0.8 yocto-project-summit-2025-12 2025-12-02 2025-12-04 3 00:05 https://pretalx.com UTC Walnascar Lightning Talk 2025-12-02T12:00:00+00:00 12:00 00:15 Welcome - Day 1 yocto-project-summit-2025-12-83620-welcome-day-1 All Attendees Josef Holzmayr en Welcome - Day 1 false Slides https://pretalx.com/yocto-project-summit-2025-12/talk/RHELPK/ https://pretalx.com/yocto-project-summit-2025-12/talk/RHELPK/feedback/ Walnascar Talk 2025-12-02T12:15:00+00:00 12:15 01:30 This seminar is for people who are new to using the Yocto Project and want an introduction to the basics of how to use bitbake and start to build images to be used with QEMU. yocto-project-summit-2025-12-83632-introduction-to-the-yocto-project-and-bitbake Beginner track Behan Webster en This talk will be the first of a series of 2 seminars which will cover the topics of: * Bitbake * Recipes * Tasks * Operators * Common variables * What to do when things go wrong * Building an embedded image false Beginning Class Slides (PowerPoint) Beginning Class Slides (PDF) https://pretalx.com/yocto-project-summit-2025-12/talk/TDSBE7/ https://pretalx.com/yocto-project-summit-2025-12/talk/TDSBE7/feedback/ Walnascar Talk 2025-12-02T14:00:00+00:00 14:00 01:30 This seminar is for people who are new to using the Yocto Project and want an introduction to the basics of layers, building images, and other initial topics yocto-project-summit-2025-12-83633-introduction-to-layers-images-and-more Beginner track Tom King en This talk will be the second of a series of 2 seminars which will cover the topics of: * Introduction to layers * What's in each of the provided layers * Booting your image with QEMU * Board support packages * Images * Toaster * Building an application false https://pretalx.com/yocto-project-summit-2025-12/talk/3ZUTZU/ https://pretalx.com/yocto-project-summit-2025-12/talk/3ZUTZU/feedback/ Walnascar Talk 2025-12-02T15:40:00+00:00 15:40 00:30 We are happy to announce the first release of a brand new open-source project: **sbom-cve-check**, a lightweight CVE analysis tool for your Software Bill of Materials (SBOM). Written in Python, with minimal dependencies and a very simple workflow in mind, **sbom-cve-check** will parse your SBOM (SPDX v2.2 or SPDX v3.0 currently supported), and using publicly available databases of security vulnerabilities, will generate a report of known security vulnerabilities affecting the software components listed in your SBOM. yocto-project-summit-2025-12-84219-sbom-cve-check-lightweight-python-tooling-for-out-of-build-cve-analysis-of-spdx3-sboms Intermediate Track / Presentation Olivier BenjaminBenjamin Robin en **sbom-cve-check** was conceived to help produce artifacts necessary in vulnerability assessment which will be a periodic action for CRA compliance. Developers, integrators and manufacturers will need to archive the SBOM as part of a release, and regularly conduct automated vulnerability reporting. Yocto today is able to generate the SBOM for its builds, and can also do CVE analysis. Our main problem was that this capability is intricately tied to the build, and cannot be replicated based on only the SBOM: one must rerun the whole build. We present sbom-cve-check: a new tool to conduct automated vulnerability analysis based on the SBOM, without rebuild, and relying on the open SPDX3 standard. **sbom-cve-check** aims at being an efficient replacement for the cve-check logic currently available in Yocto. It pulls from several databases, including NVD and CVE List, and supports multiple annotation formats, such as Open VEX and Yocto's custom format. sbom-cve-check currently supports the following export formats: SPDX3, CSV and Yocto's cve-check output format. The tool is provided under the GPLv2 license, and contributions are of course welcome :). false sbom-cve-check presentation https://pretalx.com/yocto-project-summit-2025-12/talk/WNE7XA/ https://pretalx.com/yocto-project-summit-2025-12/talk/WNE7XA/feedback/ Walnascar Talk 2025-12-02T16:30:00+00:00 16:30 00:30 After a few months of using Cursor AI backed by claude-4-sonnet in agentic mode on Yocto / OpenEmbedded development, I want to share the genuine productivity transformations I've experienced, and the critical lessons about where it goes wrong. I'll show you how AI helped me remote into target hardware via SSH, capture webcam images of running code, analyse the output, and iterate until our e-ink display worked correctly. I'll demonstrate automated power consumption monitoring feeding back into BSP optimisation workflows. I'll also share the gotchas: when AI creates overly complex solutions, goes down rabbit holes, and happily does the nonsensical things if you ask it to. The key insight? You need feedback loops, you need experience, and you need to stay in control, I'm hoping to begin a conversation with the community about how we build best practice to leverage AI pair programming in future. yocto-project-summit-2025-12-82336-agentic-llms-as-your-pair-programming-partner-lessons-from-recent-cursor-assisted-yocto-development Intermediate Track / Presentation /media/yocto-project-summit-2025-12/submissions/3KKPQM/OE_AI__1EWcrY9.webp Alex Lennon en # The Productivity Revolution Here's what using "AI" - by which I mean Cursor backed by claude-4-sonnet in agentic mode - has genuinely transformed in my workflow: ## Research and Problem-Solving AI searches multiple sources, combines results, and presents options orders of magnitude faster than I can Google. I'm constantly learning new approaches to problems I thought I understood. ## Tool Mastery AI knows ways to use tools I've used for years that I never discovered. It analyses code-bases faster than I can grep, and interrogates command-line tools to understand their operation in real-time. ## Automation Everything Setting up repositories, managing commits, creating CI workflows, generating documentation - AI can automate these tasks by actually running the commands and learning from the output. # Real Examples That Matter ## E-ink Display Debugging I asked AI to SSH into our target board, capture webcam images of the code running on our controller chip, analyse what was displayed, identify mistakes, and iterate until the e-ink display showed correctly. This normally takes days - we did it in hours. ## Automated Power Optimisation We're now automating access to test equipment in our remote hardware lab. AI monitors power consumption as we make BSP changes, takes automated readings, and feeds results back