Blogs

Presentation by Martin Hovekamp (Mitfahrverband e.V.)

Mitfahren-BW is an open-source ride-sharing portal launched by the Ministry of Transport of Baden-Württemberg. Built on OpenTripPlanner and using open data from NVBW MobiDataBW, it consolidates all state-wide ride-sharing offers via an Amarillo instance. Data are provided in open standard formats GTFS and GTFS-RT with minute-level updates, enabling real-time integration into the Landesportal and other local city navigation systems.

At the technical center of this ecosystem lies Amarillo, an AGPL-3.0 licensed middleware that acts as a central data aggregator and normalizer. Amarillo collects ride offers from a variety of independent platforms—such as fahrgemeinschaft.de, fahrmob, and RideBee—and transforms them into standardized GTFS and GTFS-RT feeds, which are the exact same data formats used by public transit systems. By adopting these open standards and adhering strictly to the “Public Money, Public Code” philosophy, Amarillo enables regional journey planners, including OpenTripPlanner and transit apps like VPE mobi or Munich’s MVV, to display private carpool options right alongside bus and train schedules for seamless intermodal travel.

Beyond software integration, Mitfahrverband e.V. promotes a holistic approach that bridges physical and digital infrastructure. This includes establishing physical pickup locations such as Mitfahr-Haltepunkte and Park and Pool lots, while also paving the way for in-car software like the “Carpool Button” that allows drivers to safely manage ride requests directly via their vehicle’s infotainment system. Ultimately, Mitfahren-BW creates a connected, accessible, and scalable mobility network that links today’s human-driven commutes with tomorrow’s autonomous shared transportation.

Presentation by Martin Hovekamp (Mitfahrverband e.V.)

The “Mitfahrknopf” concept enables drivers to offer spontaneous ride-sharing directly from their vehicles. Using in-car data such as the current route and seat occupancy, ride offers can be shared in real time with driver consent via smartphone apps, open interfaces, or in-car apps. This system could scale to hundreds or thousands of live ride offers, demonstrating how connected vehicles can actively support sustainable mobility.

At its technical core, the system relies on the Amarillo REST API, which acts as a central aggregator and normalizer for carpool offers submitted across various platforms such as Pendlerportal.de, fahrgemeinschaft.de, and RideBee. By standardizing this data into feeds similar to public transport’s GTFS and GTFS-RT formats, it connects carpooling directly into local navigation portals, Software-Defined Vehicles (SDVs), and broader Mobility-as-a-Service (MaaS) ecosystems.

Inside Software-Defined Vehicles, the Carpool Button functions via an in-car app or voice/UI interface powered by SDV middleware (utilizing COVESA VSS and Eclipse Velocitas standards). The system continuously monitors the vehicle’s route, destination, speed, and real-time seat occupancy. When a passenger along the route requests a ride, the system automatically detects the match, alerts the driver, and allows them to accept or decline via voice control or the touchscreen. Once picked up, passengers check in digitally using a QR code on the infotainment display, automatically updating the vehicle’s occupancy rate.

The presentation frames carpooling as an essential component for the future of mobility starting with human drivers today and eventually transitioning to autonomous vehicles. Demonstrated through prototypes on digital.auto as well as the “Auto Smartmeter” dashboard, the Carpool Button aims to evolve from a retrofitted assistance app into a standard, and eventually mandatory, in-car feature. The initiative is developed by Martin Hovekamp in cooperation with the non-profit Mitfahrverband e.V.

Presentation by Michael Hamann (XWiki)

XWiki is an open source wiki platform that has been evolving for over 21 years, funded primarily by XWiki SAS.. To maintain long-term financial sustainability, the open-source community operates independently from the commercial company XWiki SAS, which generates revenue through professional support, hosting, and paid extensions that help fund core development. XWiki plays a central role in digital sovereignty initiatives like openDesk, collaborating with partners such as OpenProject, Nextcloud, and Collabora Online to provide integrated workplace solutions. The project has experienced a surge in interest due to Atlassian discontinuing its server products and raising prices, leading XWiki to develop automated migration tools and macro re-implementations to streamline transitions. Ultimately, XWiki’s success demonstrates that long-term open-source viability relies on checking enterprise requirements, maintaining clear separation between project governance and commercial interests, offering valuable support contracts, and building strong collaborative ecosystems.

