= (WIP) Security team and private reporting =

== How to Report a Vulnerability? ==

Please send a message to security [at] yoctoproject [dot] org, including as many details as possible: the layer or software module affected, the recipe and its version, and any example code, if available.

''' Branches maintained with security fixes'''
----------------------------------------------
See [https://wiki.yoctoproject.org/wiki/Stable_Release_and_LTS Stable release and LTS]for detailed info regarding the policies and maintenance of Stable branch.

The [https://wiki.yoctoproject.org/wiki/Releases Release page] contains a list of all releases of the Yocto Project. Versions in grey are no longer actively maintained with security patches, but well-tested patches may still be accepted for them for significant issues.

== How to Contact the Yocto Project regarding Security ==

We have set up two security-related mailing lists:

* '''Public List'''
: yocto [dash] security [at] yoctoproject[dot] org
: This is a public mailing list for anyone to subscribe to. This list is an open list to discuss public security issues/patches and security-related initiatives. For more information, including subscription information, please see the [https://lists.yoctoproject.org/g/yocto-security yocto-security mailing list info page].

* '''Private List'''
: security [at] yoctoproject [dot] org
: This is a private mailing list for reporting non-published potential vulnerabilities. The list is monitored by the Yocto Project Security team.

'''What you should do if you find a security vulnerability'''
---------------------------------------------
If you find a security flaw; a crash, an information leakage, or anything that can have a security impact if exploited in any Open Source packages used by the Yocto Project, please report this to the Yocto Project Security Team. If you prefer to contact the upstream project directly, please send a copy to the security team at Yocto as well.
If you believe this is highly sensitive information, please report the vulnerability in a secure way, i.e. encrypt the email and send it to the private list. This ensures that the exploit is not leaked and exploited before a response/fix has been generated.

'''What Yocto Security Team does when it receives a security vulnerability'''
---------------------------------------------
The YP Security Team team performs a quick analysis and reports the flaw to the upstream project. Normally the upstream project analyzes the problem. If they deem it a real security problem in their software, they develop and release a fix following their own security policy. They may want to include the original reporter in the loop. There is also sometimes some coordination for handling patches, backporting patches etc, or just understanding the problem or what caused it.

The security policy of the upstream project might include a notification to Linux distributions or other important downstream projects in advance to discuss coordinated disclosure. These mailing lists are normally non-public.

When the upstream project releases a version with the fix, they are responsible for contacting Mitre (cve.mitre.org) to get a CVE number assigned and the CVE record published.

'''If an upstream project does not respond quickly'''
---------------------------------------------
If an upstream project does not fix the problem in a reasonable time, the Yocto's Security Team will contact other interested parties (usually other distributions) in the community and together try to solve the vulnerability as quickly as possible.

The Yocto Project Security team adheres to the 90 days disclosure policy by default. An increase of the embargo time is possible when necessary.

== Security Team Appointment ==

The Yocto Project Security Team consists of at least three members. When new members are needed, the YP TSC asks for nominations by public channels, including also the limit date. Self-nominations are possible. When the limit time is reached, the YP TSC posts the list of candidates for the comments of project participants and developers. Comments may be sent publicly or privately to the YP and OE TSCs. The candidates are approved by both YP TSC and OE TSC and the final list of the team members is announced publicly.

YP Security Team members may resign at any time.

== Security Team Operations ==

The work of the Security Team might require high confidentiality. Team members are individuals selected by merit and do not represent the companies they work for. They do not share information about confidential issues outside of the team and do not hint about ongoing embargoes.

Team members can bring in domain experts as needed. Those people should be added to individual issues only and adhere to the same standards as the YP Security Team.

The YP security team organizes its meetings and communication as needed.

When the YP Security team receives a report about a potential security vulnerability, they quickly analyze and notify the reporter of the result. They might also request more information.

If the issue is confirmed and affects the code maintained by the YP, they confidentially notify maintainers of that code and work with them to prepare a fix.

If the issue is confirmed and affects an upstream project, the YP security team notifies the project. Usually, the upstream project analyzes the problem again. If they deem it a real security problem in their software, they develop and release a fix following their security policy. They may want to include the original reporter in the loop. There is also sometimes some coordination for handling patches, backporting patches etc, or just understanding the problem or what caused it.

The security policy of the upstream project might include a notification to Linux distributions or other important downstream projects in advance to discuss coordinated disclosure. These mailing lists are generally non-public. The YP Security Team participates in the discussion as needed. They might also include the YP maintainer of the affected package.

