Rockchip SoCs: a foray into eFuse territory

Every System-on-Chip has a boot ROM taking care of finding the next component in the boot process, load and run it. Each different vendor tends to implement a different strategy for their boot ROM, often with similar capabilities.

We have written about the Rockchip SoCs boot ROM before on this blog, for instance to discuss their recovery boot capability and the related tooling.

This time, we’re going to look into a particular piece of memory on the SoC, that is very important to the security of the SoC: the secure eFuse.

Continue reading “Rockchip SoCs: a foray into eFuse territory”

sbom-cve-check 1.3.2 and 1.3.3: improved SBOM handling and more robust CVE analysis

sbom-cve-checkSince our previous update on sbom-cve-check, the project has continued to evolve with two new releases: version 1.3.2, released in June, and version 1.3.3, released in August.

These releases bring a number of improvements to the handling of SBOM data, CVE version ranges and vulnerability assessments, as well as fixes for some corner cases encountered when analyzing real-world software projects.

For those discovering the project, sbom-cve-check is a lightweight open-source tool developed by Bootlin for performing vulnerability analysis on Software Bill of Materials (SBOMs). It is based on SPDX SBOMs and can be used both as a standalone tool and through its integration in the Yocto Project. Since the Yocto Project’s Wrynose release, sbom-cve-check has been used as the Yocto Project’s official tool for CVE monitoring.

Continue reading “sbom-cve-check 1.3.2 and 1.3.3: improved SBOM handling and more robust CVE analysis”

Embedded Linux Security training: materials available, new sessions open

Embedded Linxu Security training from BootlinBack in April 2026, we announced our brand new Embedded Linux Security training course, prepared by Bootlin engineers Olivier Benjamin and Mathieu Dubois-Briand.

We are happy to be sharing a number of updates regarding this training: feedback from the first sessions, availability of complete training materials, and new public sessions being available end of 2026.

Continue reading “Embedded Linux Security training: materials available, new sessions open”

Announcing “Embedded Linux Security”, Bootlin’s brand new training course

Embedded Linxu Security training from BootlinIt is no mystery that cyber-security has become a highly important if not critical topic over the past few years. This naturally extends to embedded devices, including those running Linux and open-source software. For many years, Bootlin has been supporting its customers in implementing security features in embedded products: secure boot, encryption, Trusted Execution Environments, and more. We also help maintain Linux systems over time through CVE monitoring, long-term maintenance, and regular upgrades of Linux BSP components.

However, Bootlin’s DNA has never been limited to providing engineering services where we simply “do the work” for our customers. Sharing knowledge and empowering engineers to build and maintain their own systems is at the core of what we do.

Based on this philosophy and our security expertise, we are excited to announce a brand new training course: Embedded Linux Security.

Bootlin "Embedded Linux Security" training agendaThis course covers a wide range of topics essential to securing Linux-based embedded devices: fundamental security concepts, hardware-enforced security mechanisms, secure boot, data confidentiality and encryption, key management, user-space security, measured boot, system maintenance, regulatory compliance, and secure update strategies. We have brought together all the key building blocks needed to design and maintain a secure embedded Linux system in a single, comprehensive course. You can review the complete training agenda for full details.

Our launch customer for this course is EBV Elektronik, for whom we will deliver the very first session in Spain mid-May. In line with Bootlin’s open-source culture, we will publish the complete training materials, free of charge and under an open-source license, shortly after this first session, adding them to the materials of our nine other training courses already freely available.

NXP i.MX93 FRDMLike most of our training courses, this one combines lectures with practical labs. The lectures are hardware-agnostic, providing knowledge applicable across platforms, with a natural focus on ARM-based systems. For the hands-on labs, we use the NXP i.MX93 FRDM, a platform offering strong security features and solid upstream software support.