Presentation by Yasmine Makkaoui (Fraunhofer IPA)

ROS 2 is an open-source robotics middleware framework that has been evolving for over a decade, driven by a global community of developers, researchers, and companies under the stewardship of Open Robotics.

The ROS 2 architecture features a layered structure designed for flexibility and performance. The Application Layer (containing user nodes, lifecycle nodes, and composable nodes) communicates via language-specific client libraries such as rclcpp for C++ efficiency or rclpy for Python prototyping. These libraries build upon rcl, a pure C library that ensures middleware independence, ABI stability, and portability. At the lower level, an abstract ROS Middleware Interface (rmw) decouples the client libraries from the Data Distribution Service (DDS) layer, which manages discovery, serialization, and decentralized transport over Linux, Windows, or macOS.

Beyond communication frameworks, the ROS 2 ecosystem provides essential tools such as ros2_control for hardware integration, RViz for visualization, MoveIt2 for motion planning, Nav2 for autonomous navigation, and various simulation environments like Gazebo, MuJoCo, and IsaacSim. These capabilities enable robotics automation in complex scenarios like textile handling, low-volume welding, fruit harvesting, and kitting.

The framework shows strong community growth, with ROS 2 now accounting for over 90% of package downloads worldwide. Technical governance is led by steering committees and working groups, supported by global alliances like the Open Source Robotics Alliance. For industrial adoption, the ROS-Industrial Consortium (co-led by Fraunhofer IPA, SwRI, and ARTC A*) drives shared open-source infrastructure through joint projects—such as ros2_canopen and vendor-specific robot drivers while providing on-call technical support, hands-on training, and event networking for member organizations.

Linux Track (Hosted by Mercedes on 25 March, Stuttgart Vaihingen, Germany)

Repotree – Looking Upstream (Sven Eppler (sodge IT))

As a Linux user, you typically rely on the packages provided by your distribution. For many users, this feels like it is “as upstream as it gets.” But these packages still need to be built. From the distribution’s perspective, they are not upstream the actual project itself is. This is where it gets exciting: How do linux distributions actually built these packages? Who is hosting the real upstream source? How is this source influenced before a package is build? Repotree could be the answer.
Repotree aims to bring full transparency to the software supply chain by examining where Linux distributions source vanilla code, what patches they apply, how far they deviate from the original project, and whether builds can be reproduced. Using a Python project to traverse and analyze package pipelines, it generates visualizations of patches and dependencies across distributions such as Debian, Ubuntu, Arch, Fedora, and Alpine. Currently hosted at canary.redgrey.net

How to create the SBOM for the Linux kernel (Maximilian Huber (TNG) and Luis Augenstein (TNG))

KernelSBOM is a tool that reconstructs the entire Linux kernel build graph by analyzing .cmd files to recover the exact commands, inputs, and outputs used during compilation. KernelSBOM generates three interlinked SPDX 3.0 documents: Source, Build, and Output, which comprehensively encode all build metadata and dependencies. In Step 1, the build graph is reconstructed by starting from the “roots” and recursively tracing through their corresponding .cmd files and source files to identify all exact commands, inputs, and dependencies. In Step 2, this reconstructed graph is serialized into the three interlinked SPDX 3.0 documents: Source, Build, and Output.

Crowdsourcing IT-Security: How openDesk uses SBOMs and VEX for decentralized security compliance (Julian Schauder (Zendis))

Modern software supply chains rely on trustworthy, reusable components. container.gov.de is a German public-sector initiative delivering hardened, signed open-source container images designed for government use. As part of the SSDLC strategy of BSI and ZenDiS, this Secure Government Container Initiative provides standardized base images that meet federal security requirements while remaining compatible with common cloud and infrastructure environments. To handle security transparency, openDesk uses CycloneDX, OpenVEX, and DevGuard to document why vulnerabilities are harmless and expose live, public VEX endpoints. Automated CI pipelines enforce policies, ensuring all critical CVEs are resolved or justified before release.

