yocto – Bootlin

sbom-cve-check 1.3.2 and 1.3.3: improved SBOM handling and more robust CVE analysis

Since our previous update on sbom-cve-check, the project has continued to evolve with two new releases: version 1.3.2, released in June, and version 1.3.3, released in August.

These releases bring a number of improvements to the handling of SBOM data, CVE version ranges and vulnerability assessments, as well as fixes for some corner cases encountered when analyzing real-world software projects.

For those discovering the project, sbom-cve-check is a lightweight open-source tool developed by Bootlin for performing vulnerability analysis on Software Bill of Materials (SBOMs). It is based on SPDX SBOMs and can be used both as a standalone tool and through its integration in the Yocto Project. Since the Yocto Project’s Wrynose release, sbom-cve-check has been used as the Yocto Project’s official tool for CVE monitoring.

Continue reading “sbom-cve-check 1.3.2 and 1.3.3: improved SBOM handling and more robust CVE analysis”

yocto-kiss: updated to the Wrynose Yocto LTS release

We are pleased to announce that yocto-kiss, our minimal but realistic Yocto/OpenEmbedded reference setup, has been updated to the latest Wrynose Yocto LTS release (version 6.0). Following the addition of ZynqMP support and the move to a cleaner multi-layer architecture earlier this year, this update keeps the project aligned with the current Yocto LTS and brings several improvements we’d like to highlight.

Continue reading “yocto-kiss: updated to the Wrynose Yocto LTS release”

Updated Yocto support for SiFive RISC-V platforms

SiFive logo Bootlin has been maintaining Freedom-U-SDK (FUSDK), a Yocto/OpenEmbedded-based software development kit for RISC-V platforms from SiFive, in collaboration with SiFive since 2022.

The Yocto support for SiFive RISC-V platforms is split into two layers:

meta-sifive, a BSP layer providing
machine-specific support
freedom-u-sdk, a demo and SDK layer that builds images for the HiFive Unmatched board and QEMU RISC-V 64-bit targets

In a previous blog post we summarized the work done up to the 2022.10 release. This new post covers everything since then, up to the latest 2026.07.00-lts release which was published recently.

Continue reading “Updated Yocto support for SiFive RISC-V platforms”

yocto-kiss: new name, cleaner architecture, and ZynqMP support

We’re excited to share some significant updates to our yocto-kiss project, our example of the simplest but realistic Yocto/OpenEmbedded setup. These changes improve the project’s organization, make it more scalable, and add support for a new ZynqMP-based platform.

Continue reading “yocto-kiss: new name, cleaner architecture, and ZynqMP support”

sbom-cve-check updates: integrated in Yocto 6.0 Wrynose, Schneider Electric support, new releases, and more

Back in December 2025, we announced the release of sbom-cve-check, a lightweight CVE analysis tool for your Software Bill of Materials (SBOM). Since the announcement, we have announced a number of updates and new releases, but work has continued, and we have several new updates to share about sbom-cve-check.

Continue reading “sbom-cve-check updates: integrated in Yocto 6.0 Wrynose, Schneider Electric support, new releases, and more”

Yocto Wrynose released, Bootlin contributions inside

Yocto Wrynose 6.0 is now released. This is the new Long Term Support release of the Yocto Project and will be maintained until 2030. Bootlin is a very active contributor to the Yocto Project, most notably with Antonin Godard being the official Yocto Project documentation maintainer, and Mathieu Dubois-Briand being a core member of the Yocto SWAT team, but also with other Bootlin engineers who use and deploy Yocto to create optimized and long-term maintainable Linux systems for the embedded devices of our customers. This 6.0 release was no exception, and we were again very active in this release cycle, with over 300 commits authored by Bootlin engineers.

Continue reading “Yocto Wrynose released, Bootlin contributions inside”

sbom-cve-check updates: new release, meta-sbom-cve-check, possible Yocto integration, FOSDEM talk

Back in December 2025, we announced the release of sbom-cve-check, a lightweight CVE analysis tool for your Software Bill of Materials (SBOM).

Since the release announcement, the project has continued its development, and in this blog post, we wanted to share a number of updates about this project: a new 1.1.0 release, a new meta-sbom-cve-check layer, possible integration into the Yocto Project, and a talk at FOSDEM.

Continue reading “sbom-cve-check updates: new release, meta-sbom-cve-check, possible Yocto integration, FOSDEM talk”

meta-kiss: updates to our simple Yocto layer

Yocto is often seen as fairly complex, and at Bootlin we believe one reason for this perception is the unnecessary complexity of the BSP layers provided by silicon or board vendors, each of which often includes highly custom logic that isn’t needed. That’s why, back in 2023, we released meta-kiss, an example layer demonstrating how simple it can be to support various hardware platforms with Yocto, without relying on any vendor-provided BSP layer.

Since then, we’ve kept this layer up-to-date and added several new features. In this blog post, we’d like to highlight recent significant updates: an upgrade to Yocto Scarthgap, support for the i.MX93 FRDM platform, and the ability to build OP-TEE for the previously supported STM32MP1 platform.

Continue reading “meta-kiss: updates to our simple Yocto layer”

Announcing sbom-cve-check, a lightweight CVE analysis tool for your SBOM

Today, we are happy to announce the first release of a brand new open-source project: sbom-cve-check, a lightweight CVE analysis tool for your Software Bill of Materials (SBOM). Written in Python, with minimal dependencies, and a very simple workflow in mind, sbom-cve-check will parse your SBOM (SPDX v2.2 or SPDX v3.0 currently supported), and using publicly available databases of security vulnerabilities, will generate a report of known security vulnerabilities affecting the software components listed in your SBOM.

This tool will be presented tomorrow, on December 2 at 3:40 PM during the Yocto Project Virtual Summit 2025.12 during a talk titled sbom-cve-check: Lightweight Python tooling for out-of-build CVE analysis of SPDX3 SBOMs, presented by Bootlin engineers Benjamin Robin and Olivier Benjamin.

Continue reading “Announcing sbom-cve-check, a lightweight CVE analysis tool for your SBOM”

Support for Yocto buildtools added to upstream Kas

Yocto Buildtools in Kas Bootlin has recently contributed to the Kas project by adding support for Yocto Project’s Buildtools. In this blog post, we will give an overview of what Kas is, what Buildtools are, why an integration of Buildtools was deemed useful and relevant, and how to use it.

Continue reading “Support for Yocto buildtools added to upstream Kas”