Hello, Boston.
Thanks for having me.
This is a great talk, a great room, a great conference, let's have fun.
My name is Julian.
I'm from the set of digital sovereignty in Germany.
I will explain that in a second.
Development lead.
I care about developing our new products, our new services,
and whatever is relevant to foster the digital sovereignty.
In Germany.
A little bit about me, so it can put me in a box.
I started out with post-gascar mostly,
and then I went more towards open chain,
the Linux Foundation project, for management systems,
for open source, and have then transitions to zenders,
and care about more infrastructure things.
I'm an advocate for public money public code,
but in the recent years I've slowly started to change this
to infrastructure.
But infrastructure in a different sense,
I think we have used in this room before.
To me, infrastructure is, for instance,
what things like a Debian project give us,
when you look at things like training maintainers,
but you think about supporting maintainers,
building systems of trust of what it means to build a coherent system.
This for me is infrastructure.
It's also infrastructure in terms of legal systems,
or in terms of public services like code work,
or things where you can store.
This is also infrastructure, but I care a lot about
the more software side of infrastructure.
I come from Zendis, the Center for Digital sovereignty,
and the public administration in Germany.
So I have to put that into perspective,
so you can understand where I'm coming from,
and why it's rather important that I say it.
The Zendis is a 100% state owned.
We were founded by the Ministry of Interior and Germany,
and right now we are owned by the Ministry of Digital Affairs.
We were founded to combat the lack of digital sovereignty.
So I'm not speaking as an NGO who has a political agenda in a certain way.
I have a task, we have a job, and the job is to create digital sovereignty,
or more directly speaking as a disarmition,
enabling a way to reduce the dependencies that we have.
By that, open source wouldn't be our,
let's put it this way, we are not an OSPOL.
But surprisingly, open source is the one tool we choose for nearly everything.
Because digital sovereignty has various definitions.
We were given one, I think, like five to six years back,
and since then, multiple criteria and definitions of digital sovereignty have arised.
But in my understanding, they always fall down really to the four freedoms.
They really are.
If you look at the government, they have to have the right to use the software really.
And regardless of sanctions, we have seen that with the ICC.
We have to have the right to modify the software.
This is where digitalization happens, right?
Well, we create new workflows, new things.
And we have to have the right to, at one point,
where we have to have the right to study the software,
to understand it, right?
This is where I said, on point, because the guy from the Ministry of Security came in.
Anywho.
The Ministry is agency.
But anyway, right, these are the freedoms.
This is what it entails. This is why it's important.
This is why open source for us is the only way really into digital sovereignty.
And so, basically, all we do is open source.
I have to put our basic things first.
One thing is open desk, you have heard it before,
so I kind of have to just point it out.
It exists.
And it does one thing.
To create digital sovereignty, if I say we have to use open source solutions,
we have to make them work.
We have to create an offering for the users,
for the municipalities, for anyone who cares for the software.
It has to be enterprise-grade.
It doesn't, it's pointless if I have ten different solutions
that the municipality has to stitch together.
It doesn't matter how well it can be integrated.
They shouldn't be the ones doing it.
And this is precisely what open desk does.
We took the pre-existing open source solutions,
as you see from mail to calendar to project management,
to chat, of course.
And just create a coherent thing,
basically what the same as last week,
or mind-brew in the Netherlands.
The problem is the same.
Create, take the existing open source
and just make a coherent system,
such that we can use it.
We have open code.
This is more where I really want to focus on today.
Open code is our platform for software.
It is code, it's a GitLab.
It's a GitLab for the public administration
to work on software.
Our shared infrastructure for the German public administration
to write store-in-hands software.
It's open to the public,
although we have to have to make sure that the project is on there.
In the interest of the public administration,
yet we'd have about 5,000 replos at the moment.
And it's designed for the public administration
to make open source,
well, a requirement really.
In addition to this being just a hosted,
available GitLab for the public administration,
we provide things like guidelines and policies.
Software stored on open code.
This platform has to be open source.
And by checkbox exercise,
we went down the rabbit hole of the legal requirements
on what is it to be,
what does it mean to be open source?
There is the open source definition.
And there is a list, but the list is all but complete.
So we enhance this.
