Two LF Decentralized Trust (LFDT) communities—the ToIP / DIF Decentralized Trust Graph Working Group (DTGWG) and OpenVTC, an LFDT lab—reached a major milestone at the Linux Plumbers Conference and LF Open Source Summit EU in Prague last week: demonstrating the first verifiable trust community (VTC) for open source projects.
Eighteen months ago, at the Linux Foundation Member Summit in Napa, LF CEO Jim Zemlin challenged LFDT members to develop a way to protect open source projects from two growing dangers: malware injection attacks and the onslaught of AI-generated pull requests. He explained that existing solutions, such as the PGP/GPG web of trust used by the Linux kernel project, were no longer up to the task because they are too slow, too hard to use, and too difficult to scale.
LFDT members responded with a new trust model called a decentralized trust graph (DTG). The heart of the DTG model is the VTC, which can represent a group of any size or type, from a nuclear family to a corporation. VTCs are a perfect fit for open source projects because both the VTC and each member of the community has an independent trust agent—a “digital twin” that stores the community's and member’s keys respectively, DIDs, and credentials and speaks standard DTG protocols called trust tasks.
The open standards for DTG trust tasks are defined by the DTGWG (Decentralized Trust Graph Working Group). In addition to setting up a VTC, the core trust tasks include issuing, storing, exchanging, and presenting digitally signed verifiable credentials representing real-world trust relationships. Three credentials define the decentralized trust graph itself:
- Verifiable relationship credentials (VRCs) are exchanged peer to peer between community members, such as project maintainers who have met face to face. For example, the Linux kernel web of trust currently requires a new maintainer to have their GPG keys signed by two other maintainers. This can now be accomplished with a VRC exchange as easily as scanning a QR code.
- Verifiable membership credentials (VMCs) are issued by the VTC to individuals who meet the membership policies defined by the community. For example, once a new contributor can present the two VRCs required to join the Linux kernel community, the kernel VTC can automatically issue the VMC.
- Verifiable delegation credentials (VDCs) enable machine-verifiable delegation relationships. VDCs are how an AI agent can prove that it is acting on behalf of a human—for example, when making a PR on behalf of a contributor.
OpenVTC lead maintainer Glenn Gore, CEO of Affinidi, demonstrated each of these as he showed how to set up a new VTC for an example open source project.
Every VTC can define its own membership and other governance policies in Rego, the declarative language used by Open Policy Agent (OPA), the open source general-purpose policy engine developed at the LF Cloud Native Computing Foundation. Glenn used the OpenVTC CLI to show examples of Rego policies applicable to the Linux kernel community, for example appointing vetters to check the government-issued credentials of new contributors.
Brendan Miller and Alberto Leon of the Harvard Applied Technology Lab then showed how their open source Keyring mobile app could be used with OpenVTC to streamline the entire process of appointing and approving a vetter—and the vetter vetting a new contributor.
The value of VTCs does not stop at ensuring the integrity of an open source community. Trust agents can perform many other useful trust tasks for developers and maintainers. Glenn concluded the demo with an example of automated repo management. From a contributor’s standpoint, their trust agent can automatically configure their account for a new project on their choice of host (git, GitHub, GitLab, etc.) and then automatically submit signed PRs. From the maintainer’s standpoint, the VTC trust agent can verify that a PR was submitted by a verified community member—or an AI agent verifiably delegated by that member—or else the PR can be automatically closed without bothering the maintainer.
The demo was enthusiastically received by both Linux Plumbers and OSS EU attendees—some of whom want to put OpenVTC to work on their project right away. That only adds to the motivation for both the DTGWG and OpenVTC to complete the work required to implement Jim Zemlin’s vision of a fully verifiable trust network (VTN) that can work across LF projects—and in fact across all open source projects following the DTG open standards.
To learn more about the demo, the decentralized trust graph, and OpenVTC, see the following sites: