Paul BarkerI have the privilege of being the first speaker of #EmbeddedRecipes2026! Bright and early, 9:45am on the first day.
I'll be speaking about Yocto Project and the Cyber Resilience Act.
I'll be covering:
- What the CRA means for the Yocto Project
- How the Yocto Project already helps manufacturers meet their obligations with SPDX3 SBoMs, CVE tracking, reproducible builds, etc
- A roadmap of where we can go in the future with your help
Yocto Project and the Cyber Resilience Act ER2026
The EU Cyber Resilience Act introduces new obligations across the software supply chain, for both manufacturers and for the new category of open source stewards. We've been thinking about what this means for the Yocto Project - what are our obligations? And what can we do to help our users meet their obligations as manufacturers? For manufacturers, the CRA requires the avoidance of known exploitable security issues, tracking of software components & vulnerabilities, reporting to relevant Computer Security Incident Response Teams (CSIRTs) and provision of software updates for the useful lifetime of products. Today, the Yocto Project provides a repeatable build process and tooling that will help manufacturers to meet these requirements. With further development, we could make it easier to achieve the required level of security and vulnerability tracking. For the Yocto Project itself, the requirements on open source stewards are more lightweight. We will need to align the project's cybersecurity policy with the CRA and be prepared to share information with market surveillance authorities if requested.
Reel Tubes
Ross Burton
PiEmbSysTech
ASI
ะะฐะบั ๐บ๐ฆ