We took what is available, for instance,
on the Linux Foundation's SPDX side,
on what are similarities and licenses.
Basically, now you can have a checkbox exercise
and say, right, this is open source,
which isn't anything new, right?
But it made it simple.
You don't need a legal guy anymore.
You can check its open source.
And if it's stored on open code,
it has to be open source by policy.
And if it's distributed artifacts,
the artifacts have to be open source as well.
So this way, if we were to use open source
in a tender, for instance, we could now say,
whatever you're creating for me,
has to be developed or not developed as a hardware.
Has to be provided by open code.
So it's available for the rest of the public administration
just to see, just to maybe collaborate, whatever.
And if I want to be hard,
I have to download it by open code.
So I know that dependencies are also open source.
Right? So this is basically our way to make it simpler.
Such as the municipality doesn't have to understand
what exactly it requires to make something open source.
In addition to that, we do a few more things.
We have the context of security.
Where the security is sweet and bad at?
I think 1730 is the next start to think about that.
Yeah?
Where we try to provide open source solutions to what security.
Just to make it easier for the municipality just to tick that box.
We have an inventory.
Two or three talks before we had the question in here on,
how can we avoid writing the same software over and over again
or compete on a municipal and federal level
on just the same solutions all over again?
Well, show the citizens that the software exists.
And this is literally what we do.
We have a large inventory of 250 components right now
who are just listed there as right.
This is an open source tool like this.
It can be used by the public administration.
So if I create something new, I have to talk.
My citizens can see that.
They can see there is a solution.
Why are we writing a new thing?
So visibility is one way to combat this.
Not the only way, but I think it helps.
It helps to have this.
And the same software inventory, by the way, is mirrored
on a European level by join up.
So I think this software inventory is a slowing rising.
One more thing is badges.
But down here, this is where I want to get to now.
Badges are our way to grade software, so to speak.
But first off, I have just a general question.
And don't answer wrong.
Who in here would trust Debian, for instance, for a production server?
And I don't care if you have a different flavor.
Who would trust Debian mainline?
Most of the hands, I expect it all.
At the point I'm trying to make it, it shouldn't take an expert
to trust open source.
But if I were to ask my mother, should I use the project Debian,
the open source project Debian as the production server?
She wouldn't know what that means, but you get my point.
Most people do not understand the quality that is inside open source.
Sometimes there isn't quality, this is different topic,
but many open source projects are very great from the get go.
Of course, you still need an integrator.
But give them the choice to use it and to use it in a professional manner.
And this is why we started the batch program.
The batch program is designed to be integrated into catalogs,
not to support the developer on what is the next thing they have to achieve.
What's the next metric to improve?
This isn't really the point.
The point is credit, we're credit is due.
Tell the world what on the open source world is already there.
Try to show.
Sorry.
Don't try to be the next 50 minutes.
Don't try to be the next authority on what is good software.
This is not our job.
But we can tell the world that the software that we have fits into certain criteria.
It isn't bad.
And this is exactly where it comes in.
Just one thing.
The Center for Digital to Solventy in Germany is precisely targeted at Germany.
This is exactly who we are responsible for.
Hence, I'm very sorry.
Most things are not translated to English.
That's the reason, because we don't like it.
Some are, but this is really not who we have to focus on.
So the batch program.
As I said, it's intended to be embedded into software catalog.
Show people that a given software project isn't bad.
It's supposed to be automatic.
There's one thing that actually requires a human, but you will see why.
I tried to take as many boxes from a technologically automatically to help for procurement, for instance,
or help people get an idea that this software isn't bad.
And we look at legal, security adoption and project maintenance.
You will see, indeed, that they are not as bad as they seem.
The first one is the open source batch.
This is very simple.
For us, it's very simple.
Every project on open code by policy is open source.
So we don't have to do the diligence at the moment.
But to be fair, there is.
We could dive deeper into, for instance, the question.
Can we automate the question of whether or not artifacts are 100% open source?
Or not.
This is where things can grow into.
Right now, it's very simple for us policy defines.
And that we can refer to at the moment.
We have the maintenance batch.
The maintenance batch, just on a very high level, tells you, this software isn't dead.
It's maintained, where people are actively answering issues.
On the first level, the later levels, the crisis proof.
