[open-regulatory-compliance] Minutes of the Stewards, maintainers and de

[Juan Rico <juan.rico@xxxxxxxxxxxxxxxxxxxxxx>]

Dear all,

find here the link to the minutes and presentation covered during the meeting today.

The conversation today cover the following points:

- Status Update: The group is awaiting confirmation from the European Commission on the public release of the Attestations report. Work is currently focused on the Due Diligence deliverable, with members encouraged to review and contribute.
- Single Reporting Platform (SRP): ENISA has clarified that stewards should not use the SRP for incident reporting until December 2027, as it is currently intended for manufacturers only. This creates uncertainty regarding how OSS stewards should seek support during cyber incidents.
- Software Supply Chain Communication: A presentation was given on using IETF SCITT standards to create decentralised, interoperable communication channels between open-source stewards, users, and regulators. The initiative is collaborating with other groups, with NixOS serving as a primary case study.

Do not hesitate to comment on this thread or directly via the pull request.

Best regards,

Juan

--

Juan Rico

Senior Manager ORC, Oniro and Cloud Programs | Eclipse Foundation Europe GmbH | X | LinkedIn | YouTube | Instagram | Bluesky | Mastodon

Eclipse Foundation: The Community for Open Collaboration and Innovation

Berliner Allee 47, 64295 Darmstadt

Handelsregister: Darmstadt HRB 92821

Managing Directors: Gaël Blondelle, Mike Milinkovich, Michael Plagge