Provenance becomes the licence—and contributor identity gets rebuilt.
Open source has not lost to AI; it has been re-licensed by it. The artefact you ship can be word-perfect MIT and still answer none of the questions a serious buyer now asks: where did this code come from, who signed it, what was the training set of the model that wrote half of it. Karan M V has spent a decade inside GitHub watching the centre of gravity drift from the inspection of code to the attestation of its producer. In this conversation he walks the seam where Copilot, sigstore, SBOMs and India's sheer commit volume are quietly rewriting what "open" means.
In sixty seconds.
The licence file is no longer the contract. Provenance is. A buyer that two years ago accepted "this is MIT" now wants a chain of custody — who committed it, which model assisted, what was the training corpus, where the build ran, what signed the binary. Open source did not lose to AI; the trust surface moved.
Karan's claim is that GitHub's actual product in 2026 is not Copilot — it is a coherent stack of identity, attestation, and workflow wrapped around code. Copilot is the surface; SBOMs, sigstore, Actions, Advanced Security and the dependency graph are the load-bearing parts. The pitch to enterprise has quietly become: trust the producer, not the artefact.
And the centre of that producer base is shifting. India is now consistently top-three in commit volume on the platform, and on its current curve will be the largest single contributor cohort on earth before the decade closes. The standards being written about provenance, signing and AI-assisted authorship will be shaped by whoever is doing the writing.
Where to land in the conversation.
Each chapter opens the YouTube video at that timestamp in a new tab.
Five ideas to carry into your own work.
Mental models lifted from the conversation that travel beyond GitHub. Each one is the kind of thing you can quote in an architecture review on Tuesday.
Provenance is the new licence
For two decades, the question for any dependency was: what licence is it under? The answer satisfied both compliance and conscience. In 2026 that question is necessary but not sufficient. The new question is a chain — who authored, what model assisted, where was it built, who signed the artefact. The licence text still matters; it just stopped being the contract.
Attestation beats inspection
Nobody reads the source of their thousandth transitive dependency. The audit model that pretended otherwise was always theatre. Karan's argument is that the next decade is built on cryptographic attestation — sigstore signatures, SLSA build levels, SBOM exports — so the question becomes "do I trust the producer's process" rather than "have I read the producer's code."
Contributor identity: operator plus actor
The old model was one human, one commit, one name. The AI-era model is two actors — a human operator who reviewed, prompted, and committed, and a model agent that drafted. Karan describes GitHub's posture as building the rails for that dual signature without pretending the agent isn't there. The git author field stops being a brag; it becomes a chain of accountability.
Copilot is a workflow, not a product
Treating Copilot as autocomplete misreads what GitHub is shipping. Copilot is now spread across the developer's entire loop — IDE suggestions, chat in pull requests, CLI prompts, Workspace planning, Actions debugging, security autofix. The product is the surface area, not any one feature. Buyers who shop on tab-completion quality are shopping the wrong axis.
India's volume shapes the standard
The country writing the most code is the country whose conventions become defaults. India is consistently top-three in commit volume on GitHub and will be number one before 2030 on current curves. Karan's quieter point is that this changes who is in the room when the next generation of OSS governance, signing standards, and AI authorship norms are negotiated.
Fifteen things to actually walk away with.
Each one carries the timestamps where the moment lives, and a transferable note for work that isn't GitHub.
Open source was not killed by AI. It was re-licensed.
The opening reframe of the conversation. The headline story of 2024 was "will AI eat open source" — agents that generate code on demand, models that swallow entire repos for training, contributors who walk away from unpaid stewardship. Karan agrees the surface looks like that and disagrees with the conclusion. Repos are not declining. Commits are not declining. What has changed is the contract underneath them.
MIT and Apache 2.0 are still load-bearing. They just stopped being sufficient. The question every enterprise legal team is now asking is not "is this OSS" but "where did each line come from, and can you attest to that." The licence is intact. The trust surface above it is being rebuilt.
The legal frame lags the technical frame by years.
Karan is careful here — he is not a lawyer, and he is talking from inside a company that has paid a great deal of attention to the question. His observation is structural: every new AI-related lawsuit is fighting the previous war. NYT v. OpenAI, Anthropic's settlement of the authors' class action, the parallel cases against Stability and Midjourney — these argue about whether training on a corpus is fair use under a framework that was written for a world in which a "copy" was a discrete event with a date.
Meanwhile the EU's AI Act has shipped clauses on training data transparency that European companies are already complying with. The US has none. India has none. The technical frame ships every quarter; the legal frame ships every five years. Builders cannot wait for the lawsuits to resolve.
