Who Controls the Code? Package Distribution as Digital Sovereignty's Blind Spot
Governments are rewriting digital sovereignty checklists around servers and cloud providers, but rarely ask who controls the pipe that delivers the software itself. This talk uses the 2025 cutoff of ICC prosecutor Karim Khan's Microsoft email as a lens on a structural blind spot in open source: centralized package distribution. It introduces FAIR (Federated and Independent Repositories) and asks what it would take to make Drupal, WordPress, TYPO3 and similar ecosystems resilient to a single point of legal or technical failure.
Public institutions run their websites, intranets and citizen services on open source CMS platforms such as WordPress, TYPO3 and Drupal. What is rarely examined is that the plugins, modules and security updates these platforms depend on typically flow through a single centralized repository, often operated by one foundation, under one legal jurisdiction. That is a chokepoint, not a detail. When ICC prosecutor Karim Khan had his Microsoft email account cut off under US sanctions in 2025, it was a stark reminder that legal orders can sever access to critical digital infrastructure even for international institutions, regardless of intent or politics.
This talk uses that case as a lens on a structural problem in open source: the "last mile" of package distribution. It introduces FAIR (Federated and Independent Repositories), a Linux Foundation initiative born in the WordPress ecosystem and now prototyped for TYPO3, and asks what it would take to apply the same model to Drupal and beyond: federated repository nodes, discovery aggregators, and trust and signing layers that remove any single point of legal or technical failure.
Attendees will leave with a working vocabulary for package-distribution sovereignty risk, a concrete example (FAIR) of a federated alternative already in production use, and a set of governance and funding questions to bring back to their own institution's procurement or OSPO conversations before a crisis forces the issue.
Speaker background and project references: Bert Boerland has been part of the Drupal community for over 25 years, registered the drupal.org domain and handed it to Dries Buytaert, organized DrupalCon Amsterdam (2005) and co-led DrupalCon Barcelona (2007), founded DrupalJam and the Splash Awards, served on the Drupal Association board, and currently chairs Stichting Drupal Nederland. Profile: drupal.org/u/bertboerland. Related project: fair.pm.
Bert Boerland has been part of the Drupal community for over 25 years. He registered the drupal.org domain in its earliest days and handed it to Dries Buytaert, organized DrupalCon Amsterdam (2005) and co-led DrupalCon Barcelona (2007), founded DrupalJam and the Splash Awards, and served as a Drupal Association board member. He currently chairs Stichting Drupal Nederland and is a 2026 candidate for the Drupal Association's At-Large Board seat. By day he works in enterprise Linux and Kubernetes sales at SUSE. Bert writes and speaks regularly on open source governance, sovereignty and infrastructure funding, and is currently organizing a community working session on FAIR at DrupalCon Rotterdam 2026 with contributors from across the Drupal, TYPO3 and WordPress ecosystems.