Academy Software Foundation Technical Advisory Council (TAC) Meeting - October 28, 2026

Join the meeting at https://zoom-lfx.platform.linuxfoundation.org/meetings/aswf?view=list&projects=aswf

Voting Representative Attendees

Premier Member Representatives

Project Representatives

Carol Payne - OpenColorIO Representative
Cary Phillips - OpenEXR Representative
Chris Kulla - Open Shading Language Representative
Daniel Greenstein - OpenImageIO Representative
Diego Tavares Da Silva - OpenCue Representative
Jonathan Stone - MaterialX Representative
Karen Ruggles - Diversity & Inclusion Working Group Representative
Ken Museth - OpenVDB Representative
Nick Porcino - Universal Scene Description Working Group Representative

Industry Representatives

Jean-Francois Panisset - Visual Effects Society

Non-Voting Attendees

Non-Voting Project and Working Group Representatives

LF Staff

David Morin - Individual - No Account
Emily Olin - Academy Software Foundation
John Mertic - The Linux Foundation
Yarille Ortiz - The Linux Foundation

Other Attendees

Doug Walker - Autodesk / OCIO
Jonathan Swartz - NVIDIA / OpenVDB
JT Nelson - Pasadena Open Source consortium / SoCal Blender group
Pierre Jasmon - RevisionFX / OpenFX
Randy Packer - Dreamworks / Moonray
Bill Ballew - Dreamworks
Jim Helman - MovieLabs / Zero Trust Working Group
Andrew Pearce - Dreamworks

Meeting Assets

Antitrust Policy Notice

Linux Foundation meetings involve participation by industry competitors, and it is the intention of the Linux Foundation to conduct all of its activities in accordance with applicable antitrust and competition laws. It is therefore extremely important that attendees adhere to meeting agendas, and be aware of, and not participate in, any activities that are prohibited under applicable US state, federal or foreign antitrust and competition laws.

Examples of types of actions that are prohibited at Linux Foundation meetings and in connection with Linux Foundation activities are described in the Linux Foundation Antitrust Policy available at linuxfoundation.org/antitrust-policy. If you have questions about these matters, please contact your company counsel, or if you are a member of the Linux Foundation, feel free to contact Andrew Updegrove of the firm of Gesmer Updegrove LLP, which provides legal counsel to the Linux Foundation.

Agenda

General Updates
Annual Review: Open Shading Language #437
Annual Review: Zero Trust Working Group #621