India is consistently top-three in commit volume — and rising.
The Octoverse data point Karan keeps coming back to. India crossed the US in active contributors in recent reports, sits behind only the US on commit volume (and by some cuts has overtaken), and is projected to be the single largest contributor base on earth by 2028. The growth is not coming from corporate accounts. It is coming from individual developers — students, junior engineers, indie maintainers — using GitHub as their first public footprint.
Karan's framing of why this matters: the standards that get written for OSS provenance, AI authorship and supply-chain attestation will reflect whoever shows up to write them. India has not historically been in those rooms in proportion to its contribution base. That changes in the next standards cycle, or the standards reflect a smaller world than the one they govern.
Copilot has stopped being autocomplete.
The cleanest takedown of how the press still describes the product. Tab-complete was Copilot's 2021 entrypoint. Today Copilot Chat sits in the IDE, in the GitHub web UI, on the CLI, inside pull requests as a reviewer, and in Actions as a build-failure interpreter. Copilot Workspace adds a planning pane — give it an issue, get back a structured edit across files with diffs you approve.
The reframe Karan offers: stop treating Copilot as a feature inside the IDE and start treating it as a workflow across the entire dev loop. The model is the same plumbing; the surfaces are everywhere the developer already goes. The buyer who benchmarks completion quality is solving a 2022 question.
Trust shifts from the artefact to the producer.
The most quotable line in the episode, and the one most worth holding up to the light. For thirty years OSS trust was a property of the artefact — you could read the code, audit the binary, diff the release. That model never scaled past a handful of dependencies, but the fiction held.
Karan's claim is that the fiction broke when the average enterprise app pulled in 1,400 transitive dependencies. Inspection is not a real practice at that scale. What replaces it is producer trust — signed artefacts, verified build environments, attested workflows. You stop asking "is this code safe" and start asking "does this producer's machine produce safe code by construction."
SBOM is no longer a nice-to-have.
Software Bill of Materials — the structured manifest of every component, version and licence in a build — went from "a thing security teams talked about" to "a thing US federal procurement requires" in under three years. The Biden executive order on cybersecurity made it a contracting requirement. The EU's Cyber Resilience Act is making it a sale requirement. The market is converging on SPDX and CycloneDX as the formats.
Karan's point is that the SBOM is the on-ramp for everything downstream — once you have a parseable manifest, you can wire vulnerability scanning, licence checks, attestation and dependency-graph alerts on top of it. GitHub's dependency graph and Dependabot are already that layer for tens of millions of repos. The format mattered less than the habit of producing it.
Sigstore makes cryptographic signing free.
The unglamorous infrastructure story underneath everything else. Sigstore is the Linux Foundation-housed project that gives any OSS maintainer free, keyless cryptographic signing for their releases — using OIDC identity providers to associate a signature with a person without that person managing a long-lived key. npm, PyPI and Maven Central have adopted it. So has the Kubernetes release pipeline. So has GitHub Actions itself.
Karan's framing of why this changed the game: signing was always technically possible and operationally impossible. Key management killed it. Sigstore removed key management as the bottleneck. Once signing is free, the next argument — "did the producer sign this" — becomes a yes/no question that procurement can ask. The economics shifted because the friction shifted.
The training-data licence question stays unresolved.
Karan is direct about what he cannot resolve. Whether training an LLM on a corpus of MIT-licensed code is a derivative work, fair use, both, or neither, is not a question GitHub or any single vendor settles. NYT v. OpenAI is in discovery. Anthropic settled the authors' class action without conceding the legal point. Doe v. GitHub, the original Copilot suit, narrowed dramatically — but it did not produce the precedent the plaintiffs wanted.
His operating posture is to assume the legal frame will eventually catch up and to build the documentation infrastructure that any future regulator will demand. Source attribution. Training data disclosure. Opt-out signals at the repo level. GitHub ships a code-reference feature in Copilot that flags suggestions matching public code; that is not legal protection but it is the kind of evidence a reasonable regulator will require.
Contributor incentives are shifting under maintainers.
The honest part of the conversation. A maintainer who spent a decade building a Python library now finds that 30% of inbound PRs are AI-drafted, that a coding agent has been trained on her code, and that the marginal user of her work may not be a human at all. The incentive question — why do this for free — gets sharper.
Karan's view is that this surfaces what was always true: most maintainers were never paid in money; they were paid in identity, reputation, and the satisfaction of having their work used well. AI does not remove those payments; it scrambles them. The maintainer's name is no longer the only name attached to her code. The downstream user may never know whose work they're consuming. The new contracts — GitHub Sponsors, Tidelift, the Sovereign Tech Fund — try to put a money floor under work that the attention economy no longer pays for.
