Academy Software Foundation Technical Advisory Council (TAC) Meeting - September 30, 2026

Join the meeting at https://zoom-lfx.platform.linuxfoundation.org/meetings/aswf?view=list&projects=aswf

Voting Representative Attendees

Premier Member Representatives

Project Representatives

Carol Payne - OpenColorIO Representative
Cary Phillips - OpenEXR Representative
Chris Kulla - Open Shading Language Representative
Daniel Greenstein - OpenImageIO Representative
Diego Tavares Da Silva - OpenCue Representative
Jonathan Stone - MaterialX Representative
Karen Ruggles - Diversity & Inclusion Working Group Representative
Ken Museth - OpenVDB Representative
Nick Porcino - Universal Scene Description Working Group Representative

Industry Representatives

Jean-Francois Panisset - Visual Effects Society

Non-Voting Attendees

Non-Voting Project and Working Group Representatives

LF Staff

David Morin - Individual - No Account
Emily Olin - Academy Software Foundation
John Mertic - The Linux Foundation
Yarille Ortiz - The Linux Foundation

Other Attendees

Doug Walker - Autodesk / OCIO
Kimball Thurston - Weta
JT Nelson - Pasadena Open Source consortium / SoCal Blender group
Sam Richars - Open Review Initiative
Tony Micilotta - Autodesk

Meeting Assets

Antitrust Policy Notice

Linux Foundation meetings involve participation by industry competitors, and it is the intention of the Linux Foundation to conduct all of its activities in accordance with applicable antitrust and competition laws. It is therefore extremely important that attendees adhere to meeting agendas, and be aware of, and not participate in, any activities that are prohibited under applicable US state, federal or foreign antitrust and competition laws.

Examples of types of actions that are prohibited at Linux Foundation meetings and in connection with Linux Foundation activities are described in the Linux Foundation Antitrust Policy available at linuxfoundation.org/antitrust-policy. If you have questions about these matters, please contact your company counsel, or if you are a member of the Linux Foundation, feel free to contact Andrew Updegrove of the firm of Gesmer Updegrove LLP, which provides legal counsel to the Linux Foundation.

Agenda

General Updates
- Dev Days 2026 - Sept 17th #1446
Annual Review: OpenAPV #803
2026 TAC Priorities #1208

Notes

Attendance is not complete
- JF: These notes were taken after the fact, I did not have access to the complete attendee list.
General Updates
- Dev Days 2026 - Sept 17th #1446
  - Carol: Olga is not available (Larry: holiday in BC).
  - Carol: gathering numbers, please tag your PRs with #devdays tag, would like if project leads can do that.
  - Don’t have up to date numbers yet, but it looks great from looking at it a few days ago.
  - Emily: looks like 59 total
  - Carol: the year over year graphs from Olga are useful we’re making progress, and the philosophy seems to be working.
  - Carey: for OpenEXR, any time I get the smallest bit of interest, I tell them we welcome contributions any day. I’ve been chatting with a couple of people who might have contributions which will come later.
  - Emily: Sept. Recap as of late last week
    - 59 PRs: 25 open, 34 closed
    - DNA (6) MoonRay (3) CI WG (1) got their first Dev Days PRs
    - 15 people opened PRs at two o r more events
    - 48% of 2025PRs were authored by first timers
    - Students / Academics rose from 3% of registrants (2024) to 15/20% (2025) to 34% (May 2026).
    - US and Canada is 65% to 75% of registrants. India is now third (9 at least of the last two fall events, up from 5 in 2024)
    - Not everybody signs up, but can cross corelate with people who contribute.
  - Virtual Town Hall Stats
    - All VTH available on demand on web site
    - Will move them to YouTube, but for now allows us to collect data
    - We can keep track of new contributors
    - May be able to share names with projects of people interested in contributing
    - New Contributors: 28% already contribute and another 22% (46 people) “would like to” USD WG (13), xSTUDIO (11, and OSL (8) had the most of those
    - Expanded Reach: 258 unique people registered for 2026 VTHs up 8% from 2025, 85% of registrants new this year
    - Need to know how people are engaging with us
    - On Demand Videos
- Carol: for folks who did VTH, how did the timing feel?
  - Larry: big improvement to have them after SIGGRAPH and closer to annual releases. Could present the next big release with some certainty, when we did them in July, there was more speculation / hedging. This was more satisfying. But having them in the middle of releases and DevDays made it busy. Since they are a good intro / advertisement for projects, would be great to have those before DevDays for potential contributors. Emily: for next year, we may want to have VTH before DevDays.
  - Karen (chat): If we want to align with academic calendars for dev days that could be a good target for end of semester requirement. Larry: yeah, but anybody who doesn’t have that as a real graded assignment is going to be super hard to allocate time in the middle of their end-of-semester busy period. Karen: Agreed. Could be something for clubs too
  - Carol: for OCIO, if we could have slid something, it would have been VTH, but liked having it after SIGGRAPH and closer to release, could be even a bit later. But would push Dev Days
  - Carey: I like suggestion of staging VTH as a glorified TSC meeting, use the timeslot, same content, but introduce what the TSC does, a pitch for openness of meeding. OpenEXR VTH was a bit disappointing since there was no interaction. There were 30 people in the stream, but we didn’t rehearse and ended up running out of time. OIIO was just after us so we had to cut off. Not sure we would have gotten more questions, but it would good to have a “soft” ending instead of a hard stop. Emily: yes I will space them out. Most of the VTH were quiet, not a lot of questions. Kimball: I recognized a lot of the names in the OpenEXR VTH, but want to channel more new people to these VTHs. Carol: Doug and I for OCIO treat the VTH as intended for the recording / YT, SIGGRAPH is where we get the interaction and questions. VTH for OCIO has almost always been very quiet. Maybe that’s not the right way to look at it? Larry: like the BoFs, there can be some flexibility. Some are just informal discussions, some are more presentations. Making the VTH like the TSC could give more flexibility to the projects. Sam: David Morin has used evpoll effectively, could we prompt people to give feedback this way to interact. A lot of Zoom meetings, people are doing something else. So want to encourage interaction. David: polls are always a good idea when you don’t see your audience. Emily: happy to work with projects who want this. But we are after the recordings, I’m going to slice and dice them into smaller pieces which can be reused. If we do it as a TSC meeting, we could do 1 weeks as a formal VTH, and make the next one the informal discussion? Or answer questions on Slack. Carol: some projects may not have 1h worth of presentation, so could have 1/2 presentation, 1/2 TSC discussion.
