人工智能和数字主权主导了今年的欧洲开源峰会。但在人工智能的喧嚣之外，关于主权的讨论提供了一些实用的东西：将开源投入实际应用的具体计划。
AI and digital sovereignty dominated this year's Open Source Summit Europe. But beyond the AI noise, the sovereignty discussions offered something useful: practical plans for putting open source to work.
数字主权这一反复出现的主题从第一天的主题演讲就开始了，Linux基金会的尼思娅·拉夫（Nithya Ruff）和瑞典研究研究院（其名称比其网址ri.se长得多）的约翰·利纳克尔（Johan Linaker）共同发表了题为《地缘政治、主权与保持开放的斗争》的演讲。这不仅仅是一个欧洲问题。拉夫强调，它“从加拿大到塞拉利昂，再到特立尼达和多巴哥”都至关重要。
The recurring theme of digital sovereignty started right from the first day's keynotes, with Geopolitics, Sovereignty, and the Fight to Stay Open, by the Linux Foundation's Nithya Ruff and Johan Linaker from Research Institutes of Sweden, whose name is considerably longer than its URL: ri.se. This isn't just some European issue. Ruff stressed that it mattered "from Canada, to Sierra Leone, to Trinidad and Tobago."
紧随其-之后的是《开源安全：欧洲主权的基石》，重点关注开源软件供应链。接着是《ORBIT发射台：在制造商与开源之间搭建尽职调查桥梁》，来自戴尔和微软的演讲者讨论了OpenSSF为建立开源组件目录所作的努力，以帮助企业实现《网络韧性法案》（CRA）的合规性，例如CRA开源消费基准（CRABFOSC）。
This was followed by Open Source Security as the Foundation of European Sovereignty, focusing on OSS supply chains. Then ORBIT Launchpad: Building the Due Diligence Bridge Between Manufacturers and Open Source, with speakers from Dell and Microsoft discussing OpenSSF's efforts to build catalogs of open source components to help companies achieve CRA compliance, such as CRABFOSC – the CRA Baseline For Open Source Consumption.
欧盟的《网络韧性法案》现在开始产生实际影响：关于被积极利用的漏洞和严重安全事件的报告义务已于上个月开始实施，其主要要求将从2027年12月起适用。听取戴尔和微软讨论如何满足这些要求，而不是仅仅讨论它们为何重要，令人感到鼓舞。
The EU's Cyber Resilience Act (CRA) is now starting to bite: reporting obligations for actively exploited vulnerabilities and severe security incidents began last month, with its main requirements applying from December 2027. Hearing Dell and Microsoft discuss how to meet those requirements, rather than simply why they matter, was encouraging.
埃利奥诺尔·达克斯莱特（Éléonore Daxhelet）介绍了欧盟开源观察站（OSOR）的2026年报告。她强调这不仅仅是一个欧盟的问题，并提到了乌克兰数字化转型部的迪aa（Diaa），以及我们最近报道过的瑞士EMBAG立法。幻灯片已在线发布[PDF]。
Éléonore Daxhelet presented the 2026 report from the EU's Open Source Observatory, or OSOR. Emphasizing that this isn't just an EU matter, she highlighted Diaa, from the Ministry of Digital Transformation of Ukraine, as well as the Swiss EMBAG legislation we recently covered. The slides are online [PDF].
随后，为了进一步强调这一点，来自日本信息技术推进机构（IPA）的今村和树（Kazuki Imamura）介绍了日本型开源软件模式。
Then, as if to emphasize that further, Kazuki Imamura from Japan's Innovation Platform Agency (IPA) presented the Japan-Type OSS Model.
IPA调查了7个国家的数百家公司以及3万多个GitHub代码库，发现虽然许多机构都在谈论开源，但真正付诸实践的却寥寥无几。日本拥有自身的三轴方法，即公共部门试图播下种子并培育当地商业供应商的努力，同时强烈强调需要机器可读的立法和规则。同样，幻灯片已在网上发布[PDF]，其中包含一些令人尴尬的数据。
The IPA looked at hundreds of companies in seven countries, and more than 30,000 GitHub repositories, and found that while a lot of organizations are talking about open source, few are actually doing it. Japan has its own three-axis approach, where the public sector attempts to plant seeds and cultivate efforts by local commercial vendors, with a strong emphasis on the need for machine-readable legislation and rules. Again, the slides are online [PDF] and contain some uncomfortable numbers.
如果要挑选信息量最大的一场演讲，那可能是Fast Wonder的道恩·福斯特（Dawn Foster）博士主讲的《展示开源软件努力价值的战略方法》（Strategic Approach To Demonstrating the Value of OSS Efforts）。她首先介绍了Linux基金会关于《衡量开源项目办公室价值》（Measuring OSPO Value）的报告，深入探讨了开源项目办公室（OSPO），随后展示了来自CHAOSS项目的的大量实用指导和信息。
To pick out the single talk with the most information, it might be Strategic Approach To Demonstrating the Value of OSS Efforts by Dr Dawn Foster of Fast Wonder. She started with the Linux Foundation's report on Measuring OSPO Value, examining open source program offices, and then presented a remarkable amount of guidance and info from the CHAOSS Project.
