conference-luxembourg-2026//sp
 eaker//TTHZGL
BEGIN:VTIMEZONE
TZID:Europe/Luxembourg
BEGIN:DAYLIGHT
DTSTART:20251007T000000
TZNAME:CEST
TZOFFSETFROM:+0200
TZOFFSETTO:+0200
END:DAYLIGHT
BEGIN:STANDARD
DTSTART:20251026T030000
RDATE:20261025T030000
TZNAME:CET
TZOFFSETFROM:+0200
TZOFFSETTO:+0100
END:STANDARD
BEGIN:DAYLIGHT
DTSTART:20260329T030000
RDATE:20270328T030000
TZNAME:CEST
TZOFFSETFROM:+0100
TZOFFSETTO:+0200
END:DAYLIGHT
END:VTIMEZONE
BEGIN:VEVENT
SUMMARY:Who touched my software? Trust beyond the SBOM checkbox - bertboer
 land\, Wilco van der Stek
DTSTART;TZID=Europe/Luxembourg:20261007T113000
DTEND;TZID=Europe/Luxembourg:20261007T130000
DTSTAMP:20261009T055802Z
UID:pretalx-open-source-conference-luxembourg-2026-3JBUZ8@pretalx.com
DESCRIPTION:Imagine you buy lunch at the corner of the street every day. I
 t's fast\, it's cheap and it tastes great. Where the ingredients came from
  or who prepared it\, you don't know. Most days that's fine. Until the day
  you get sick and can't trace it back to anything. Food solved this decade
 s ago with labels\, inspected kitchens\, known handlers and recalls. Softw
 are now has its label too: the Cyber Resilience Act makes the SBOM mandato
 ry. Many of us will generate one\, file it and move on. But a label on a k
 itchen nobody inspected tells you very little.\n\nHere is the uncomfortabl
 e part for our own community. Open source is the only model where every st
 ation of the supply chain can be inspected\, and we barely use that streng
 th. Most of us still pull images from public registries and trust dependen
 cies nobody in the room has read. xz showed how close we came: one exhaust
 ed maintainer\, years of patient social engineering\, and a backdoor found
  because a login took half a second too long. With the Open Build Service 
 and the SUSE Application Collection as worked examples\, this talk shows w
 hat running every station properly looks like: preserved source\, reproduc
 ible builds\, known packagers and patches that travel back through the sam
 e chain. Only then does the SBOM become proof of something.\n\nIt closes w
 ith four questions any team can answer this week\, one for every station o
 f the chain: Where did it come from? Who built it? How did it reach us? Wh
 o fixes it when it breaks?
LOCATION:Workshops room 2
URL:https://pretalx.com/open-source-conference-luxembourg-2026/talk/3JBUZ8
 /
END:VEVENT
END:VCALENDAR