into the optimization process for better battery life. # The Critical Gotchas - Content Overload: AI creates far too much content and makes things unnecessarily complex - Rabbit Holes: It gets confused and can chase irrelevant solutions - Happy Compliance: Ask it to do something nonsensical and it will absolutely do it - Tracking Management: You need to keep it focused on what you actually need to achieve # The Essential Insight This only works because I stay in control. AI is incredibly powerful, but you need: - Your experience to know what questions to ask - Feedback loops like CI testing and target board validation - Constant course correction to prevent hallucinations # Community Discussion How do we share these techniques? What feedback loops work best? How do we prevent AI from creating technical debt while harnessing its genuine productivity gains? I've got real examples to share, but I want to hear what's working for others. false Presentation (Google Slides Link) Presentation (PDF) https://pretalx.com/yocto-project-summit-2025-12/talk/3KKPQM/ https://pretalx.com/yocto-project-summit-2025-12/talk/3KKPQM/feedback/ Walnascar Lightning Talk 2025-12-02T17:00:00+00:00 17:00 00:15 Handling the complexity of automotive software projects with Openembedded/Yocto is very challenging. Contributing factors to this include the complex automotive SoCs in general and of course the vendor-supplied BSPs with many meta-layers. They include multiple image and distro variants, as well as specific machine configurations for the hardware and the emulation. On top of that the project developers put on top of that the project specific layers, build variants and configurations. To handle that in automotive projects, a standardized way is required to deal with all of this complexity without developing something new. In our case KAS was adopted as the best solution, that fulfilled all the requirements on such a tool. The talk will highlight the general idea of KAS and the problem it solves within Openembedded/Yocto projects. After explaining how to set up KAS projects the next step is an overview of how it is used in our automotive project will be given. It will be highlighted how we manage multiple layers, different machines, images and distros to build different targets with the help of KAS. Afterwards, it will be shown how it enabled our project to have a standardized way for developers and the CI to trigger builds with specific configurations easily. At the end of the talk the key reasons to use KAS will be summarized and an outlook will be given onthe development that is currently happening with bitbake-setup. yocto-project-summit-2025-12-82186-kas-in-automotive-projects Intermediate Track / Presentation Michael Estner en Handling the complexity of automotive software projects with Openembedded/Yocto is very challenging. Contributing factors to this include the complex automotive SoCs in general and of course the vendor-supplied BSPs with many meta-layers. They include multiple image and distro variants, as well as specific machine configurations for the hardware and the emulation. On top of that the project developers put on top of that the project specific layers, build variants and configurations. To handle that in automotive projects, a standardized way is required to deal with all of this complexity without developing something new. In our case KAS was adopted as the best solution, that fulfilled all the requirements on such a tool. The talk will highlight the general idea of KAS and the problem it solves within Openembedded/Yocto projects. After explaining how to set up KAS projects the next step is an overview of how it is used in our automotive project will be given. It will be highlighted how we manage multiple layers, different machines, images and distros to build different targets with the help of KAS. Afterwards, it will be shown how it enabled our project to have a standardized way for developers and the CI to trigger builds with specific configurations easily. At the end of the talk the key reasons to use KAS will be summarized and an outlook will be given onthe development that is currently happening with bitbake-setup. false Slides: KAS in automotive projects https://pretalx.com/yocto-project-summit-2025-12/talk/X9VJYK/ https://pretalx.com/yocto-project-summit-2025-12/talk/X9VJYK/feedback/ Walnascar Talk 2025-12-02T17:20:00+00:00 17:20 00:30 This talk explains how STM32MP BSP Layer is developed and organized. yocto-project-summit-2025-12-81805-yocto-bsp-with-stm32mp Intermediate Track / Presentation Talel BELHAJSALEM en The community finds the STMP32MP Yocto BSP Layer is quite complicated, and it is quite difficult to developed a new machine based on ST machine configuration. The aim of this talk is to give a BSP implementation example, as well as how ST abstracts key BitBake BSP variables and uses advanced development techniques to support their boards in a generic way. Talking about STM32MP, STM32MP2 specifically, also means talking about ARM Trust Boot and firmware update and how ST handles that in Yocto. false Yocto BSP with STM32MP https://pretalx.com/yocto-project-summit-2025-12/talk/3Z9QRJ/ https://pretalx.com/yocto-project-summit-2025-12/talk/3Z9QRJ/feedback/ Walnascar After hours social 2025-12-02T18:00:00+00:00 18:00 02:00 Social hangout - Day 1 yocto-project-summit-2025-12-83623-social-hangout-day-1 After Hours Hangout en Social hangout - Day 1 false https://pretalx.com/yocto-project-summit-2025-12/talk/RV3ZZC/ https://pretalx.com/yocto-project-summit-2025-12/talk/RV3ZZC/feedback/ Whinlatter Talk 2025-12-02T12:15:00+00:00 12:15 00:10 Hands-On Setup yocto-project-summit-2025-12-83618-hands-on-setup Hands on Lab David Reyna en Hands-On Setup false Hands-on class setup (PowerPoint) Hands-on class setup (PDF) https://pretalx.com/yocto-project-summit-2025-12/talk/TTWVXV/ https://pretalx.com/yocto-project-summit-2025-12/talk/TTWVXV/feedback/ Whinlatter Lightning Talk 2025-12-02T12:25:00+00:00 12:25 00:30 Two high-impact new arrivals in bitbake and openembedded-core are bitbake-setup and support for the clang toolchain. Lets give them a spin. yocto-project-summit-2025-12-83389-bbsc-bitbake-setup-clang-livecoding Intermediate Track / Presentation Josef Holzmayr en Livecoding as you know it. An idea to show, a rough concept how it's supposed to work, and then finding the problems live. false Slides, but not really. https://pretalx.com/yocto-project-summit-2025-12/talk/GXDTRX/ https://pretalx.com/yocto-project-summit-2025-12/talk/GXDTRX/feedback/ Whinlatter Hands-on class 2025-12-02T12:55:00+00:00 12:55 01:30 Hands-on class that demonstrates the features of devtool. yocto-project-summit-2025-12-83292-devtool-hands-on-class Hands on Lab Michael Opdenacker, Root Commit en devtool is a powerful set of features that can greatly enhance package development with the Yocto Project. Be prepared to be impressed and wish you had known this tool earlier! This class will teach users about the features available with this tool. It will then guide the users through the process of importing new packages, generating and editing recipes, testing them on a target system and also how to create new patches for existing recipes. Last but not least, this class will be run using the latest Yocto release, Whinlatter. false Slides https://pretalx.com/yocto-project-summit-2025-12/talk/V9YJMW/ https://pretalx.com/yocto-project-summit-2025-12/talk/V9YJMW/feedback/ Whinlatter Hands-on class 2025-12-02T14:40:00+00:00 14:40 01:30 Many tools and scripts are made available to developers after sourcing the build environment. These tools can automate many everyday Yocto tasks and greatly improve the Yocto experience. This talk will briefly demonstrate how to automate common Yocto workflows for managing projects, managing dependency relationships, patching source code, etc. using tools such as bitbake, bitbake-\*, oe-\*, etc. yocto-project-summit-2025-12-83381-yocto-and-bitbake-tooling Hands on Lab Anakin Childerhose en Many of the basic everyday Yocto tasks can be tedious. That is why the many amazing developers contributing to the Yocto project have created tools that come with Yocto to automate such tedious tasks. Often beginners can end up wasting time on small issues for simple changes for example: Creating a recipe but the recipe is not detected. Creating a bbappend that fails to append. Creating a layer but the layer configuration is not correctly defined. Setting a variable but it does not take affect. Often there are manual approaches to tasks such as creating layer and recipes by hand which can lead to such issues as above. The standard Yocto tooling can automate manual tasks that can be error prone for beginners thus avoiding such errors. This talk will briefly cover the following Yocto and Bitbake tools: - bitbake-layers - bitbake-getvar - bitbake - recipetool - runqemu - oe-depends-dot - oe-pkgdata-util - oe-run-native - buildhistory-collect-srcrevs To fullfill tasks such as: - creating a Yocto project from scratch - creating layers - adding third party layers - validating layer and recipe definitions - determining inter-layer, inter-recipe, inter-task dependencies - creating reproducible builds - inspecting build environments - patching recipe source code - debugging the kernel - emulating the kernel - inspecting packages - running native tooling without installing locally - version locking all floating SRCREVs false Slides Slides with Toaster https://pretalx.com/yocto-project-summit-2025-12/talk/PV3SLG/ https://pretalx.com/yocto-project-summit-2025-12/talk/PV3SLG/feedback/ Walnascar Lightning Talk 2025-12-03T12:00:00+00:00 12:00 00:15 Welcome - Day 2 yocto-project-summit-2025-12-83621-welcome-day-2 All Attendees en Welcome - Day 2 false https://pretalx.com/yocto-project-summit-2025-12/talk/SWNBQS/ https://pretalx.com/yocto-project-summit-2025-12/talk/SWNBQS/feedback/ Walnascar Talk 2025-12-03T12:15:00+00:00 12:15 00:30 Since the Linux kernel became a CVE Numbering Authority (CNA), the number of associated CVEs has increased. Security teams must address these CVEs to meet regulatory and customer requirements, increasing their workload unless automation is implemented. In this talk, we analyze the status of CVEs for each LTS kernel branch. Then, we demonstrate how leveraging CVE kernel metadata and recent SPDX generation enhancements within oe-core can reduce CVE false positives by 70% and provide detailed responses for all kernel-related CVEs. This process uses output from vex or the cve-check bbclass as input. Additionally, it enables more detailed per-binary information about the source code used to compile any package built with The Yocto Project. yocto-project-summit-2025-12-83097-improving-cve-triage-for-the-linux-kernel Intermediate Track / Presentation /media/yocto-project-summit-2025-12/submissions/9PBHQP/kernel_e2fMSgt.webp Daniel Turull en Since the Linux kernel became a CVE Numbering Authority (CNA), the number of associated CVEs has increased. Security teams must address these CVEs to meet regulatory and customer requirements, increasing their workload unless automation is implemented. In this talk, we analyze the status of CVEs for each LTS kernel branch. Then, we demonstrate how leveraging CVE kernel metadata and recent SPDX generation enhancements within oe-core can reduce CVE false positives by 70% and provide detailed responses for all kernel-related CVEs. This process uses output from vex or the cve-check bbclass as input. Additionally, it enables more detailed per-binary information about the source code used to compile any package built with The Yocto Project. false Slides https://pretalx.com/yocto-project-summit-2025-12/talk/9PBHQP/ https://pretalx.com/yocto-project-summit-2025-12/talk/9PBHQP/feedback/ Walnascar Talk 2025-12-03T12:50:00+00:00 12:50 00:30 Two major features have been added to Yocto Project in 2025: Configuration Fragments and the `bitbake-setup` command. Configuration Fragments were introduced in Yocto Project 5.2 "Walnascar", allowing configuration changes to be organised into separate files which can easily be enabled or disabled via the `OE_FRAGMENTS` variable. The `bitbake-setup` command will be introduced in Yocto Project 5.3 "Whinlatter", automating the initial setup of a build environment. This command will fetch required layers and enable configuration fragments based on user input. It makes use of a new `conf/toolcfg.conf` file to avoid clashing with any changes you wish to make in `conf/local.conf`. After the introduction of `bitbake-setup`, the combined `poky` git repository is being retired - if you have been using this you will need to switch over to `bitbake-setup` or clone `bitbake` and `openembedded-core` directly. yocto-project-summit-2025-12-83403-configuration-fragments-bitbake-setup Intermediate Track / Presentation Yoann Congal en This talk will introduce the new features described above and show how they can be used. It will