Carlos Panato is a Staff Software Engineer at Chainguard and a long-time open source contributor, with a focus on software supply chain security, cloud native technologies, and developer tooling. He has contributed to projects across the Kubernetes, Helm, Sigstore, and broader CNCF ecosystems, working on everything from releases and CI/CD to artifact signing and software supply chain security. Carlos enjoys the practical side of open source: building tools, improving how projects are maintained and released, and working with communities to make software more secure and easier to use.
Zach first got involved in securing open source at Python Packaging sprints, and more recently helped release npm’s package provenance using Sigstore. He works at GitHub as a Principal Engineer and is looking forward to continually improving the security of open source software.
Bob Callaway is the leader of Google’s Open Source Security Team (GOSST), spearheading initiatives to bolster the security of open source software, benefiting both Google and the global community. Under his leadership, the GOSST team develops and contributes to projects that address critical areas such as supply chain integrity, observability, and vulnerability management. GOSST also plays a pivotal role in managing essential internet infrastructure services, including OSV, Sigstore, and Certificate Transparency logs. Bob’s influence extends to advisory positions in key organizations: he serves as a member of the Technical Advisory Council for the OpenSSF, is a co-founder and technical steering committee member of Sigstore, and represents Google on the Alpha-Omega project leadership team. His extensive experience includes engineering and leadership roles at Red Hat, NetApp, and IBM. Bob holds a PhD in Computer Engineering from NC State University, where he also shares his expertise as an adjunct assistant professor in the ECE department.
Arnaud Le Hors is Senior Technical Staff Member of Open Technologies at IBM, working on a range of technologies with a primary focus on Open Source supply chain security. Arnaud has been working on standards and open source for over 30 years, both as a staff member of the X Consortium and W3C, and as a representative for IBM. He has been involved in every aspect of the open technology development process: technical, strategic, political, and legal. Arnaud was editor of several key web specifications including HTML and DOM and was a pioneer of open source with the release of libXpm in 1990. Arnaud has participated in several prominent open source projects including the X Window System and Xerces, the Apache XML parser. Arnaud is the main representative for IBM at W3C and INCITS, a member of the Hyperledger Technical Oversight Committee and contributor to OpenSSF.
Georg has been a member of the OpenSSF technical community since 2022. During this time, he has actively participated in various TIs, committees and working groups, such as the Best Practices WG, the End Users WG, but also the Governance Committee and the Public Policy Committee.
Within the Best Practices WG, Georg has facilitated the creation of two SIGs: the C/C++ Compiler Options Hardening Guide and the Python Secure Coding Guide. He has also accepted the role of co-chair of the Best Practices WG, additionally contributing to the OpenSSF’s activities focusing on upcoming EU cyber regulation.
Michael Lieberman is co-founder and CTO of Kusari. His passion is in applying his expertise to use cases where privacy and security are paramount. Mostly recently he has been focused on work within the software supply chain security space. He is also highly committed to open-source, having co-created projects like GUAC and FRSCA, along with having co-lead white papers like the CNCF’s Secure Software Factory Reference Architecture. He is an OpenSSF SLSA steering committee member, tech lead for the CNCF Security Technical Advisory Group (STAG), and formerly co-chaired the CNCF FinServ User Group. His career has led him from startups to multinational financial institutions and everything in between.
Michael Scovetta has over 20 years of experience in software security—10 of which have been dedicated to open source. Michael brings a wealth of knowledge and a unique perspective to one of the most critical challenges we face today.
Michael is a proud co-founder and co-lead of the Alpha-Omega project. In addition to Alpha-Omega, he’s participated in multiple working groups, led the Metrics & Metadata WG, authored the Threats, Risks and Mitigations white paper, and drove the creation of the security-reviews project.
Tracy is a recognized authority in software supply chain security and DevSecOps, with expertise in managing complex, decoupled architectures. She serves on the OpenSSF Governing Board as a General Member Representative and on the Technology Oversight Committee at the Continuous Delivery Foundation (CDF). Earlier in her career, she was a founding Board Member of the Eclipse Foundation, collaborating with IBM to foster its ecosystem.
Named one of TechBeacon’s Top 100 DevOps Visionaries, Tracy is a sought-after speaker at prominent industry events such as CDCon, Open Source Summit, and TechStrong TV. She hosts TechStrong Women TV, highlighting the accomplishments of women in technology, and frequently contributes to expert panels for organizations like JFrog, TechStrong, and the Linux Foundation. Her insights have been featured in various technical publications focusing on DevOps and open-source security.
Before her current role, Tracy was the COO and co-founder of OpenMake Software, a build acceleration and audit tool adopted by over 400 enterprise development teams. She was also recognized as a Women in Technology (WIT) Honoree for her significant contributions to the DevOps field.
Stephen is a Black engineering and community leader in open source, based in New York City.
He currently works as a Technical Architect in the Office of the CTO at Bloomberg.
Stephen participates in project-level steering committees (Kubernetes, OpenSSF Scorecard, TODO Group) and helps maintain a few codebases around open source projects you may have heard of.
Additionally, he serves as an advisor and investor for startups in the open source ecosystem.
Within the Open Source Security Foundation (OpenSSF), he is a member of the Technical Advisory Council, which governs the foundation’s technical initiatives. He is also a maintainer of OpenSSF Scorecard, a project that helps assess the security posture of open source projects.
For Kubernetes, Stephen serves as a Steering Committee member and a chair of SIG Release. He has co-founded transformational elements of the project, including the KEP (Kubernetes Enhancements Proposal) process, the Release Engineering subproject, and Working Group Naming. He has previously served as a chair of both SIG PM and SIG Azure.
Across the wider Cloud Native Computing Foundation (CNCF) ecosystem, he is a former TAG Contributor Strategy Chair, Dex maintainer, and Program Chair for KubeCon / CloudNativeCon, the cloud native community’s flagship conference.
Stephen is a prolific contributor to CNCF projects, and is amongst the top 100 (as of writing) code/content committers since the inception of the foundation.
In 2020, Stephen co-founded the Inclusive Naming Initiative, a cross-industry group dedicated to helping projects and companies make consistent, responsible choices to remove harmful language across codebases, standards, and documentation.
He was previously Head of Open Source at Cisco and has held positions at VMware (via Heptio), Red Hat, and CoreOS. He has also participated in foundation-level governing boards (OpenSSF, CNCF, OpenAPI Initiative).
