yocto – Bootlin

Bootlin’s Yocto training course updated to Wrynose

The latest Long Term Support release of the Yocto Project, Yocto Project 6.0 (Wrynose), was released a few months ago, so it was time to update our Yocto Project training materials. This update is now complete.

As with every new Yocto Project release, Wrynose brings a number of changes and new features. Some of them affect the way developers work with Yocto, so we have updated our slides and labs accordingly. In particular:

The bitbake-setup tool was introduced as the Yocto Project-supported way to fetch layers and set up a build configuration. This has been a long-requested feature, and it is now covered in our training.
As part of this change, the Poky Git repository has been deprecated and is no longer maintained. Users now fetch the base components through a bitbake-setup configuration file or by using an external tool.
Support for configuration fragments was added, making it possible to group related and consistent configuration settings together. This is intended to simplify configuration management, whether or not bitbake-setup is being used. The new bitbake-config-build command can be used to enable these fragments from the command line.
There are also internal changes that affect how recipes should be written. These changes are reflected in our training materials. For example, the introduction of UNPACKDIR changes how the S and WORKDIR variables can be used.

Updated labs

We continue to support four different boards in our practical labs:

STM32MP157A-DK1
i.MX93 FRDM
BeaglePlay
BeagleBone Black

For each of these platforms, we use either vendor-provided or community-supported layers, each approach has its own advantages and limitations.

The labs have therefore been updated alongside the training slides to ensure that they remain aligned with the latest Yocto Project release.

Join our Yocto Project training

As with all Bootlin training courses, the Yocto Project training materials are freely available on our website.

If you would like to attend the training with an instructor, we offer public online sessions scheduled by Bootlin. We can also organize private online or private on-site sessions on demand.

Our next public sessions with available seats are:

Whether you are new to the Yocto Project or want to update your existing knowledge, our training provides both the concepts and hands-on experience needed to build and maintain embedded Linux systems with Yocto.

sbom-cve-check 1.3.2 and 1.3.3: improved SBOM handling and more robust CVE analysis

Since our previous update on sbom-cve-check, the project has continued to evolve with two new releases: version 1.3.2, released in June, and version 1.3.3, released in August.

These releases bring a number of improvements to the handling of SBOM data, CVE version ranges and vulnerability assessments, as well as fixes for some corner cases encountered when analyzing real-world software projects.

For those discovering the project, sbom-cve-check is a lightweight open-source tool developed by Bootlin for performing vulnerability analysis on Software Bill of Materials (SBOMs). It is based on SPDX SBOMs and can be used both as a standalone tool and through its integration in the Yocto Project. Since the Yocto Project’s Wrynose release, sbom-cve-check has been used as the Yocto Project’s official tool for CVE monitoring.

Continue reading “sbom-cve-check 1.3.2 and 1.3.3: improved SBOM handling and more robust CVE analysis”

yocto-kiss: updated to the Wrynose Yocto LTS release

We are pleased to announce that yocto-kiss, our minimal but realistic Yocto/OpenEmbedded reference setup, has been updated to the latest Wrynose Yocto LTS release (version 6.0). Following the addition of ZynqMP support and the move to a cleaner multi-layer architecture earlier this year, this update keeps the project aligned with the current Yocto LTS and brings several improvements we’d like to highlight.

Continue reading “yocto-kiss: updated to the Wrynose Yocto LTS release”

Updated Yocto support for SiFive RISC-V platforms

SiFive logo Bootlin has been maintaining Freedom-U-SDK (FUSDK), a Yocto/OpenEmbedded-based software development kit for RISC-V platforms from SiFive, in collaboration with SiFive since 2022.

The Yocto support for SiFive RISC-V platforms is split into two layers:

meta-sifive, a BSP layer providing
machine-specific support
freedom-u-sdk, a demo and SDK layer that builds images for the HiFive Unmatched board and QEMU RISC-V 64-bit targets

In a previous blog post we summarized the work done up to the 2022.10 release. This new post covers everything since then, up to the latest 2026.07.00-lts release which was published recently.