also show how you can write your own Configuration Fragments and `bitbake-setup` configuration files, as well as where to place them in a layer. It will discuss the migration paths from the combined `poky` git repository or from other layer setup tools. The talk will finish with some ideas of how we can continue to improve these tools. false Slides https://pretalx.com/yocto-project-summit-2025-12/talk/BUH9GG/ https://pretalx.com/yocto-project-summit-2025-12/talk/BUH9GG/feedback/ Walnascar Lightning Talk 2025-12-03T13:25:00+00:00 13:25 00:15 In Yocto-based projects, the distribution is commonly a means to an end - sandwiched between the BSP and business logic, it often simply "exists". But what if the distro itself is the focus of the project, designed to be generic and reusable across multiple devices, products, or even organizations? This lightning talk explores the motivations, challenges, and strategies behind writing a targetless, general-purpose Yocto distribution. yocto-project-summit-2025-12-83175-writing-a-distro-for-no-one-or-anyone Intermediate Track / Presentation Esa Jääskelä en This quick presentation talks about the considerations of building a Yocto distribution without a specific target in mind. We'll discuss when a generic distro makes sense, how to plan for the unknown, and some best practices for architecture, kernel, userspace, and documentation. Topics include: - Why and when to write a general-purpose distro, and the distro's role in embedded Linux projects. - Choosing hardware targets before users or use cases are defined. - Optimizing the distro for flexibility and reuse in Yocto projects. - The Linux kernel's role in a generic distro. - Creating references and documentation. false Presentation slides https://pretalx.com/yocto-project-summit-2025-12/talk/EUWBYR/ https://pretalx.com/yocto-project-summit-2025-12/talk/EUWBYR/feedback/ Walnascar Talk 2025-12-03T14:00:00+00:00 14:00 00:30 The cve-check class allows to find out which packages in your Yocto Project build have unfixed vulnerabilities. In the recent months, Marta and the team has worked on a replacement called currently yocto-vex-check. In this talk she will share experiences from this experiment and explore how the Yocto Project could address the problem in the years ahead, taking into account the new legal requirements (CRA-Cyber Resilience Act) and the ongoing issues with the CVE program. yocto-project-summit-2025-12-83296-cve-check-which-way-forward Intermediate Track / Presentation Marta RYBCZYNSKA, Ygreky en Outline: - CVE/NVD and the state of the landscape - What is cve-check? What worked? What didn't work? - yocto-vex-check? What worked? What didn't work? - Options going forward false Slides - cve-check: which way forward https://pretalx.com/yocto-project-summit-2025-12/talk/ACAQGV/ https://pretalx.com/yocto-project-summit-2025-12/talk/ACAQGV/feedback/ Walnascar Talk 2025-12-03T14:35:00+00:00 14:35 00:30 Previous presentations at the Yocto Summit on Secure Boot have primarily focused on what Secure Boot is. This presentation instead walks a developer through the step-by-step process to generate a Poky (walnascar) build that supports Secure Boot. yocto-project-summit-2025-12-83194-enabling-uefi-secure-boot-on-x86 Intermediate Track / Presentation Gregory Meiste en After briefly introducing Secure Boot and meta-secure-core, dive into project creation. I will create a genericx86-64 build and demo how to provision the keys and secure boot on hardware. Then I will create an intel-corei7-64 build (using meta-intel) showing changes required to use that machine. After demoing booting intel-corei7-64, I’ll show how to generate your own keys instead of using the sample keys provided. Lastly, I’ll walk through how to change the Grub password from the default. Trademarks displayed in this presentation are the property of their respective owners. No claim of ownership is intended, and all recognized trademarks, logos, and service marks belong to the companies or individuals to whom they are registered. false Presentation Slides https://pretalx.com/yocto-project-summit-2025-12/talk/RZGDFW/ https://pretalx.com/yocto-project-summit-2025-12/talk/RZGDFW/feedback/ Walnascar Talk 2025-12-03T15:10:00+00:00 15:10 00:30 This session presents feedback from deploying dm-verity in a Secure Boot-enabled embedded Linux system built with The Yocto Project. We will outline the integration process, system-level constraints, and runtime implications for secure deployments. yocto-project-summit-2025-12-81946-feedback-on-dm-verity-integration-under-secure-boot-with-yocto Intermediate Track / Presentation Pierre Gal en This talk provides a detailed walkthrough of the real-world integration of dm-verity in a Yocto-based Linux distribution to ensure data integrity across multiple system partitions. We will cover the configuration of dm-verity within the Yocto build system, its interaction with Secure Boot across various hardware platforms, and the implications for system updates. The session will also address performance overhead, update workflows for read-only root filesystems, and common failure modes encountered during boot authentication. Debugging techniques and mitigation strategies will be discussed to equip attendees with the technical knowledge required to successfully integrate dm-verity into their own secure embedded platforms. false Presentation slides https://pretalx.com/yocto-project-summit-2025-12/talk/XSM7NL/ https://pretalx.com/yocto-project-summit-2025-12/talk/XSM7NL/feedback/ Walnascar Talk 2025-12-03T15:50:00+00:00 15:50 00:30 This talk explores how to establish a complete secure boot chain on ARM-based embedded platforms using Yocto, combining SoC-level security mechanisms with Linux-level integrity protection. Through the example of NXP’s `i.MX` family, we’ll show how to leverage features such as HABv4, ARM TrustZone, and OP-TEE to create a verified, encrypted, and trusted execution environment from the first instruction to the root filesystem. yocto-project-summit-2025-12-83328-implementing-secure-boot-on-arm-platforms-with-yocto-a-case-study-on-nxp-i-mx Intermediate Track / Presentation Mathieu Dupré en Not all ARM devices include UEFI or a TPM, yet embedded systems still need strong guarantees of authenticity and integrity. This session explains how to build a secure and trusted boot chain on ARM platforms directly using SoC-provided mechanisms. Focusing on the NXP `i.MX` SoC family, we’ll walk through: * Using