Enterprise security is now an IDE feature.
GitHub Advanced Security used to be a separate product reviewed by a separate team after the code was written. The 2024-26 shift is that the same scanning, secret-detection and dependency-vulnerability analysis now runs inside the editor, in the PR, and in chat — with Copilot autofix offering suggested patches in line. The security review is no longer a gate; it is a continuous overlay.
The structural point Karan makes is that this changes who security work belongs to. When the finding shows up in your IDE with a one-click fix, you fix it. When it shows up as a Jira ticket assigned to the AppSec team three weeks after merge, nobody fixes it. The location of the finding determines its remediation rate.
Copilot Workspace closes the full dev loop.
The product Karan describes with the most energy. Workspace takes a GitHub issue as input, produces a plan — a structured description of what files to change and why — and then proposes diffs across the whole repo. The developer's job becomes reviewing the plan and the diffs, not typing the code. Build, test, and PR creation are wrapped into the same loop.
This is the productisation of agentic coding inside a workflow developers already use. The wider field has shipped impressive demos — Devin, SWE-agent, Codex CLI — but most live outside the developer's existing tools. Workspace's bet is that the loop wins, not the agent. The agent that is one click away from the issue tracker beats the agent that is a separate web app.
The Octoverse is a signal worth reading carefully.
GitHub's annual Octoverse report — the language rankings, contributor numbers, geographic distribution — is not a marketing artefact in Karan's framing. It is the highest-resolution view of where global software work is actually happening, because GitHub captures the activity that other surveys ask people to self-report on.
The findings he flags: TypeScript displaced Java in 2024. Python kept climbing on the back of AI workloads. Rust grew faster than any other language two years in a row but is still small in absolute terms. Generative-AI repos roughly tripled year on year. And India's contributor count grew faster than any major country. The aggregate picture is that the centre of gravity in software has moved twice — toward AI workloads and toward South Asia — in the same five-year window.
SLSA gives "trustworthy build" a number.
SLSA — Supply-chain Levels for Software Artefacts — is the framework Karan keeps mentioning when he talks about how producer trust gets measured. It is a graded scheme: Level 1 means the build produces provenance metadata. Level 2 adds an authenticated source. Level 3 requires a hardened, isolated build environment. Level 4 requires two-person review and hermetic builds.
The reason it matters in 2026 is that procurement teams now have a number to ask for. "We require SLSA Level 3" is a real contract clause. GitHub Actions, with the Reusable Workflows pattern and OIDC-based deployments, can be configured to hit Level 3 with deliberate effort. The framework gave the conversation a vocabulary.
Open source's governance layer is being tested.
The xz backdoor of 2024, in which a long-game attacker spent three years building maintainer trust to land a near-undetected supply-chain compromise, is the cautionary tale that sits behind everything Karan says about provenance and producer trust. The licence on xz was fine. The code review was light because there was one overworked maintainer. The attacker exploited the social layer, not the technical layer.
The lesson Karan extracts is not "more code review." It is that the governance layer of OSS — who can land what, how maintainers are vetted, what backup exists when a single maintainer is the choke point — is now the load-bearing thing. The Linux Foundation, the OpenSSF, and projects like Scorecards are trying to formalise what was previously informal trust.
The agent is not the moat. The repo is.
The closing reframe of the conversation. Every well-funded AI lab now ships a coding agent. The differentiation between them is real but narrow. What is not narrow is the data they are wired into — the issues, PRs, commit history, code reviews, CI runs, and dependency graph that sit in a real engineering organisation. The agent that has read your repo's last five years of decisions is a different product from the agent that read your last file.
Karan's framing is that GitHub's defensive line is exactly this: the agents will commoditise; the context will not. The repo is the moat. The same logic — context beats raw model — is playing out in legal, finance, and design tooling. The category leader in agent surfaces is going to be the platform that already owned the context.
Lines worth keeping near your desk.
The jargon, unpacked.
Some of these will be obvious; some won't. Skim, mark the unfamiliar, come back later.
Check what you actually retained.
Try to answer before you click. The point is to notice where the conversation is fuzzy in your memory, then return to the transcript.
Five questions worth sitting with.
No correct answers. Type into the boxes — your responses are saved locally and exportable along with your notes.
If provenance is replacing the licence as the trust contract, what does your team need to start emitting from its own builds — and how would a buyer ask for it?
Karan distinguishes Copilot as a workflow from Copilot as a feature. Where in your own stack are you mis-evaluating an AI tool by benchmarking one surface instead of the whole loop?