  - Carol: overall what I’m hearing
    - we made improvements with timing (after SIGGRAPH), will do that next year, with some adjustments. Figure out best timing to encourage participation.
    - figure out how to get more projects to participate in VTH, don’t want to force projects, but they are really valuable. Want more projects to participate, a way to do that is to have it occupy the normal TSC meeting slot, easiest way to do this.
  - Carol: we did get some feedback as to why a project didn’t do a VTH, but we want to hear that feedback. Larry: was it mostly just “we didn’t have time?”. Carol: main reason was from Rez. Stephen: most of our maintainer effort is around project maintenance. When we’ve had VTHs, we had plenty of turnout, but hard for maintainers to put together a proper slideshow / presentation. We’re seeing more value in taking care of current community, people find us anyway, and that keeps us busy. If number of reviews slows down and we no longer have trouble with basic maintenance, we may change this, but for now we have our hands full.
  - Emily: also some projects may not have had enough activity to present on. Carol: would lead to a more casual presentation. More like a SIGGRAPH BoF, have a discussion about the project, less formal presentation.
  - Stephen: there’s only so many ways you can make a CLI interesting to watch! Emily: I’m happy to work with everybody on what the format looks like. It has to be valuable for the project as much as for marketing. Maybe it’s a 15 minute thing? But would be good to have something.
- Larry - back to Dev Days: at Imageworks, we’re up to 5-6 people we hired who were connected to DevDay, curious if other places are seeing this and hiring people coming in that way. We’re not going out looking for this, but maybe candidates are learning about us this way? But it’s been looking as a real success in this way. Maybe we can play it up a little?
- Jonathan (chat): There have been plenty of Dev Days participants that we’d want to hire, though so far it’s been more common for existing ILM employees to dive into ASWF projects through involvement in Dev Days. Carol: Dev Days not always about outside / new contributors, we also want people inside our companies to learn how to contribute to open source projects.
- Carol: we have some data around this from SLP. Larry: there’s overlap. Carol: a bit harder with DevDays, we need help tracking. With SLP we have 20 learners a year, we can ask them if they got a job. But with Dev Days, a lot harder to figure out such connections. We would like to be able to tell these success stories. Open Source is a valuable way to help your career, more than a resume. How it impacts recruitment is valuable.
Annual Review: OpenAPV #803
- Presentation Slides
- Youngkwon Lim - OpenAPV TSC
- 2 years working in ASWF
- Brief Description
  - To develop a royalty-free, open-source, open standard video codec for professional video capturing and post-production
- TSC Chairperson
  - YOungkwon Lim
- Current TSC members
  - Erik Strauss
  - Sam Richards
  - Alejandro Arango
  - Eric Reinecke
  - JT Nelson
- Contributions
  - 214 commits
  - 90 PRs
  - 23 Forks
  - Upgrading from origin 0.0 software
  - Good tendency, getting contributions from others
  - Curious about external uses
- Organizations Contributing
  - Samsung (major contributor)
  - Epic Games (major contributor)
  - OpenRV supporting
  - O3DE Open 3D Engine, interested in adopting, working with JT Nelson
- Commercial Products using OpenAPV
  - Galaxy S26 Ultra/Galaxy Z Fold 8/Vivo X300 Ultra
  - Android 16
  - Exynos 2600/Snapdragon 8 Elit Gen 5
  - DaVinci Resolve 20.2+/Samsung Gallery/LumaFusion/CapCut
  - mpv/PotPlayer
  - ffmpeg has their own implementation, need to check conformance
- Key Achievements in last year
  - v0.2.0.4 (Sept 25,2025) -> v1.1.1.0 (Sept 15, 2026)
    - Support fo APV RAW encoding / decoding (16 bit, 4 channel video)
      - Encoder does not support Bayer image format for input
      - Piecewise linear compressing/expanding is supported by the encoder and decoder
    - Introduction of API sets 1 including support for Tiled Mipmap Video use case for Unreal Engine
      - PBU-based encoding/decoding for flexible/fast processing
    - Introduction of new profiles relaxing the constraint on the number of tiles per frame
      - Previously limited to 64 tiles
      - Must consider requirements of hardware implementers
    - Performance improvement (SIMD optimization)
      - 1.1.2 is now 2x faster for decoding than 1.1.1.0
    - Security patches
      - Fixed 731 security vulnerabilities found by AI agent (internal project at Samsung to audit open source projects we are working on)
        