该项目全称为开源软件社区健康分析（Community Health Analytics in Open Source Software），福斯特内容密集的幻灯片[PDF]链接了来自《CHAOSS从业者指南》（CHAOSS Practitioner Guides）的多份不同指南。这里有大量的阅读材料，包括关于生存能力指标的系列文章、关于展示组织价值的指南，以及关于如何研究软件影响力的指南。
It stands for Community Health Analytics in Open Source Software, and Foster's dense slide deck [PDF] linked to multiple different guides from the CHAOSS Practitioner Guides. There is a lot of reading here, including a series on viability metrics, a guide on demonstrating organizational value, and a guide on how to research software impact.
在我们看来，这些内容非常务实：包含关于如何引入和运行自由及开源软件（FOSS）程序的信息、如何与用户交流的信息，以及或许最重要的是，如何向高管解释这些内容的信息。许多演讲都提到了石勒苏益格-荷尔斯泰因州摆脱美国云服务的举措。其中一场演讲来自柏林数字主权战略背后的两名负责人。柏林既是一座城市，也是德国的一个州，居民人数多于石勒苏益格-荷尔斯泰因州。
To our eye, this looks like pragmatic stuff: info on how to introduce and run FOSS programs, on how to talk to users, and, perhaps most importantly, on how to explain it to executives. Many talks made reference to Schleswig-Holstein's moves away from the US cloud. One was from two of the people behind Berlin's Strategy for Digital Sovereignty. Berlin is both a city and a German state, with more residents than Schleswig-Holstein.
柏林市政府正与普华永道合作管理其迁移工作——这不是人们在FOSS领域首先想到的名字，但却表明大型咨询公司也在这里看到了商机。
The city government is working with PwC to manage its migration – not the first name that springs to mind in FOSS, but a sign that the giant consultancies see business here too.
我们并不惊讶于在整个峰会上唯一提到KPIs的地方就在这里；我们对时间表则稍微有些惊讶，该时间表计划到2032年，使行政工作站上的70%软件栈成为开源软件。这份幻灯片文档[PDF]揭示了相当官僚的规划过程，但这并不意外；关于治理、依赖和衡量标准的大量讨论也不意外。根据我们的经验，高管们往往喜欢可以衡量的数字和可以瞄准的目标。
We were not surprised to see the only mention of KPIs at the entire summit here; we were slightly more surprised by the timescales, which aim to make 70 percent of the software stack on administrative workstations open source by 2032. The slide deck [PDF] reveals a rather bureaucratic planning process, but that's not a big surprise; nor is quite a lot of discussion of Governance, Dependencies, and Measures. Executives, in our experience, tend to like numbers they can measure and targets they can aim for.
SUSE的埃米尔·布罗克谈到了开源软件联盟现状：评估您的软件栈在欧盟法律下的自主权。这涵盖了欧盟委员会提出的云和人工智能发展法案（CADA）以及组织如何衡量其对此的准备情况。其中一些内容围绕欧盟云主权框架[PDF]展开，以及其对八个主权目标（SOV-1至SOV-8）和主权效能保证等级（SEAL量表，从SEAL-0（无主权）到SEAL-4（完全数字主权））的定义，后者被定义为“完全受欧盟控制，仅受欧盟法律约束，且没有关键的非欧盟依赖”。
Emiel Brok from SUSE talked about the State of the OSS Union: Assessing Your Stack's Autonomy Under EU Law. This covered the European Commission's proposed Cloud and AI Development Act (CADA) and how organizations can measure their readiness for it. Some of this revolves around the EU Cloud Sovereignty Framework [PDF], and its definitions of eight Sovereignty Objectives (SOV-1 to SOV-8) and Sovereignty Effectiveness Assurance Level, the SEAL scale, from SEAL-0 (No Sovereignty) to SEAL-4 (Full Digital Sovereignty), defined as "complete EU control, subject only to EU law, with no critical non-EU dependencies."
布罗克提到了SUSE的云主权框架在线自评工具，该工具可让您在十分钟内了解您的组织所处的位置。所有这些在活动其他地方进行的内核GPU驱动程序讨论面前，可能听起来有些枯燥。但计划、目标和衡量标准表明，组织正在将开源视为基础设施，而非实验。有时候，官僚主义也是一种胜利。®
Brok mentioned SUSE's online Cloud Sovereignty Framework Self Assessment, which lets you get an idea of where your organization stands in ten minutes. All this may sound dry beside the kernel GPU driver discussions happening elsewhere at the event. But plans, targets, and measurements are signs that organizations are treating open source as infrastructure rather than an experiment. Sometimes, being bureaucratic is a win. ®