This crisis proof, for us, means there's more than one code developer.
And that code developer is anyone who has more than 20, 30% on the commit ratio.
So really, we should try to figure out what is it that people really need.
And if I have a project where they quite actively answer all the issues,
where the reason they are released is just now and then.
I have more than just one guy, right?
Three badges.
Go for it.
That's an information.
There are more things we check, but really this is the information we want to give out.
Right?
This is more than most proprietary products have.
With the reuse batch, and this is one of the more important ones.
Ready for reuse?
Quite simple.
It has packages.
It has really users.
Is there something available you could use?
But this is boring.
The important one is actively use.
This is where I say that we need humans.
On open code, everyone in the public administration can just take, I'm using this.
And I had to add this one, example from a few talks before, right?
If I were to tell you that, for instance, any federal government agency runs, open WRT, at scale.
As a proof of concept, but let's say I would say that.
This provides a different level of assurance towards whether or not immigration can be assumed.
Right?
If this information doesn't exist, most municipalities wouldn't even consider open WRT.
This changes the field.
And this is why this kind of batch is for us, one of the more important ones.
Just to show the world that things exist.
Yeah, this is how it can look.
Everyone in open code is allowed to do this.
There's the one can say what company they come from for, in short, in short,
a form.
And if they really want to, they can even be listed as a contact person.
Ah, it's not mentioned, but it's a security batch.
That's wrong, I was confused.
The last one is the security batch, where we care about security basic practices.
For instance, some of our users said, people don't trust open source, because anyone can commit.
Of course, that's not the case.
This is what we're checking, right?
No, not everyone can commit, right?
Yeah, you have some, I think branch protections, even level two, stuff like that.
Provide people with the basic understanding that normal open source ecosystems are not unmentained,
unsecure, and not in the use by anyone.
They are in production, they are secure, most not all of them.
And many are maintained, very well maintained.
Now give them a chance just to go there and be used in the production.
Because I am going to be faster than that.
The last batch that we got, this is the first time we actually look for instance at attestations.
I have to point out at the moment that we are very focused on containers and container infrastructures,
because in Germany we have a larger cloud strategy put it this way.
So this is the first batch where we actually say right on the last image that we see.
We look at the attestation, like the OCI attestation, the signed one.
We look if there is an s-bomb, if there is an s-bomb, a trustworthy one.
And it has CV information and effects information.
We want to see that this is managed.
We want to see that the last release does not have high or critical CVs.
This is necessary check.
No, but now I can say, this is secure.
There is no known vulnerability for this software in this release.
This information is quite important to have.
It is quite important to put on a sticker on a software inventory,
because right now you can just look at it and say,
obviously there is a way to use this in a secure way.
If you don't get the batch, of course, different topic.
Taking this one step further.
This is the latest project that we started.
I have to read it.
I know I haven't spelled it out.
This is a secure government container initiative.
Yes.
Find it.
The bullet point.
This is our way to create a Docker hub,
that isn't a geopolitical playball.
A Docker hub that cannot be taken down.
A supply chain for the public administration,
just to use containers to redistribute containers.
And as I said before, we look at it as stations.
For instance, one of our policies is,
we only distribute containers that are actively maintained.
And the actively maintained now means that all higher CVs,
high 7 plus and upwards, are a have Vex attestations.
Now that Vex can say you big problem, sorry.
All that Vex attestation can be definitely not affected.
But this is what we consider to be maintained.
If the software doesn't have new builds, I don't care.
But I care if the software has no vulnerabilities that nobody looks at.
This is what I call on maintained.
And this is now our way to basically create this kind of infrastructure.
I have to mention that this isn't necessarily a service
that we put out to the public administration.
This is an initiative that we started from our own needs with various players.
The open desk, I mentioned it, of course, is container-based.
We have about a hundred containers in it.
We have to harden these containers.
This is where we put the containers for others to reuse.
And the Ministry of Foreign Affairs has joined in.
They have publishing containers as well for their own needs.
So what we try to do is we create this new supply chain that is resilient.
That is sovereign, if I dare say.
And provides a way for the public administration just to collaborate with each other.
Just to push something in a very safe space, I would like to say.
And pull it out again the way that we intend and that doesn't violate any kind of policies.