When the upstream project releases a version with the fix, they are responsible for contacting Mitre (cve.mitre.org) to get a CVE number assigned and the CVE record published.

When the fix is publicly available, the YP security team member or the package maintainer sends patches against the YP code base, following usual procedures, including public code review.

== Current Security Team Members ==

For secure communications, please send your messages encrypted using the GPG keys. Remember message headers are not encrypted so do not include sensitive information in the subject line.

* Richard Purdie '''<richard.purdie@linuxfoundation.org>'''
: [https://keys.openpgp.org/search?q=richard.purdie%40linuxfoundation.org Public key]

* Michael Halstead '''<mhalstead [at] linuxfoundation [dot] org>'''
: Public keys: [https://pgp.mit.edu/pks/lookup?op=vindex&search=0x3373170601861969 Michael Halstead] or [https://keyserver.ubuntu.com/pks/lookup?op=get&search=0xd1f2407285e571ed12a407a73373170601861969 Michael Halstead]

* Ross Burton '''<ross@burtonini.com>'''
: [https://keys.openpgp.org/search?q=ross%40burtonini.com Public key]

* Marta Rybczynska '''<marta DOT rybczynska [at] syslinbit [dot] com>'''
: [https://keys.openpgp.org/search?q=marta.rybczynska@syslinbit.com Public key]

Security private reporting

2023-10-17T10:12:21Z

Rpurdie:

= (WIP) Security team and private reporting =

== How to Report a Vulnerability? ==

Please send a message to security [at] yoctoproject [dot] org, including as many details as possible: the layer or software module affected, the recipe and its version, and any example code, if available.

''' Branches maintained with security fixes'''
----------------------------------------------
See [https://wiki.yoctoproject.org/wiki/Stable_Release_and_LTS Stable release and LTS]for detailed info regarding the policies and maintenance of Stable branch.

The [https://wiki.yoctoproject.org/wiki/Releases Release page] contains a list of all releases of the Yocto Project. Versions in grey are no longer actively maintained with security patches, but well-tested patches may still be accepted for them.

== How to Contact the Yocto Project regarding Security ==

We have set up two security-related mailing lists:

* '''Public List'''
: yocto [dash] security [at] yoctoproject[dot] org
: This is a public mailing list for anyone to subscribe to. This list is an open list to discuss public security issues/patches and security-related initiatives. For more information, including subscription information, please see the [https://lists.yoctoproject.org/g/yocto-security yocto-security mailing list info page].

* '''Private List'''
: security [at] yoctoproject [dot] org
: This is a private mailing list for reporting non-published potential vulnerabilities. The list is monitored by the Yocto Project Security team.

'''What you should do if you find a security vulnerability'''
---------------------------------------------
If you find a security flaw; a crash, an information leakage, or anything that can have a security impact if exploited in any Open Source packages used by the Yocto Project, please report this to the Yocto Project Security Team. If you prefer to contact the upstream project directly, please send a copy to the security team at Yocto as well.
If you believe this is highly sensitive information, please report the vulnerability in a secure way, i.e. encrypt the email and send it to the private list. This ensures that the exploit is not leaked and exploited before a response/fix has been generated.

'''What Yocto Security Team does when it receives a security vulnerability'''
---------------------------------------------
The YP Security Team team performs a quick analysis and reports the flaw to the upstream project. Normally the upstream project analyzes the problem. If they deem it a real security problem in their software, they develop and release a fix following their own security policy. They may want to include the original reporter in the loop. There is also sometimes some coordination for handling patches, backporting patches etc, or just understanding the problem or what caused it.

The security policy of the upstream project might include a notification to Linux distributions or other important downstream projects in advance to discuss coordinated disclosure. These mailing lists are normally non-public.

When the upstream project releases a version with the fix, they are responsible for contacting Mitre (cve.mitre.org) to get a CVE number assigned and the CVE record published.

'''If an upstream project does not respond quickly'''
---------------------------------------------
If an upstream project does not fix the problem in a reasonable time, the Yocto's Security Team will contact other interested parties (usually other distributions) in the community and together try to solve the vulnerability as quickly as possible.

The Yocto Project Security team adheres to the 90 days disclosure policy by default. An increase of the embargo time is possible when necessary.