the High Assurance Boot (`HABv4`) to sign and verify U-Boot and kernel images * Fusing keys inside the SoC’s OTP memory * Extending trust to userspace through `dm-verity` and `dm-crypt`, even without a TPM * Leveraging ARM TrustZone and OP-TEE for trusted key management and runtime validation This talk echoes the [YPS 2024.12 session “Secure Boot All the Way to Userspace” by Mikko Rapeli](https://www.youtube.com/watch?v=mNC5suIlWAQ), bringing similar principles to embedded hardware where UEFI is unavailable. Attendees will learn practical Yocto integration patterns and reproducible workflows to implement secure boot and trusted execution on ARM-based devices, ready for deployment in production environments. false Slides https://pretalx.com/yocto-project-summit-2025-12/talk/AMBENP/ https://pretalx.com/yocto-project-summit-2025-12/talk/AMBENP/feedback/ Walnascar Talk 2025-12-03T16:25:00+00:00 16:25 00:30 VulnScout is an open-source vulnerability assessment tool that analyzes SBOMs and aggregates results from sources such as CVE, OSV, and Yocto cve-check output. To make it directly usable within the Yocto ecosystem, we developed meta-vulnscout, a layer adding build tasks for automated and web analysis, similar in spirit to Toaster. This talk will show how VulnScout helps improving the security envelope of Yocto-based systems and present our roadmap for tighter integration with Yocto workflows, including continuous monitoring, CI gating based on severity filters, and structured reporting. Attendees will learn how to run it today and what is coming next. yocto-project-summit-2025-12-83172-vulnscout-yocto-evolving-vulnerability-and-compliance-management Intermediate Track / Presentation /media/yocto-project-summit-2025-12/submissions/9JWKV7/vulnsc_RlpGvxy.webp Jérôme OufellaValentin Boudevin en The evolution of regulatory frameworks such as the EU Cyber Resilience Act require continuous vulnerability monitoring and assessment of the software supply chain. While Yocto already ensures reproducibility and transparency, maintaining visibility into vulnerabilities across hundreds of software packages remains a challenge. VulnScout addresses this need by analyzing SBOMs (SPDX, CycloneDX, and others) and correlating components with several vulnerability data sources, including NVD, OSV, and Yocto’s native cve-check output. It can operate in interactive mode, through a web interface for efficient review and assessment, or in non-interactive mode for CI pipelines, filters, and automate the production of reports. The accompanying meta-vulnscout layer integrates these capabilities into Yocto builds, providing tasks to: - Generate and collect SBOMs for images or other artifacts - Run vulnerability scans as part of BitBake builds - Merge cve-check results with external feeds - Optionally fail builds or generate structured reports based on severity thresholds This session will demonstrate current features and discuss upcoming developments, including better Yocto Project integration, vulnerability assessment, and continuous monitoring. Attendees will gain a clear view of how VulnScout and meta-vulnscout can help secure Yocto-based products and how the community can collaborate on their evolution. false Slides of presentation https://pretalx.com/yocto-project-summit-2025-12/talk/9JWKV7/ https://pretalx.com/yocto-project-summit-2025-12/talk/9JWKV7/feedback/ Walnascar Lightning Talk 2025-12-03T17:00:00+00:00 17:00 00:15 Software‑supply‑chain attacks increasingly exploit the dependency graphs hidden inside container base images. General‑purpose binary distributions can drag in hundreds of packages, making it difficult to generate accurate SBOMs and keep up with CVE patching. In this session you will learn how to use the Yocto Project to build lean, auditable container base images and matching package repositories that can serve as drop‑in replacements inside existing Docker or Podman build pipelines. yocto-project-summit-2025-12-83349-hardening-your-container-supply-chain-with-yocto-built-base-images Intermediate Track / Presentation Anders Heimer en We will replace an Alpine base image in a micro‑service with an OCI‑compliant image generated by Yocto. Along the way you will learn that we can: - compile every dependency from source under fully reproducible builds; - strip unused libraries, toolchains and the package manager to shrink the attack surface; - automatically generate file level SPDX SBOMs; -feed vulnerability scanners with deterministic package metadata. A comparison quantifies the impact on image size, package count, and open‑CVE exposure. false Hardening Your Container Supply Chain with Yocto‑Built Base Images https://pretalx.com/yocto-project-summit-2025-12/talk/C933T3/ https://pretalx.com/yocto-project-summit-2025-12/talk/C933T3/feedback/ Walnascar Talk 2025-12-03T17:20:00+00:00 17:20 00:30 Meeting EU RED GEC-1 compliance requires a stronger focus on identifying and addressing vulnerabilities in embedded Linux systems. This talk shares lessons learned from building a practical CVE monitoring and remediation workflow using Yocto’s cve-check and related tooling. yocto-project-summit-2025-12-82997-from-cves-to-compliance-strengthening-security-for-eu-red-gec-1-with-yocto Intermediate Track / Presentation Colin Pinnell McAllister en As regulatory frameworks like EU RED introduce stricter cybersecurity requirements, maintaining visibility into vulnerabilities has become critical for embedded Linux developers. This talk walks through the process of improving a security posture to meet GEC-1 compliance goals using the Yocto Project’s cve-check tool and related workflows. Topics include: * How to use and extend cve-check for ongoing vulnerability tracking * Challenges of applying security updates in long-lived products * Strategies for prioritizing fixes and handling false positives * Lessons learned integrating compliance requirements into a Yocto-based workflow * The role of meta-lts-collab in supporting long-term maintenance While specific implementation details will remain high-level, the goal is to share actionable insights for teams working toward stronger security and compliance practices with Yocto. false Slides https://pretalx.com/yocto-project-summit-2025-12/talk/RDTCUR/ https://pretalx.com/yocto-project-summit-2025-12/talk/RDTCUR/feedback/ Walnascar After hours social 2025-12-03T18:00:00+00:00 18:00 02:00 Social hangout - Day 2 yocto-project-summit-2025-12-83624-social-hangout-day-2 After