And now I have time for questions.
Hans, I heard that one first.
Yes.
Is there any kind to support commercial corporations in this world?
Or is this just a public sector?
Ah.
The question was, is it planned that we support private corporations as well?
Yes.
And it's necessarily.
It's a follow-up question, because a large part of the cooperation in Europe is actually,
it has to work for Europe to function as an area.
And I think for some of the banks, it could be atostations, as it could stores.
So the question really is, how do we include the North Public Administration into this?
I can't say the supply chain, just for me.
Yes.
And no.
We are reaching out wherever we can.
We try to make this accessible to anyone.
The thing is right now, we are kind of bound by just legal matters.
We are not responsible for private sectors in the way that we are for the public administration.
We are getting out to that.
We are, at the very least, it's very simple to join that supply chain and read from it,
because it's always read public.
But participate.
This is something that we are currently building up on how does it work,
because this needs steering.
We need a sovereign market in Europe.
Yes.
And this would be just, so we need, the comment was we need a market for sovereign solutions.
This is one anchor point to this.
Right.
And if we have a larger market, we are going to just talk on if that's possible.
Uh, five minutes.
Yes.
There.
Yeah.
No.
I also worked for a company Germany whole thing.
So there's a lot of chance to work on that.
And sometimes I see a bit of respect to open a code,
but I think it's open.
And also, to understand that this public infrastructure,
I'll see going to the market.
So, and I also request by the number of reports,
where there is that 10 is less or less great possible.
Can we just share, obviously,
how can you do that?
I think the opening work on the market was all in.
How can you, uh,
uh, on this level?
Or do you do this thing?
The point is, the budget is just,
I think, to explain this to,
I think that two things to this.
One is, um, reusing the software.
This is where the batch comes in.
Um, publishing something.
Also, sorry.
The, the question basically was, how do you,
do you convince the, the public administration,
or anyone just to go there,
uh, and just to participate?
But the, the funny thing is,
um, finding someone who's willing to publish the code for me,
this seems very simple.
Uh, because we put out, put out this place.
Um, we make the barriers as simple as possible.
And, um, I think we have quite high,
high visibility,
um, actors on the platform.
Like the, the, the, the Dutch unstack,
the German stack, the, the idea on what exactly is a cloud platform in Germany.
This is actively developed by the federal ministry of digital affairs,
whatever, um, on open code.
So we, we have some visibility in that regard.
So, I, I assume there's still very many projects
who would like to, to leave their proprietary realm.
Um, I have the discussions,
and usually the, it's, it has become very easy to reach to get out
because the important guys are already doing it.
Just just as an idea, right?
This is, um, by, by the way, we have,
apart, apart from the, the documentation that we publish.
Um, our members, or our people on the platform,
are, uh, a successfully patch, um,
publishing, uh, workflows,
and how to actually publish the PTV,
the, the, the, the, the, the Ministry, I don't know, for technical and physical stuff.
Um, they have published a guideline on how, what exactly do they have to
run through from a legal perspective to publish things as open source.
Right? So, so slowly it becomes just easier to go there.
But I don't have to convince people anymore.
Yeah.
Uh, first of all,
is the extension to be, like,
a draftman, a replacement for the document,
which, uh, that can be a good thing.
Private, uh, of course.
Uh, one second.
Our question is,
is this only talking about the German,
the government's ecosystem,
or is the intention to open it up to,
all the member states, uh,
uh, also that, uh, the intention of this project is,
uh, independent of geopolitical, uh,
uh,
one of the three great questions.
Let me first try to, um,
uh, first, so it's about to contain any initiative.
Uh, first one is, is it supposed to be a drop in the replacement
to existing registries?
And yes, it is.
Uh, absolutely, especially for the public administration.
This is the job I have to fulfill.
At the same time, we don't try to, to scope anyone out.
I have to make sure the public administration can use this
on a sovereign way.
Time's up.
Um, there is a big paper, just let me finish that word.
Um, SSDLC.
Maybe, maybe, I hope it's just, I hope,
I think it's just in German, but Google translate goes along way.
Uh, SSDLC on open code.
This is a large paper that we have, uh,
with the BSI together on what exactly has to change
to make this kind of supply chains resilient.
Thank you.