Beyond the Release: Managing Long-Term Risk and Compliance in Embedded Linux with Yocto
- Anna-Lena Marx
- Embedded , Conferences
- April 14, 2026
The embedded systems of the future will be judged by their long-term resilience and security. For many manufacturers, however, the shift from a product release to continuous lifecycle management is a significant operational hurdle.
Regulations like the EU’s Cyber Resilience Act (CRA) are formalizing this challenge, demanding ongoing vulnerability management and creating a backdraft of responsibility that impacts the entire supply chain.
This presentation highlights that a robust and reproducible build system is the cornerstone of any sustainable product strategy in this new environment. It will explore how the Yocto Project provides the essential framework for building future-proof and maintainable systems.
The discussion will cover how its architecture enables the critical features needed to manage long-term risk: full-stack patchability for targeted CVE fixes, reproducible builds for maintaining legacy devices, and automated Software Bill of Materials (SBOM) generation for regulatory transparency.
Attendees will gain actionable strategies for implementing lifecycle-aware embedded development and transforming existing product portfolios to meet evolving regulatory requirements.
Presented at
- Embedded World Conference, Nuremberg, 2026-03-10
- EmBO++, Bochum, 2026-03-20
- Yocto Project Workshop @ Embedded Recipes, Nice, France
Related Posts
Your Vendor's BSP Is Probably Not Built For Product Longevity - Now What?
- Anna-Lena Marx
- December 4, 2025
- Embedded , Conferences
Vendor Board Support Packages (BSPs) are the standard for bringing new silicon to market, showcasing features, and promising an “easy” start. However, for those of us building products with long-term lifecycles, these BSPs often fail to meet quality requirements. They can be overly intrusive and typically don’t separate feature showcases from the well-maintained base needed for product development. This focus on rapid demonstration frequently results in BSPs which are difficult to maintain, lack transparency, and are built on non-LTS Yocto and kernel versions, making them unsuitable for products expected to last 5, 10, or even 20 years.
Read Post
Building a Yocto Pipeline with KAS, GitHub Actions and AWS
- Anna-Lena Marx
- November 29, 2023
- Embedded , Conferences
Using KAS makes handling Yocto Projects easy. By shipping its own container with all needed dependencies, building sophisticated CI pipelines becomes pretty easy - in theory, or when using Gitlab.
But using GitHub as a code hosting platform with self-managed Action runners on AWS comes with a set of unexpected challenges.
Anna-Lena will talk about her quest through GitHub Actions, the Cloud and how to tame them.
The talk aims to point the audience to the obstacles when building CI pipelines for the Yocto Project with KAS, GitHub Actions, and custom action runners on AWS and strategies to handle them.
Android Automotive OS: A short introduction into Google's AAOS
- Anna-Lena Marx
- April 2, 2024
- Embedded , Conferences
Android, or the Android Open Source Project (AOSP), is primarily known from the smartphone market. What is less well known, however, is that the AOSP also provides a good basis for embedded systems and ensures a pleasant reading experience on eReaders, for example.
Google is now increasingly pushing into the automotive sector with Android Automotive. But what exactly is Android Automotive or the Android Automotive Operating System (AAOS)? How does it differ from Android or the AOSP? And what are the advantages over classic operating systems for infotainment?
Read Post