== Security Team Appointment ==

The Yocto Project Security Team consists of at least three members. When new members are needed, the YP TSC asks for nominations by public channels, including also the limit date. Self-nominations are possible. When the limit time is reached, the YP TSC posts the list of candidates for the comments of project participants and developers. Comments may be sent publicly or privately to the YP and OE TSCs. The candidates are approved by both YP TSC and OE TSC and the final list of the team members is announced publicly.

YP Security Team members may resign at any time.

== Security Team Operations ==

The work of the Security Team might require high confidentiality. Team members are individuals selected by merit and do not represent the companies they work for. They do not share information about confidential issues outside of the team and do not hint about ongoing embargoes.

Team members can bring in domain experts as needed. Those people should be added to individual issues only and adhere to the same standards as the YP Security Team.

The YP security team organizes its meetings and communication as needed.

When the YP Security team receives a report about a potential security vulnerability, they quickly analyze and notify the reporter of the result. They might also request more information.

If the issue is confirmed and affects the code maintained by the YP, they confidentially notify maintainers of that code and work with them to prepare a fix.

If the issue is confirmed and affects an upstream project, the YP security team notifies the project. Usually, the upstream project analyzes the problem again. If they deem it a real security problem in their software, they develop and release a fix following their security policy. They may want to include the original reporter in the loop. There is also sometimes some coordination for handling patches, backporting patches etc, or just understanding the problem or what caused it.

The security policy of the upstream project might include a notification to Linux distributions or other important downstream projects in advance to discuss coordinated disclosure. These mailing lists are generally non-public. The YP Security Team participates in the discussion as needed. They might also include the YP maintainer of the affected package.

When the upstream project releases a version with the fix, they are responsible for contacting Mitre (cve.mitre.org) to get a CVE number assigned and the CVE record published.

When the fix is publicly available, the YP security team member or the package maintainer sends patches against the YP code base, following usual procedures, including public code review.

== Current Security Team Members ==

For secure communications, please send your messages encrypted using the GPG keys. Remember message headers are not encrypted so do not include sensitive information in the subject line.

* Richard Purdie '''<richard.purdie@linuxfoundation.org>'''
: [https://keys.openpgp.org/search?q=richard.purdie%40linuxfoundation.org Public key]

* Michael Halstead '''<mhalstead [at] linuxfoundation [dot] org>'''
: Public keys: [https://pgp.mit.edu/pks/lookup?op=vindex&search=0x3373170601861969 Michael Halstead] or [https://keyserver.ubuntu.com/pks/lookup?op=get&search=0xd1f2407285e571ed12a407a73373170601861969 Michael Halstead]

* Ross Burton '''<ross@burtonini.com>'''
: [https://keys.openpgp.org/search?q=ross%40burtonini.com Public key]

* Marta Rybczynska '''<marta DOT rybczynska [at] syslinbit [dot] com>'''
: [https://keys.openpgp.org/search?q=marta.rybczynska@syslinbit.com Public key]

2022-12-07T10:24:46Z

Rpurdie: /* Products that use the Yocto Project */

It's hard to know which companies or projects use the Yocto Project since there is no requirement to tell us. This list is here to informally collate the companies, projects and products that use the Yocto Project in some way. This helps the project since it means we can show at least some cross section of which companies are using it and how/where. There is more information about this here: https://lists.yoctoproject.org/g/yocto/topic/82722441

= Companies using the Yocto Project =

== Semiconductor Vendors ==
* AMD (Silver Member)
* ARM (Platinum Member)
* Intel (Platinum Member)
* Microchip
* NXP (Silver Member)
* Qualcomm
* Renesas (Gold Member)
* STMicroelectronics (Silver Member)
* Texas Instruments (Gold Member)
* Xilinx (Platinum Member)

== Operating System Vendors ==
* ENEA (Silver Member)
* Linaro (Silver Member)
* Lineo (Silver Member)
* Mentor Graphics (Gold Member)
* Microsoft (Platinum Member)
* Montavista (Silver Member)
* Wind River (Gold Member)