Notes

General Updates
- Emily: Open Source Forum call for participation is coming up.
- Larry: what about Virtual Town Halls? Emily: for now they are all on the ASWF web site, but moving to Youtube soon.
Annual Review: Open Shading Language #437
- Chris Kulla
- Presentation Slides
- What is OSL?
  - Shading language for modern production renderers
  - A compiler and efficient runtime for the language
  - Levarages LLVM for execution on CPU and GPU
  - Project just turned 18 years old (first commit Sept 3, 2008)
  - ASWF member since 2020
  - Software supporting OSL:
    - 3DS MAX, Arnold, Cycle, 3delight, Renderman, V-Ray, Octane, Redshift
    - Studio renderers
      - Glimpse, Arnold, Illumination films
- Ties to other ASWF projects:
  - Dependencies
    - OIIO, OCIO, OpenEXR, OpenVDB
    - …
- What is different about OSL
  - Shaders can be assembled into networks
    - Networks are evaluated lazily (unused sections are not evaluated)
  - Entire graph is runtime optimized
    - Works across nodes in the shading graph
    - Scales to very large production shaders that have lots of features
    - Optimizer can remove 98% of instructions in such cases
  - Automatic Differentiation for filtering and bump mapping
  - Shaders return clostures instead of colors
    - Renderer decides how to integrate the lighting
    - Complex layering can be achieved by building closure trees
- OSL TSC
  - Chris Kulla, Epic Games (TSC Chair)
  - Larry Gritz, Imageworks (Chief Architect)
  - …
- Code contributors since last year
  - Imageworks, NVIDIA, smaller contributors, build fixes
  - New contributors from Dev Days, some have been hired by Imageworks
- Recent Development Highlights
  - BSDL: implementation of production BSDF code from Imageworks (Alejandro Conty)
  - More enhancements of GPU / OptiX back end (Tim Grant)
  - Prototype “C++” back end (Larry Gritz)
    - Turn OSL shaders back into C++ code, useful debugging tool
    - Use to support other C/C++ languages
  - Volume rendering in testrender (Owner O’Malley)
    - Useful for unit tests
  - Ray Tracing in One Weekend - with OSL shading (Jinnie Kim)
- Work in Progress
  - OSL 1.16 release imminent!
  - BSDL splitting into separate repo
    - Header only library, lighter dependency
  - OIIO-compatible GPU/OptiX texture engine (SPI)
    - Have long had CPU solution
  - AMD GPU back end (AMD)
  - Alternate shading back end research (Luca Fascione, NVIDIA)
- Dev Days
  - Participated in May & Sept 2026 Dev Days
  - One merged PR each time
  - Reasons why it’s hard for this project
    - Tricky to find good first issues
    - C++, LLVM & compiler tech, GPU, rendering -> most parts of OSL require lots of specialized knowledge
    - Lack of developer bandwidth to attract new contributors
    - Not good excuses, hopefully can do better
- Security
  - Haven’t had any problems yet
  - Are we too obscure to attract attention? Similar to issue with lack of “good first issues”. Just building the project is tricky.
  - Doesn’t mean our project is immune from security issues. We’re a compiler which executes arbitrary code on your device… We struggle with what security vulnerabilities. Our language is limited and sandboxed, but we don’t prevent you from running an infinite loop which could hang your rendering process
- Code Generation Policy
  - LLM coding assistants are permitted, with rules:
    - Human must always be in the loop and is the responsible party
    - Interact with the project and community yourself, not by agent
    - Disclose tools use: Assisted-by: TOOL / MODEL
    - Don’t waste maintainer time with low quality PRs
    - Don’t stomp on Dev Days or Good First Issues
    - Exempt: spell/grammar check, LLMs to teach / explain, audit for bugs, language translations, self-review prior to PR, trivial refactors
- How to get involved
  - TSC meetings every other Thursday at 2PM Pacific
  - Slack Channel
  - Github
- Q&A
  - Carol: anything the TAC can do to help? Larry: we get great support, CI infrastructure has been critical to the project. We have close connections with other projects, including shared people across TSCs, shared dependencies, we’re close to these other groups which serves us well. Only slide I can ask is film credits / who is using OSL on what films, this was easy in early days when it was only a few proprietary studio renderers, harder to track now.
  - Chris: we had a TSC member from Intel, would be interesting if there was someone from Intel? Larry: the other Intel contributor was laid off, so that work has been inherited by me and Pixar. Renderman was the main user of that feature. It’s kind of working, but when a new version of LLVM comes out, it can break things when they change their API. So ongoing maintenance work. Eric: was really being pushed forward before? Chris: some of the work Intel was doing infused into other parts of the code, they were valuable contributors, and had future plans.
  - JF could use ci-osl containers to help bootstrap Dev Days participants
Annual Review: Zero Trust Working Group #621
- Daryll Strauss
- Going for a bit more than a year, talking about ramping it down.
- Original proposal: the idea of putting up a firewall outside the perimeter is no longer sufficient, wanted to encourage people to move to Zero Trust. Identify user and service, they have to authenticate to each other. A Discussion Group to discuss what that looks like inside studios and vendors, and how to help ASWF projects move to Zero Trust model.
- Goals
  - Assist community members in becoming aware of the use of zero trust security models…
- Achievements
  - Discussions with studios, software companies, and vendors about zero trust architectures and why they are important to our industry
  - Examined existing Zero Trust Networking solutions for legacy systems
  - Deep dive on SSO as a first step
- Problem Identification
  - ASWF applications will have increasing networking needs
  - AI services will increase the demand
  - API keys are not a good security solution
  - OIDC is best practice, but the flow is difficult to implement correctly particularly for plugins
  - Rendering has unique needs for handling identity: user isn’t present at terminal, need to store and retrieve credentials
  - Studios staring to see this issue for plugins and applications but early need, an upcoming problem
  - Jim: you’re not dealing with a single browser with a shared store, different panels in different DCCs, wanted to avoid requiring artists to login multiple times
  - Daryll: DCC vendors already do their own version of that
- Proposed Solution: Proxy Identity Server
  - Allow the user to log in once on their desktop and have a local server relay the verifiable user identity to applications that need it
  - Well received by software vendors
  - Well received by studios
  - We built a POC with a mock backend
  - Requires a change to the backend to exchange identity token for access token
- Chicken or the egg: a two sided market