F*EX – Frams’ Fast File Exchange (Ullrich Horlacher)

FEX is a service to send files of ANY size to ANY recipient(s). The sender uploads the file to the FEX server using a WWW upload form, and the recipient automatically gets a notification email with a download URL. Only the sender needs an account on the FEX server; receiving is “free.” Typical files contain videos, gauge data, ML and simulation datasets, research reports, DB dumps, and virtual machines. FEX is secure, fast, reliable, and has no limits. FEX does not use foreign clouds, which means digital sovereignty! One can also use FEX with special clients, which offer automatic resuming after a link failure. The FEX server requires UNIX/Linux, but the clients can run on any operating system, one needs only a web browser and an email program of any kind. Development site: https://fex.rus.uni-stuttgart.de/

The Bosch Open Source and InnerSource Program Office has created a new training program. This training is built by Bosch experts for Bosch people to ensure the content is practical, relevant, and trustworthy. It is designed specifically for developers, department heads, group leaders, architects, and product owners.

The 5 Steps of the Training Journey

The curriculum is organized into five clear sections to guide learners step by step:

1. Introduction: Understanding the basics of Open Source and InnerSource.

2. Common Core Principles: Learning about collaboration, governance, and licensing.

3. Community and Business Models: Exploring business models, business impact, and community management.

4. Compliance and Awareness: Creating awareness for legal and compliance aspects of Open Source and InnerSource.

5. Practical Implementation: Learning how to discover, use, contribute to, and successfully maintain projects.

Built for Busy Schedules

The training program focuses closely on the business essentials of Open Source and InnerSource. A key requirement of the program is that it is easy to consume. The training uses short modules that people can complete independently. This design allows the lessons to fit easily into busy daily schedules.

How the Training Was Developed

The modules were built using a structured five-step development process:

• Kick-off: The team was established and high-level content was brainstormed.

• Research: Stakeholder interviews were conducted and personas were created.

• Outline: Research insights were evaluated and the main learning sections were structured into a logical flow.

• Implement: The first draft was developed and the content was implemented technically for the release.

• Release: Peer reviews were completed, and the final modules were officially released.

They say “data is the new oil” and this highlights a critical vulnerability for Europe. Our reliance on non-European hyperscalers for data storage creates a significant dependency, raising serious questions about control, security, and resilience. What if these dominant nations restrict services, or how our data being used? Companies like Microsoft can not guarantee that European data won’t be used by others while it is stored outside of Europe.
Digital sovereignty means you have full control over your data, software, and infrastructure. Digital sovereignty isn’t just about knowing your dependencies; it’s about actively eliminating them. Björn Schiessle from NextCloud highlighted that Europe not only must act but, crucially, can act now. Many organizations remain stuck in theoretical debates, overlooking that solutions already exist. Arguments like “we need European hyperscalers first” often serve as excuses preventing change. Key pathways include developing European hyperscalers, utilizing existing European solutions, defining missing features, and making informed decisions. By consciously steering our decisions and investments towards the right solutions, digital sovereignty can transition from a mere aspiration to a practical reality.

The EU Cyber Resilience Act (CRA) is a challenge and also an opportunity.  It is transforming cybersecurity from an optional extra into a mandatory market entry requirement. This presents a significant question for manufacturers across Europe. Dirk Leopold  during the Open chai and Friends event  presented a great solution of collaboration, that is the CRA Community. CRAIG is a community-driven Non-Profit Association designed to support the implementation of the CRA. Its mission is clear: “We bridge the gap between complex legal requirements and practical technical application, and we strengthen cyber resilience across European industry by making security-by-design, secure development practices, and risk assessment accessible to organizations with limited resources.”

CRAIG empowers organizations, particularly those with limited resources, to meet these new standards. Whether you’re an engineer, a researcher, or a corporation, CRAIG offers an open, collaborative platform where you can get inspired, share ideas and develop together with others. This platform acts as a central source of information, but also much more. CRAIG also organizes working groups for the most important topics to create guidance and collect best practices for small companies up to large multinationals. Through this Community you also have to chance to connect to peers in your region and participate local events.

Are you interested? – check the official website for more information: CRAIG | Your CRA Community