        Software is now more secure / robust
- Side Activities: ffmpeg
  - Vulkan accelerated encoding/decoding merged (9.0)
  - ffapv - FFmpeg plus up-to-date codec integrations available in ffapv repo
    - If you want to use ffmpeg with integrated APV until everything merged into official ffmpeg
- Next Steps
  - Ready to be an incubation project by next year
  - Since we’ve reached a 1.0 status, everything is stable
  - Sustained interest and contribution, we may propose to move to incubation stage
  - Started looking at OpenSSD badge, working on required improvements
- TAC Open Discussion
  - Carol: great progress in a year! Resolve is a big deal. 730 security vulnerabilities all from internal scans? Or some official CVEs from outside? Youngkwon: can’t disclose which AI engine we used, but just did a code scan which reported 731 vulns. A lot more than we expected! Carol: how did you sort through that? Youngkwon: we also used AI to fix a lot of these! An interesting exercise. Carol: lines up with discussions I’ve had with Larry and Carey. Youngkwon: a good way to get help from AI engine.
  - Carol: anything OpenAPV could use more help from the TAC?
  - Stephen (chat): Complete and total tangential-aside for OpenAPV: Popular tech youtuber “MKBHD” does a weekly podcast with some co-hosts that occasionally entertain with a “trivia” segment. Last-weeks episode had a trivia question for “What does the ‘APV’ acronym stand for?” (a phone being reviewed has the Snapdragon chip with the codec). Great progress, already getting big-name mindshare. Youngkwon: APV is being pushed by Samsung as a new feature.
2026 TAC Priorities #1208
- Carol: what do we want to spend time on the last 3 months of the year
- Priorities Issue
  - Get more traction on the best practices docs
  - More purposeful/intentional engagement of first-time contributors.
  - Project maintainer succession planning
  - Improve and continue to update the dependency matrix spreadsheets.
  - Explore a QT working group.
- Carol: we have made some progress on:
  - More traction on best practices docs: AI, code review, security were done this year
  - Engagement of first time contributors: changes to Dev Days is progress
  - Started updating dependency spreadsheet, now part of annual review, review deck template needs to be finalized
- Other progress
  - AI policies
  - Security vulnerabilities (lots of time which wasn’t planned for)
- But:
  - Project maintainer succession planning: we have not made meaningful progress
    - Kimball (chat): We just convince the project maintainer to retire and keep working full time on the project, right?
  - Do we still need a Qt working group?
- Larry: anything about figuring out the role of the security audit? We did it for a couple of projects, but? Carol: we have it as a separate TAC agenda item. For this year we want projects to self select / volunteer? Larry: landscape has so completely changed, it’s less clear what the role of external auditors is? Carey: we could have had an agenda item about making it through the vulnerapocalypse. For OpenEXR, a team spent months and found 2 issues, the AI agents found dozens. It’s one thing to find flaws in the C code, but what I really wanted was to be told about our process. What are the ways a project can be vulnerable that we’re not aware of. We didn’t really get that. What do professional organizations responsible for bullet proofing their software do that we’re not aware of? Carol: we had talked about putting together a “Security Council”, along the lines of the Security Manager group. Should include folks from member companies who have experience. Carey: things like hardening your CI, GH repo permissions. There are various pieces of infra you can opt into to help, but thinking about the social engineering attacks… Would like to know how to guard against that stuff.
- Michael: there are MCP services like ThreatForge that allows Thread Modelling. We can build projects, but can we moderate an external service to do threat modelling, which does the assessment for us. Carol: maybe a question for the LF team about how their process has changed, they have to stay relevant. We should check in with them.
- Michael: at Adobe we use Agentic Systems for Threat Modelling.
- Carol: an area we need to keep looking in, even though it wasn’t on the January list. Will take that Action Item.
- Carol: there are foundation wide efforts around engagement of first time contributors, TAC may not need to drive that effort. But project maintainer succession is important, what can we do in our projects to allow this.
- Carey: Malory, the prototypical “malicious hacker”, the name to refer to for a malicious actor. If you are trying to break into a system, what better way than sign up for Dev Days, pretend to know nothing, submit a PR that makes a change on the side, adds a new dependency…
- Eric: we should look at getting resources for agentic code reviews. We have this at our company which has been very useful. Can “battle agents with agents”. Something that has domain knowledge really helps. Larry: I’ve made a pitch under the CI WG of making a common agents skill / plugin repo, things that are not specific to a single project, but specific enough to the ASWF, an example would be a checklist expressed as an agent list of everything a project should look at for a review. Carol: JF presented this at last meeting? We agreed it’s a good idea, but struggled to come up with concrete things. JF would talk with others as to what would be useful foundation wide.
- Michael (chat): did we ever get to a “plan for a plan” around MCP services for ASWF and/or projects? Carol: It was a topic last TAC and I think the action item was JF to go investigate and come back to the TAC with more concrete suggestions

Next Meeting Agenda

General Updates
- AGENDA TOPIC: agent skills repo #1467
- AGENDA TOPIC: GitHub Security Manager role #1434
Add Guide #1105
Annual Review: Zero Trust Working Group #621
Annual Review: Open Shading Language #437
Revamp Annual Review Structure/Template #1336
AGENDA TOPIC ASWF Project Health & Resource Framework #1377