== Others ==
* [https://3mdeb.com/ 3mdeb]
* [https://alladin.at/ alladin-IT GmbH]
* [https://www.ambu.com/ Ambu] (Endoscope video devices)
* [https://www.arthrex.co.uk/ Arthrex] (Surgical video products)
* Atlas Copco
* AWS (Platinum Member)
* [https://www.axis.com/ Axis Communications] (Silver Member)
* [https://www.balena.io/ Balena]
* BMW
* BMW Car IT
* [https://www.bruker.com/ Bruker BioSpin GmbH]
* [https://bootlin.com/ Bootlin]
* Cisco (Platinum Member)
* Comcast (Platinum Member)
* [https://www.cytera.bio/ Cytera] (via Belena)
* Dell (Silver Member)
* [https://www.denx.de/ DENX Software Engineering]
* Dynamic Devices
* [https://www.ericsson.com Ericsson]
* Facebook (Platinum Member)
* [https://formlabs.com/ Formlabs]
* Fujitsu
* [https://www.gardena.com/ GARDENA] (Husqvarna Group)
* [https://www.garmin.com/ Garmin]
* General Electric
* [https://genielifesciences.com/ Genie Life Sciences]
* Gigaset Communications GmbH
* [https://hillrom.com Hillrom]
* Juniper
* [https://koansoftware.com/ KOAN sas]
* Kodak
* [https://www.korg.com/ Korg]
* [https://lawo.com/ LAWO]
* Lexmark
* LG (Silver Member)
* [https://lightyear.one/ Lightyear]
* National Instruments
* [https://www.ovo.auto/ OVO Automotive]
* [https://www.pengutronix.de/ Pengutronix]
* reMarkable
* [https://www.rethinkrobotics.com/ Rethink Robotics GmbH]
* [https://www.smile.eu/en/offers/embedded-iot Smile ECS]
* StreamUnlimited Engineering GmbH
* [https://www.taitradio.com Tait Communications]
* [https://www.witekio.com/values-expertise/ Witekio]
* [https://www.veobot.com/ Veo Robotics]

= Products that use the Yocto Project =

* Amazon Eero
* Ambu aview2 and abox2
* BMW cars
* [https://www.cambridgeaudio.com/ Cambridge Audio] network streamers
* Comcast set top boxes
* [https://dasharo.com/ Dasharo]
* [https://www.gardena.com/int/products/smart/ GARDENA smart garden] (The smart garden gateway runs Yocto/OpenEmbedded. Open source parts can be found [https://github.com/husqvarnagroup/smart-garden-gateway-public on GitHub.])
* Some Garmin [https://www.garmin.com/marine/ Marine] Products
* Gigaset DSPG-SOCs based products (e.g N870, N870 Integrator, Marine 2/3/4)
* Go Pro (https://gopro.com/content/dam/help/open-source/2020-09-28%20-%20HERO9%20Black%20-GoPro%20Open%20Source%20Software%20Notice.pdf)
* [https://www.korg.com/uk/products/synthesizers/wavestate/ Korg Wavestate Synthesizer]
* LAWO [https://lawo.com/products/a__uhd-core/ A__UHD Core] [https://lawo.com/products/a__line/ A__ Line]
* Lexmark Printers
* LG webOS TVs
* Lightyear 0 solar EV (Telematics Control Unit)
* Mellanox Bluefield SmartNIC
* Sky Glass (clear from sources tarball [http://oss.sky.com/SkyHD/SkyGlass/skyglass_spk.tar.bz2])
* [https://www.streamunlimited.com/hardware-modules/ StreamUnlimited hardware modules for voice assistants and connected speakers]
* Vernier LabQuest

= Projects that use the Yocto Project =

* [https://asteroidos.org/ AsteroidOS]
* [https://www.automotivelinux.org/ Automotive Grade Linux (AGL)]
* [https://www.balena.io/ Balena]
* Comcast RDK
* [https://www.webos-ports.org LuneOS]
* Nvidia vibrante SDK [https://docs.nvidia.com/drive/archive/4.1.8.0L/nvoss_docs/index.html]
* OpenBMC
* [https://oryx-linux.org/ Oryx Linux]
* [https://github.com/riscv/meta-riscv RISC-V]
* [https://www.streamunlimited.com/stream-sdk/ StreamSDK for voice assistants and connected speakers]
* Windows Subsystem Linux (v1+v2)
* webOS
* [https://www.webosose.org/ webOS OSE (Open Source Edition)]
* [http://yoedistro.org The Yoe Distribution]

Project Users

2022-12-07T10:24:05Z

Rpurdie: /* Others */

Project Users

2022-11-30T19:33:37Z

Rpurdie: /* Others */

Project Users

2022-11-30T19:28:23Z

Rpurdie: /* Others */