  - The identity server isn’t useful to the studio if no backends support it
  - It’s not worth it for the software vendors to implement the backend without the server
- Conclusion
  - TIme to shutdown the working group
  - The discussion were useful to the participants
  - Our proxy identity server seems feasible but was premature
  - The papers…
  - Jim: need for ASWF tools to be cloud / external network savy. But a lot of facilities are still using services within trusted perimeter network, so may not need zero trust solutions yet. That’s why we did trial with Software Defined Networking solutions. But the premise that Zero Trust will need to become pervasive in ASWF or CLI tools to make them able to access object storage without an API key isn’t happening yet. Maybe it won’t through solutions like FUSE pseudo filesystems. Interesting experiment, maybe a bit before its time. After the Proxy Identity Server we’ve decided not to build a “better prototype” until someone is ready to POC it. No one expressed short term interest to implement it.
- Q&A
  - Kimball: as a maintainer of OpenEXR, it provides a plugable file I/O system, so it could provide direct object store access, did you guys developer recommendations, is S3 enough of an answer, or need to look at other object store providers? Jim: there are different S3 flavors, especially with security. Daryll: Amazon is the “de facto” standard, but there are many variations, and it still assumes you have a key. Short term sessions are a better solution. In our forum we’re forcing vendors to use short term session tokens, how long the token is good for. For a software implementation, S3 is your object storage in most cases, there are several ways to manage credentials and there are existing toolkits, so we don’t have a specific recommendation. Use OAuth / OIDC… Kimball: OpenEXR wouldn’t implement that. Daryll: but if you are talking to S3, you still need to deal with authentication… but no way to reach out to a web browser to authenticate that calls back into your app. Kimball: main application has to do that, can provide auth key to plugin? Daryll: that’s why we had the Proxy Identity Server design, but you have to ask it for the token.
  - Jim: maybe we didn’t do enough outreach to other groups, for instance is OpenEXR case worth pursuing. Other CLI tools have same issues (like OIIO).
  - Eric: is this a problem we can solve in our industry, or a cross industry approach, AI providers, storage providers? Daryll: we see it more than other orgs because of the variety of apps we use. Amazon built a backend that does this identity exchange, we could have used their backend, it’s a problem that other people see, but there doesn’t seem to be a good solution.
  - Michael: is it a chicken / egg / nest problem? There are MPA audits who enforce whether something is air gapped or not? Have you talked to MPA at a certification level / policy level, not just technology. Jim: we work closely with MPA / TPM, encourage to develop Zero Trust controls. Agentic AI is a whole other consideration. From MovieLabs 2030 vision, we believe there is a way with zero trust to have secure workflows without an air gap. Some studios may want to go further than that. Daryll: TPN are evaluated the facilities, but they move somewhat slowly. Jim: still up to studio / production to set policies, we want to make the ability to use remote services / teams as secure as possible so studio productions are more comfortable using these, “don’t have 5 copies of every file”. TPN will have controls around that, but up to production if they are going to ask for air gapped requirements.
  - Mark: working at a place that does zero trust for all tech employees, before we used a VPN, now we don’t, everything is zero trust. Different helper technologies for ssh for instance, proxied through something on local machine, managed through corporate IT. Daryll: similar problem, but with a different solution. Mark: how do you get provenance around AI agent usage, how do you track actions by an agent vs a human, how do you auth humans vs agents differently, those are the next challenges. Jim: need provenance not just for security, but also know what model / who did what to what, track the full genealogy. We have another project at MovieLabs to look at different systems we’re looking at. Daryll: a lot of discussion around security for agentic workflows. The current models are not right, it’s a huge issue. Jim: zero trust is a starting point, but definitely not sufficient.
  - Mark: in Deadline Cloud, our service connects to AWS Identity Center which you can connect to an external IdP. All our plugins into DCCs need to be able to submit using those identities, using the AWS identities / short term keys. We have a desktop app installed based on a TORI (?) Rust framework which creates an AWS profile which the plugins can get their credentials from. It updates with IdP. There are lots of ways you can slice this, that’s what we came up. Daryll: AWS has mechanism to turn identity back into access credentials.
  - Jim: we’re surprised with level of interest, we were thinking about shutting down, but maybe not? Kimball: maybe hand over Proxy Identity Server to Wayland group? If we’re making a new desktop, there may be some synergy there. Carol: ASWF is a great place to host these industry related discussions, we could try to force it, but with open source, priorities from the industry drives effort. Daryll: so keep the archive up? Carol: we don’t have to make decision today, if you want to follow up with people who have spoken up, it would be fair, we don’t have to make decision today.
  - Larry: to what extent you think you had the right set of people in the room? ASWF may be the right place to do this since all the member companies are here, but maybe the people on the TAC are the right representatives from those companies who have the right expertise. Maybe one round of trying to reach into our orgs to find the folks who have this as a job. Daryll: fair enough, takes resources to do the engineering. Jim: should we give it a few more months, get back in Q1 to the TAC, in the meantime try to reach out? For those who have spoken, if you can point us to people in your projects / orgs. We had good participation from Adobe, Autodesk, Paramount, Disney Animation, Dreamworks. If people are willing to put in some effort before we pull the plug, doesn’t hurt to go for a few months.
  - Carol: that seems perfectly fine. People on the TAC may not be the right people to talk to. Maybe post to the TAC channel about the folks you are looking for so TAC members can try to find the right people in your companies, do our due dilligence.

Next Meeting Agenda

General Updates
- AGENDA TOPIC: agent skills repo #1467
- AGENDA TOPIC: GitHub Security Manager role #1434
Add Guide #1105
Annual Review: OpenTimelineIO #477
Annual Review: Dailies Notes Assistant (DNA) #1040
AGENDA TOPIC ASWF Project Health & Resource Framework #1377