Continue reading “Updated Yocto support for SiFive RISC-V platforms”

yocto-kiss: new name, cleaner architecture, and ZynqMP support

We’re excited to share some significant updates to our yocto-kiss project, our example of the simplest but realistic Yocto/OpenEmbedded setup. These changes improve the project’s organization, make it more scalable, and add support for a new ZynqMP-based platform.

Continue reading “yocto-kiss: new name, cleaner architecture, and ZynqMP support”

sbom-cve-check updates: integrated in Yocto 6.0 Wrynose, Schneider Electric support, new releases, and more

Back in December 2025, we announced the release of sbom-cve-check, a lightweight CVE analysis tool for your Software Bill of Materials (SBOM). Since the announcement, we have announced a number of updates and new releases, but work has continued, and we have several new updates to share about sbom-cve-check.

Continue reading “sbom-cve-check updates: integrated in Yocto 6.0 Wrynose, Schneider Electric support, new releases, and more”

Yocto Wrynose released, Bootlin contributions inside

Yocto Wrynose 6.0 is now released. This is the new Long Term Support release of the Yocto Project and will be maintained until 2030. Bootlin is a very active contributor to the Yocto Project, most notably with Antonin Godard being the official Yocto Project documentation maintainer, and Mathieu Dubois-Briand being a core member of the Yocto SWAT team, but also with other Bootlin engineers who use and deploy Yocto to create optimized and long-term maintainable Linux systems for the embedded devices of our customers. This 6.0 release was no exception, and we were again very active in this release cycle, with over 300 commits authored by Bootlin engineers.

Continue reading “Yocto Wrynose released, Bootlin contributions inside”

sbom-cve-check updates: new release, meta-sbom-cve-check, possible Yocto integration, FOSDEM talk

Back in December 2025, we announced the release of sbom-cve-check, a lightweight CVE analysis tool for your Software Bill of Materials (SBOM).

Since the release announcement, the project has continued its development, and in this blog post, we wanted to share a number of updates about this project: a new 1.1.0 release, a new meta-sbom-cve-check layer, possible integration into the Yocto Project, and a talk at FOSDEM.

Continue reading “sbom-cve-check updates: new release, meta-sbom-cve-check, possible Yocto integration, FOSDEM talk”

meta-kiss: updates to our simple Yocto layer

Yocto is often seen as fairly complex, and at Bootlin we believe one reason for this perception is the unnecessary complexity of the BSP layers provided by silicon or board vendors, each of which often includes highly custom logic that isn’t needed. That’s why, back in 2023, we released meta-kiss, an example layer demonstrating how simple it can be to support various hardware platforms with Yocto, without relying on any vendor-provided BSP layer.

Since then, we’ve kept this layer up-to-date and added several new features. In this blog post, we’d like to highlight recent significant updates: an upgrade to Yocto Scarthgap, support for the i.MX93 FRDM platform, and the ability to build OP-TEE for the previously supported STM32MP1 platform.

Continue reading “meta-kiss: updates to our simple Yocto layer”

Announcing sbom-cve-check, a lightweight CVE analysis tool for your SBOM

Today, we are happy to announce the first release of a brand new open-source project: sbom-cve-check, a lightweight CVE analysis tool for your Software Bill of Materials (SBOM). Written in Python, with minimal dependencies, and a very simple workflow in mind, sbom-cve-check will parse your SBOM (SPDX v2.2 or SPDX v3.0 currently supported), and using publicly available databases of security vulnerabilities, will generate a report of known security vulnerabilities affecting the software components listed in your SBOM.

This tool will be presented tomorrow, on December 2 at 3:40 PM during the Yocto Project Virtual Summit 2025.12 during a talk titled sbom-cve-check: Lightweight Python tooling for out-of-build CVE analysis of SPDX3 SBOMs, presented by Bootlin engineers Benjamin Robin and Olivier Benjamin.

Continue reading “Announcing sbom-cve-check, a lightweight CVE analysis tool for your SBOM”