If you are interested in attending this course, several options are available:

  • Join one of our first public online sessions, delivered by the Bootlin engineers who designed the course:
  • Organize a private in-person session at your location – contact us
  • Organize a private online session dedicated to your team – contact us

We hope this new training will be useful to engineers and teams working on securing their embedded Linux systems, whether they are just getting started or already tackling advanced topics. We also hope to see many of our readers join one of the upcoming sessions, and we look forward to your feedback on this new course!

sbom-cve-check v1.2.0 released

sbom-cve-checkWe are pleased to announce the release of sbom-cve-check v1.2.0, which focuses on offline usability, improved SPDX 3.0 support, and more flexible export options.

For the record, sbom-cve-check is a lightweight, standalone and easy-to-use tool that parses Software Bill Of Materials (SBOM) files and using publicly available databases of security vulnerabilities (CVEs), provides a report detailing which software components are affected by known security vulnerabilities. sbom-cve-check is developed and maintained by Bootlin engineer Benjamin Robin.

In the next sections we will describe the major updates brought by this 1.2.0 release.

Continue reading “sbom-cve-check v1.2.0 released”

Announcing sbom-cve-check, a lightweight CVE analysis tool for your SBOM

sbom-cve-checkToday, we are happy to announce the first release of a brand new open-source project: sbom-cve-check, a lightweight CVE analysis tool for your Software Bill of Materials (SBOM). Written in Python, with minimal dependencies, and a very simple workflow in mind, sbom-cve-check will parse your SBOM (SPDX v2.2 or SPDX v3.0 currently supported), and using publicly available databases of security vulnerabilities, will generate a report of known security vulnerabilities affecting the software components listed in your SBOM.

This tool will be presented tomorrow, on December 2 at 3:40 PM during the Yocto Project Virtual Summit 2025.12 during a talk titled sbom-cve-check: Lightweight Python tooling for out-of-build CVE analysis of SPDX3 SBOMs, presented by Bootlin engineers Benjamin Robin and Olivier Benjamin.

Continue reading “Announcing sbom-cve-check, a lightweight CVE analysis tool for your SBOM”

Back from Open Source Summit Europe 2025: talks from Bootlin

Open Source Summit Europe 2025Bootlin had a very strong presence at the recent Open Source Summit Europe, with 26 members of our team attending the event, 8 talks given by our engineers, and a booth at the technical showcase.

As the Linux Foundation just posted the videos of all talks from the event, now is a good time to publish the slides of our talks, alongside with the videos.

Continue reading “Back from Open Source Summit Europe 2025: talks from Bootlin”

Safe updates using RAUC on Raspberry Pi 5

RAUC on RaspberryPi 5As part of a recent project at Bootlin, we implemented A/B Over-The-Air (OTA) updates on a a system based on the RaspberryPi 5 using RAUC. We ended up not using U-Boot as a bootloader and instead rely solely on the RaspberryPi firmware as a bootloader. This post will dive into the details of making this happen, and some advanced features of RAUC.

Continue reading “Safe updates using RAUC on Raspberry Pi 5”

Cyber Resilience Act (CRA) – Obligations for manufacturers

The EU’s new Cyber Resilience Act (CRA) sets out a comprehensive framework of cybersecurity requirements for products with digital elements. While most of its provisions will apply starting December 11, 2027, certain obligations—most notably, reporting duties for manufacturers—will kick in earlier, on September 11, 2026.

In a previous blog post, we offered an overview of the CRA and its broader context. In this article, we’re narrowing the focus to a key actor in the CRA’s ecosystem: the manufacturer. We’ll explore what qualifies someone as a manufacturer under the regulation, and what responsibilities that role carries under the new law.

Continue reading “Cyber Resilience Act (CRA) – Obligations for manufacturers”

The NIST’s new plan for digital signatures: impact on secure boot

NIST Special Publication 800 – 131AIn October 2024, the National Institute of Standards and Technology (NIST) published an initial public draft of Special Publication 800 – 131A, with the title “Transitioning the Use of Cryptographic Algorithms and Key Lengths”.
It details how the NIST expects the requirements for use of cryptography to protect non-classified information to evolve.

There are several key points, such as abandoning ECB and SHA-1, but the main one this post will investigate is digital signatures.

Continue reading “The NIST’s new plan for digital signatures: impact on secure boot”