Hours Hangout en Social hangout - Day 2 false https://pretalx.com/yocto-project-summit-2025-12/talk/MG8H8V/ https://pretalx.com/yocto-project-summit-2025-12/talk/MG8H8V/feedback/ Whinlatter Hands-on class 2025-12-03T14:35:00+00:00 14:35 01:30 Self-paced version of the Tools hands-on class for all. yocto-project-summit-2025-12-83931-self-paced-hands-on-yp-tools-class Hands on Lab David ReynaAnakin Childerhose en This is a self-paced version of the Tools hands-on class, with guidance from the experts. This is also a special invitation for the Beginner's Class students to try out the tools direct, since the official class was at the same time as the Beginning Classes. Instructions are provided on how to set up the classes on your own host. Please open the class slides and set up your host the day before, since the initial build will take many hours. A limited number of pre-configured VM hosts will also be available. false Class at home setup script ("summit_dec_2025_setup.sh") Self-paced class slides (PowerPoint) Self-paced class slides (PDF) https://pretalx.com/yocto-project-summit-2025-12/talk/UGBFS3/ https://pretalx.com/yocto-project-summit-2025-12/talk/UGBFS3/feedback/ Walnascar Lightning Talk 2025-12-04T12:00:00+00:00 12:00 00:15 Welcome - Day 3 yocto-project-summit-2025-12-83622-welcome-day-3 All Attendees en Welcome - Day 3 false https://pretalx.com/yocto-project-summit-2025-12/talk/EEVRRL/ https://pretalx.com/yocto-project-summit-2025-12/talk/EEVRRL/feedback/ Walnascar Product Showcase 2025-12-04T12:15:00+00:00 12:15 00:30 Philips needed advanced UI development and connectivity for a new range of Saeco connected coffee machines. The Xelsis models had to go to market in under two years, work seamlessly as a luxury home appliance should, and offer a next-generation experience for users. Of course it was based on Yocto :) yocto-project-summit-2025-12-82244-yocto-in-the-real-world-philips-case-study Product Showcase /media/yocto-project-summit-2025-12/submissions/CLTKKY/Philli_eS2WTVi.webp Ed Langley en Setting the Stage: Embedded Software Development (5 minutes) Challenges of embedded system development in modern industries The growing need for custom, maintainable, and optimized software stacks Why Yocto is a popular choice in this context Philips Case Study Overview The Role of Yocto in the Philips Project How Yocto was chosen as the solution Benefits of Yocto: Customization, scalability, long-term maintenance How Yocto addressed Philips’ specific needs: Custom Linux Distribution for Philips embedded devices Real-time requirements, security features, and ease of integration Key technical features of Yocto used: Layered architecture Recipe management for build automation SDK generation for development consistency Cross-compilation for ARM-based processors Key Challenges & Solutions Challenge 1: Customization and Integration Challenge 2: Security Challenge 3: Long-Term Support and Maintenance Yocto’s Real-World Benefits for Philips Time-to-market reduction through automated builds Tailored, lightweight OS for embedded systems with optimized performance Ease of scaling the system across different device families and models Maintaining a single build environment for multiple product lines Conclusion and Q&A false Slides for the talk updated https://pretalx.com/yocto-project-summit-2025-12/talk/CLTKKY/ https://pretalx.com/yocto-project-summit-2025-12/talk/CLTKKY/feedback/ Walnascar Product Showcase 2025-12-04T12:50:00+00:00 12:50 00:30 Hitachi Energy is in the middle of an exciting rollout of Linux-based energy grid automation and protection products. This talk walks through the story of the switch to embedded Linux using Yocto, challenging industry protocol support, EU CRA impact, OSS license obligation challenges, and all in a very long-lived and slowly evolving industry. yocto-project-summit-2025-12-81938-yocto-linux-in-mission-critical-energy-systems-a-hitachi-energy-journey Product Showcase /media/yocto-project-summit-2025-12/submissions/RT8L3Y/key-im_tI6wc87.webp Benjamin Weber en Hitachi Energy has a rich history dating back to the 19th century, marked by technological innovation and strategic mergers that have shaped its evolution into a global force in electrification and power grids. Driven by a commit-ment to sustainability, security, resilience, and affordability, Hitachi Energy actively contributes to the moderniza-tion of energy systems, making electricity more accessible worldwide. In product development, adopting Embedded Linux and Yocto enhances flexibility and maintainability, with strong legal compliance, license management, and open-source collaboration. Hitachi Energy is rolling out Linux-based energy grid automation products and this talk covers their transition to embedded Linux via Yocto, addressing industry protocol support, impacts of the EU Cyber Resilience Act, OSS license challenges, and navigating these within a slow-evolving sector. false Yocto Linux in Mission Critical Energy Systems – A Hitachi Energy Journey https://pretalx.com/yocto-project-summit-2025-12/talk/RT8L3Y/ https://pretalx.com/yocto-project-summit-2025-12/talk/RT8L3Y/feedback/ Walnascar Talk 2025-12-04T13:25:00+00:00 13:25 00:30 The lifetime of electronic products is not defined solely by hardware; software design has become a decisive factor. Design choices in embedded software, such as build reproducibility, dependency management, update strategy, and security configuration, have a direct impact on product reliability and long-term usability. This talk explores how robust and sustainable software practices can extend component lifetimes and reduce maintenance demands. Using the Yocto Project as a demonstration platform, it presents practical examples of reproducible builds, modular layer structures, and CI/CD integration that support system stability and maintainability. Attendees will gain insights into best practices for long-lived embedded products, including maintainable BSP creation and secure update management, emphasizing that designing for longevity is a shared responsibility between hardware and software engineering. yocto-project-summit-2025-12-83320-designing-for-longevity-embedded-software-as-a-determinant-of-electronic-component-lifetime Intermediate Track / Presentation Lenka Kosková Třísková en Designing for longevity means shifting focus from short-term delivery to long-term maintainability. Embedded software, if engineered with reproducibility, modularity, and security in