Linux Track (Hosted by Mercedes on 25 March, Stuttgart Vaihingen, Germany)
Repotree – Looking Upstream (Sven Eppler (sodge IT))
As a Linux user, you typically rely on the packages provided by your distribution. For many users, this feels like it is “as upstream as it gets.” But these packages still need to be built. From the distribution’s perspective, they are not upstream the actual project itself is. This is where it gets exciting: How do linux distributions actually built these packages? Who is hosting the real upstream source? How is this source influenced before a package is build? Repotree could be the answer.
Repotree aims to bring full transparency to the software supply chain by examining where Linux distributions source vanilla code, what patches they apply, how far they deviate from the original project, and whether builds can be reproduced. Using a Python project to traverse and analyze package pipelines, it generates visualizations of patches and dependencies across distributions such as Debian, Ubuntu, Arch, Fedora, and Alpine. Currently hosted at canary.redgrey.net
How to create the SBOM for the Linux kernel (Maximilian Huber (TNG) and Luis Augenstein (TNG))
KernelSBOM is a tool that reconstructs the entire Linux kernel build graph by analyzing .cmd files to recover the exact commands, inputs, and outputs used during compilation. KernelSBOM generates three interlinked SPDX 3.0 documents: Source, Build, and Output, which comprehensively encode all build metadata and dependencies. In Step 1, the build graph is reconstructed by starting from the “roots” and recursively tracing through their corresponding .cmd files and source files to identify all exact commands, inputs, and dependencies. In Step 2, this reconstructed graph is serialized into the three interlinked SPDX 3.0 documents: Source, Build, and Output.
Crowdsourcing IT-Security: How openDesk uses SBOMs and VEX for decentralized security compliance (Julian Schauder (Zendis))
Modern software supply chains rely on trustworthy, reusable components. container.gov.de is a German public-sector initiative delivering hardened, signed open-source container images designed for government use. As part of the SSDLC strategy of BSI and ZenDiS, this Secure Government Container Initiative provides standardized base images that meet federal security requirements while remaining compatible with common cloud and infrastructure environments. To handle security transparency, openDesk uses CycloneDX, OpenVEX, and DevGuard to document why vulnerabilities are harmless and expose live, public VEX endpoints. Automated CI pipelines enforce policies, ensuring all critical CVEs are resolved or justified before release.
F*EX – Frams’ Fast File Exchange (Ullrich Horlacher)
FEX is a service to send files of ANY size to ANY recipient(s). The sender uploads the file to the FEX server using a WWW upload form, and the recipient automatically gets a notification email with a download URL. Only the sender needs an account on the FEX server; receiving is “free.” Typical files contain videos, gauge data, ML and simulation datasets, research reports, DB dumps, and virtual machines. FEX is secure, fast, reliable, and has no limits. FEX does not use foreign clouds, which means digital sovereignty! One can also use FEX with special clients, which offer automatic resuming after a link failure. The FEX server requires UNIX/Linux, but the clients can run on any operating system, one needs only a web browser and an email program of any kind. Development site: https://fex.rus.uni-stuttgart.de/
