ASF Plus One Newsletter: October 2025

Published on October 22, 2025
By The ASF

If you weren’t able to attend Community Over Code North America or you’re hoping to revisit some of the conference content, we have video recordings for some of the conference tracks now available on The ASF’s YouTube channel. The Apache Trusted Releases platform entered its second Alpha, marking major progress toward secure, compliant release processes. We also welcomed two new Top-Level Projects and are reflecting on Cybersecurity Awareness Month with a reminder that security is everyone’s job. Plus, get ready, lightning talks are going online soon! ⚡

**To receive Plus One directly to your inbox, sign up via the subscribe box below.**

Community

Catch more video recordings from Community Over Code North America on The ASF’s YouTube Channel.

Plus One Podcast

Dave Fisher, VP Tooling

Danny Angus, VP Infrastructure

Project Updates

The Apache Software Foundation Announces New Top-Level Projects

Apache Kibble and Apache Traffic Control have been retired to the Apache Attic.

Foundation News

Apache Trusted Releases Platform Begins Second Alpha

Corporate Contributions Pivotal to Advancing ASF Community-led Innovations and Public Benefit

In the News

A RedMonk Conversation: CRA – The First Horizontal Regulation of the Software Industry

President’s Letter

Welcome to Cybersecurity Awareness Month! The theme from the National Security Alliance is very basic and personal-security focused–strong passwords and recognizing scams–but I’ve been seeing the open source community embrace a month of focus for our own growing cybersecurity needs and efforts.

At The ASF, our Tooling team’s core project, the Apache Trusted Releases platform has begun second alpha. This is a huge step towards making sure that our release processes comply with all the forthcoming regulatory requirements. It’s open to all ASF projects, including those in the Incubator, so if you’d like to try it out, reach out to dev@tooling.apache.org.

The Open Regulatory Compliance Working Group out of the Eclipse Foundation, which we’ve been participating in since the beginning, launched its attestations project this week, with several ASF folks in attendance. The goal is to create guidance for open source projects on attestations, particularly for compliance with the CRA.

Security can no longer be limited to “the security team” or “the security person.” It’s everyone’s job to be thinking about it. With a little more than a week left in Cybersecurity Awareness Month, take a few minutes to figure out what your part can be if you aren’t already actively working towards better security in your project.

And if you are already passionate about it (or anything else!), start prepping your five-minute talk, because in the next couple of months, we’re taking one of the best parts of Community Over Code–the lightning talks–out of the confines of a once-a-year conference and going online! Same rules as lightning talks in person: five minutes each, hard stop, no slides. Each session will be an hour long with three lightning talks, after which breakout rooms will split off for anyone who would like to discuss the topics more in-depth. Ready to sign up? Registrations are open for sessions through April 2026.

I look forward to hearing what you all have to share!

Sincerely,
Ruth Suehle