The xz backdoor exploited the social layer of OSS, not the technical one. Which of your dependencies have a single overworked maintainer, and what is your contingency if that person disappears?
Standards reflect whoever shows up to write them. In which technical standards body or governance forum is your team's contribution base unrepresented — and what is the cost of staying out of the room?
If models commoditise and context becomes the moat, what context does your product own that an AI-first competitor would have to spend years to assemble?
Where to push back.
The strongest version of each disagreement, written to be persuasive — not to win.
"AI ends open source."
The push: this conflates the artefact with the practice. Models trained today on yesterday's OSS still need fresh code to learn current frameworks, idioms, and standards. The maintainers who matter most — the ones with judgment, taste, and current context — are exactly the ones an agent cannot replace. What weakens is the long tail of small libraries; what strengthens is the foundational packages whose maintainers can now ship faster with AI assistance. The category does not die. Its shape changes.
"Copilot is just autocomplete with better marketing."
The push: the steelman is correct in 2022 and increasingly wrong from 2024 onwards. Copilot Workspace producing whole-repo diffs from an issue is qualitatively different from completion. Security autofix proposing patches inline changes who does security work. The reason the autocomplete framing persists is that it is true of the entry-level tier; the upper tiers do something different and are easier to mis-read as "the same thing, scaled."
"Hyperscalers and OEMs will replicate this directly."
The push: the moat is the repo, not the code-completion model. A coding assistant wired into your AWS console without your repo's context is solving a different problem. The reason competitors keep failing to replicate GitHub is that they ship the agent without the substrate. Replicating the substrate — five years of issues, PRs, reviews, and CI runs across hundreds of millions of repos — is not a feature decision; it is the entire reason GitHub was bought for $7.5B in 2018, and the price would be higher today.
"Provenance is solving a problem that doesn't exist."
The push: this was true until xz, until SolarWinds, until Log4Shell. Each of those produced regulation that does not get repealed when the news cycle moves on. The compliance overhead is real and the buyer's appetite for it is also real. Calling it theatre is accurate the way calling airline security theatre is accurate — partly correct, and operationally irrelevant because the requirement is now in the contract whether or not it is well-designed.
Three angles on Monday morning.
If you don't work at GitHub, here's what to take.
If you're an engineering leader
- Audit your build pipeline against SLSA. Decide which level you actually need, and what configuring Actions or your CI to hit it costs you.
- Turn on SBOM generation everywhere you ship a binary. The cost is near-zero; the procurement upside in 18 months is real.
- Move security findings into the IDE and the PR. Anywhere a vulnerability surfaces post-merge, treat the placement as the bug.
- Stop benchmarking AI tools on completion quality alone. Run a workflow benchmark — issue to merged PR — across realistic tasks.
- Map your single-maintainer dependencies. Have a plan for each one before the next xz.
If you're a legal or compliance lead
- Build the documentation infrastructure the strictest plausible regulator will eventually demand. Training-data disclosure, source attribution, opt-out signals — emit them now.
- Treat the licence audit as necessary but no longer sufficient. Add a provenance layer to your acceptance criteria.
- Watch the EU AI Act implementation. It is the closest thing to a global precedent; companies serving Europe will set the global floor.
- For AI-assisted code, demand the chain — model used, suggestion accepted, reviewer who merged. The audit trail is the hedge against legal ambiguity.
If you're a developer or maintainer
- Sign your releases. Sigstore made it free; not signing is now a choice, not a constraint.
- Treat Copilot as a workflow tool, not an autocomplete. Spend a week using it in PR review and CLI before deciding what it is.
- If you maintain a library that AI tools are training on, document your provenance. It is the only honest answer to the user who asks "where did this come from."
- Consider the GitHub Sponsors / Tidelift / Sovereign Tech Fund options seriously. The non-monetary payment that used to sustain OSS work is weakening; a money floor is now necessary, not awkward.
- Read the Octoverse report. The geographic and language shifts it captures are a leading indicator of where work is going.
Two decades of GitHub, briefly.
The arc Karan sketches in the conversation, lined up.
The whole conversation, searchable.
Click a timestamp to open YouTube at that moment. Click any line to highlight it (yellow). Highlights and notes save in this browser only.
00:00 in the page to seek.SEGMENTS array in the inline script below will populate this panel. Until then, use the chapter map above to jump into the video; timestamps throughout this page already deep-link into YouTube. Auto-captions occasionally mis-hear names — expect "Karan" rendered as "Karen" and product names like "Copilot" occasionally split across segments.