mind, becomes the determining factor in extending the life of electronic components. The Yocto Project provides both the tools and the structure to implement these practices effectively. Through disciplined layer management, automated validation, and secure update infrastructures, developers can create products that remain functional, maintainable, and secure over many years. By treating software as a lifecycle driver rather than a disposable component, we contribute not only to technical excellence but also to environmental sustainability and the principles of green electronics. false Slides - PDF https://pretalx.com/yocto-project-summit-2025-12/talk/7ZEQ3P/ https://pretalx.com/yocto-project-summit-2025-12/talk/7ZEQ3P/feedback/ Walnascar Talk 2025-12-04T14:05:00+00:00 14:05 00:30 Maintaining a complex Yocto layer like meta-ros is more than just writing BitBake recipes—it's a balancing act across automation, cloud infrastructure, developer experience, and community collaboration. This talk explores how cross-domain skills—from Python scripting to cloud-native CI, and from configuration tooling to open source community engagement—can transform the sustainability and usability of embedded software layers. Through real-world examples, Rob Woolley shares how embracing automation, reproducibility, and scalable testing has helped streamline maintenance and improve accessibility for developers. The session will also highlight the importance of fostering a vibrant community around open source projects, and how thoughtful tooling and infrastructure choices can empower contributors and users alike. Whether you're a Yocto veteran or just getting started, this talk offers insights into how diverse technical skills and a collaborative mindset can make embedded development more approachable, efficient, and fun. yocto-project-summit-2025-12-81841-multiverse-of-maintenance-where-ros-meets-yocto-and-every-combination-is-a-new-reality Intermediate Track / Presentation Rob Woolley en Maintaining the meta-ros layer for the Yocto Project is more than just embedded systems work—it's a multidisciplinary effort that spans Python automation, cloud-native CI/CD, developer experience, and open source community building. In this talk, Rob Woolley shares lessons learned from maintaining meta-ros, including the use of the superflore Python tool to auto-generate BitBake recipes from upstream ROS metadata, and how GitHub Actions streamline monthly syncs with rosdistro. Rob will also explore how integrating the kas configuration tool has simplified onboarding and reproducibility, despite the complexity of supporting 20+ Yocto/ROS distribution combinations. He’ll walk through the use of advanced Git techniques to manage this matrix, and how a Terraform-powered GitLab CI farm on AWS spot instances enables scalable, cost-effective testing—coordinated via GitLab SaaS. The session will highlight how SDK generation, pre-built images, and native build environments improve developer workflows, and how community engagement through GitHub, Discord, Discourse, and biweekly working group meetings fosters collaboration and innovation. Whether you're an embedded developer, DevOps engineer, or open source contributor, this talk will show how cross-domain skills can elevate the sustainability and impact of a complex Yocto layer. false Presentation slides https://pretalx.com/yocto-project-summit-2025-12/talk/ENVHQJ/ https://pretalx.com/yocto-project-summit-2025-12/talk/ENVHQJ/feedback/ Walnascar Talk 2025-12-04T14:40:00+00:00 14:40 00:30 Yocto Project has a few years ago introduced the genericarm64 machine configuration. This talk explains what genericarm64 is, how it has been configured and how it can help developers to start with Yocto on arm64 based SoCs and to support multiple HW variants. yocto-project-summit-2025-12-82666-genericarm64-what-is-it-and-how-can-it-help-you Intermediate Track / Presentation Mikko Rapeli en A lot of development has been done to make 64bit Arm architectures work well with GNU/Linux SW stack. Low level bootloader (u-boot etc) and Linux kernel support has been upstreamed and many boards and devices from multiple vendors will work out-of-the-box at least for basic functionality like memory, CPU, highspeed buses like PCIe, serial consoles and ethernet. Since support for these devices exists in upstream kernel, it just needs to be enabled in downstream Linux distributions, which is what Yocto machine configuration genericarm64 does. The SoCs and boards working with genericarm64 need an Arm System Ready compatible firmware, with UEFI support. Either vendor or u-boot or edk2 open source SW can be used to provide this firmware, with or without extra security components from the Trusted Firmware umbrella https://www.trustedfirmware.org/. With the device and board and firmware and necessary kernel support enabled, genericarm64 can boot a number boards from a number of vendors. The default core-image-sato images can be used to test boards from multiple vendors and can be used as a starting point for product specific configuration and to compare HW from different vendors. The traditional SoC vendor way of providing vendor and product specific layers and build configurations makes comparing different boards and their features harder. They also tie solutions to specific supported branches, possibly only an older LTS, even when support exists in latest development branch in Yocto. It is hard to compare different product specific builds because environments are complext to setup and manage, though some HW specific usecases may not work with upstreamed SW and thus may require vendor specific firmware, SW or BSP SW support in genericarm64. The default Yocto Project builds for genericarm64 are also a bit limited on the contents of the SW stack, since in Yocto community oe-core only contains quite minimal set of SW components. Additional layers like meta-security, meta-virtualisation, meta-arm etc may need to be added in such cases. Vendors providing HW and firmware support can also use Linaro service like ONELab to test their HW and firmware versions so that they are compatible with Yocto genericarm64 and also other Linux distributions. Yocto genericarm64 also uses Linaro Lava to test different boards and firmware variants so that boot to serial console etc and execution of Yocto upstream oeqa runtime tests work. false Slides v2 https://pretalx.com/yocto-project-summit-2025-12/talk/B7EK7K/ https://pretalx.com/yocto-project-summit-2025-12/talk/B7EK7K/feedback/ Walnascar Talk 2025-12-04T15:15:00+00:00 15:15 00:30 Vendor Board Support Packages (BSPs) are the standard for bringing new silicon to market, showcasing features, and promising an "easy" start. However, for those of us building products with long-term lifecycles, these BSPs often fail to meet quality requirements. They can be overly intrusive and typically don't separate feature showcases from the well-maintained base needed for product development. This focus on rapid demonstration frequently results in BSPs which are difficult to maintain, lack transparency, and are built on non-LTS Yocto and kernel versions, making them unsuitable for products expected to last 5, 10, or even 20 years. yocto-project-summit-2025-12-81864-your-vendor-s-bsp-is-probably-not-built-for-product-longevity-now-what Intermediate Track / Presentation Anna-Lena Marx en This talk will take a critical look at the state of vendor BSPs from an integrator's perspective. We will explore the common pitfalls: opaque custom tooling, automatic inclusion of demo software, reliance on unmaintained kernel forks, and the widespread avoidance of Yocto LTS releases. We'll discuss the differing perspectives of vendors and product developers, examine both good and bad real-world examples, and make the case for why writing your own sleek BSP layer is an absolutely valid strategy. Writing your own board descriptions and leveraging the stability of mainline Yocto and Linux kernels is not as daunting as it seems and can be the key to building truly sustainable and maintainable products. false Slides https://pretalx.com/yocto-project-summit-2025-12/talk/BCPNTE/ https://pretalx.com/yocto-project-summit-2025-12/talk/BCPNTE/feedback/ Walnascar Talk 2025-12-04T15:55:00+00:00 15:55 00:30 Clang compiler recipes have been merged into OE-core layer with 5.3 release. Clang is used directly or indirectly in a lot of cases in Linux stack and increasingly in embedded linux systems. This talk will cover the rationale why it was promoted to OE-core. We will discuss the use cases where it is already used and how it is used. yocto-project-summit-2025-12-82377-why-do-we-need-clang-llvm Intermediate Track / Presentation Khem Raj en Clang is another C/C++ compiler in addition to GCC which is now part of OpenEmbedded Core and yocto project users will get it out of box. This talk covers the needed know-how to use it in various capacities e.g. just for one package, system-wide builds with clang. Clang has additional tools which are good to have in the toolbox, eg. LLD is new linker implementation which is blazing fast linking large C++ programs. LibTooling based tools like clang-tidy provide needed checks close to static analyzers and it can be customized, clang-format is a lint'ing tool and clang-scan provides a static analyzer, with meta-clang it can be enabled to generate HTML reports. Having clang moved out of meta-clang, the question why we still need it, will be answered, there still are distro build policy fragments e.g. LTO, Thin-LTO to enable distro-wide settings. Then there are recipes which need clang explicitly which have moved to different layers e.g. meta-oe but some tweaks still are needed for some cases. LLVM is now shared across rust compiler, clang compiler and mesa and more use cases to come. Finally, It will tackle information on building Clang based C/C++ SDKs. There might be more use cases for GPU toolchains in future that involves clang/MLIR which can be enabled in Yocto project. false Slides https://pretalx.com/yocto-project-summit-2025-12/talk/PFKZZN/ https://pretalx.com/yocto-project-summit-2025-12/talk/PFKZZN/feedback/ Walnascar Talk 2025-12-04T16:30:00+00:00 16:30 00:30 This session explores the latest developments in toolchain testing, ongoing improvements, and upcoming features with a focus on GCC, GLIBC, Binutils, Rust and Clang/LLVM within the Yocto Project. Attendees will gain insights into the status of toolchain testing and improvements. yocto-project-summit-2025-12-83319-toolchain-testing-advancements-gcc-glibc-rust-clang-llvm Intermediate Track / Presentation Sundeep KOKKONDA en This session will delve into the evolution of key development toolchains—GCC, GLIBC, Binutils, Rust and Clang/llvm —and their testing within the Yocto Project. We will discuss the latest enhancements over previous releases, provide an overview of current testing methodologies, and share upcoming improvements aimed at ensuring robust toolchain behavior. Attendees will gain a deeper understanding of the toolchain testing process, including the challenges faced and the solutions being developed to maintain cutting-edge support for multiple architectures. false Toolchain Testing Advancements: GCC, Glibc, Rust & Clang/LLVM Yocto Project Summit 2025.12 - Toolchain Testing Advancements https://pretalx.com/yocto-project-summit-2025-12/talk/X979CC/ https://pretalx.com/yocto-project-summit-2025-12/talk/X979CC/feedback/ Walnascar Talk 2025-12-04T17:05:00+00:00 17:05 00:30 This is the journey of bringing up a custom STM32MP-based board, starting with an existing Buildroot repository and evolving toward a full Yocto Project setup using ST’s meta-st-stm32mp layers. This will describe going from a Buildroot project to an exact replica with a Yocto Project using individual recipes and then updating it to use the meta-st-stm32mp layers. yocto-project-summit-2025-12-83067-meta-st-stm32mp-and-me-a-journey-from-buildroot-to-yocto Intermediate Track / Presentation Ming en "Updates are easy", they said... When I meet "they", they owe me a drink! To start, I will go through the process of migrating from a Buildroot project to a Yocto Project. Once the dust has settled on that phase of the project, I will go through the tasks involved of integrating a bespoke board into the meta-st-stm32mp layers and updating tf-a, u-boot and the Linux kernel. The guide is quite short and seems straightforward enough, so it should be an easy job... Let us find out the reality. false Sllides https://pretalx.com/yocto-project-summit-2025-12/talk/DWXS3N/ https://pretalx.com/yocto-project-summit-2025-12/talk/DWXS3N/feedback/ Walnascar After hours social 2025-12-04T18:00:00+00:00 18:00 02:00 Social hangout - Day 3 yocto-project-summit-2025-12-83625-social-hangout-day-3 After Hours Hangout en Social hangout - Day 3 false https://pretalx.com/yocto-project-summit-2025-12/talk/MR3HJJ/ https://pretalx.com/yocto-project-summit-2025-12/talk/MR3HJJ/feedback/