Since the Yocto Project is intended to be flexible and meet the needs of many applications, we leave policy-making decisions around security to our end users. Our goal instead is to ship each release with metadata that follows best practices in that we try our best not to release recipe versions which are known to have significant security vulnerabilities. Generally this is done by upgrading recipes to newer versions that are no longer vulnerable to these issues.

Upgrading recipes to the newer versions in the maintenance branches is not always easy, this is why we provide a patch for the existing version instead if we detect a vulnerability in a package. The patches are added to the recipes, see example below:

poky/recipes-connectivity/bind/bind_9.9.5.bb

SRC_URI = "ftp://ftp.isc.org/isc/bind9/${PV}/${BPN}-${PV}.tar.gz \
file://conf.patch \
...
file://bind9_9_5-CVE-2014-8500.patch \

We provide a tool [https://git.yoctoproject.org/cgit/cgit.cgi/poky/tree/meta/classes/cve-check.bbclass cve-check.bbclass] to help report possible security vulnerabilities in the Yocto Project against the [http://nvd.nist.gov/home.cfm National Vulnerability Database]. Unpatched CVEs can be detected using the cve-checker which compares bitbake recipes, their versions and applied CVE patches to reported CVEs for that SW component name and version in the NVD database.

Another good source to track reported CVEs is via the oss-security mailing list (Open Source Software Security) http://www.openwall.com/lists/oss-security/

== Yocto Security Team ==

Currently, the Yocto Project DOES have a Security team. We have two methods of communicating with the project.

'''How to Contact the Yocto Project regarding Security'''
---------------------------------------------
We have set up two security-related mailing lists:
* '''Public List'''
: yocto [dash] security [at] yoctoproject[dot] org
: This is a public mailing list for anyone to subscribe to. This list is an open list to discuss public security issues/patches. For more information including subscription information please see the [https://lists.yoctoproject.org/g/yocto-security yocto-security mailing list info page].

* '''Private List'''
: security [at] yoctoproject [dot] org
: For non-public or urgent issues.

Anyone can contribute with security patches as before, but those volunteering to this security team will sync/organize security related activities and take more responsibility.

'''What you should do if you find a security vulnerability'''
---------------------------------------------
If you find a security flaw; a crash, an information leakage, or anything that can have a security impact if exploited in any Open Source packages used by the Yocto Project, please report this to the Yocto Security Team. If you prefer to contact the upstream project directly, please send a copy to the security team at Yocto as well.
If you believe this is sensitive information, please report the vulnerability in a secure way, i.e. encrypt the email and send it to the private list. This ensures that the exploit is not leaked and exploited before a response/fix has been generated.

'''What Yocto Security Team does when it receives a security vulnerability'''
---------------------------------------------
The team performs a quick analysis and reports the flaw to the upstream project. Normally the upstream projects analyzes the problem. If they deem that it is a real security problem in their software, the project will email the linux-distros mailing list and notify all the big Linux distributions/vendors about the existence of this vulnerability/flaw. These mailing lists are normally non-public. The project and people on the linux-distros can then agree on a release date when the flaw should be made public.
There is also sometimes some coordination for handling patches or backporting of patches etc, or just understanding the problem or what caused it.

When the security issue is finally to be made public, normally upstream project is responsible to contact Mitre (cve.mitre.org) to get a CVE number assigned to it and copy the information to other Opens Source Security mailing lists to inform the whole world of the vulnerability.

'''If an upstream project does not respond quickly'''
---------------------------------------------
If an upstream project does not fix the problem the Yocto's Security Team will contact linux-distros and community and together try to solve the vulnerability as quickly as possible.
Normally big Linux vendors fix the problem if the problem affects their products.
Chances are that everyone from the enterprise distros to the commercial Yocto vendors will get fixes done first, but it is nice to have safety net for issues that really are specific to OE and embedded.

== Branches maintained with security fixes ==
See [https://wiki.yoctoproject.org/wiki/Stable_branch_maintenance Stable branches maintenance]for detailed info regarding the policies and maintenance of Stable branch.

Versions in grey are no longer actively maintained with security patches, but well-tested patches may still be accepted for them.)

== Policy for updating package versions for the stable branches ==
The Yocto project purposely limits updating of packages on oe-stable releases to items that address security problems (e.g. CVEs). For packages like QEMU we avoid updating between from one "dot.dot" to another related "dot.dot" version since it has been seen in the past that even with "simple" updates, things can go wrong and a lot more testing is required to verify compatibility. Better to only add CVE patches to fix specific point problems.

== Kernel security patches ==

Kernel security patches are backported to Linux-yocto kernels regularly from https://www.kernel.org/
=== Linux-yocto ===
linux-yocto_3 (maintainer: Bruce Ashfield)

=== Vendor kernels ===
Kernel security patches are also backported to Linux-vendor kernels from https://www.kernel.org/

* meta-intel (meta-intel uses Linux-yocto)
* meta-xilinx (meta-xilinx@lists.yoctoproject.org)
* meta-ti (meta-ti@yoctoproject.org)
* etc

== How to test ==

If there is any test case for the vulnerability by the upstream project or community
- Run the test to reproduce the problem and verify the correction.
- Run the regression test

If there isn’t any test case and it is complicated and time consuming to write a testcase
- Run the regression test

'''Regression test'''

* Build the core image for at least two architectures (preferably one big-endian and one little-endian)
* Run ptest (for those branches/packages that there is ptest mechanism)

== Patch name convention and commit message ==

Security patches like any Open Source development should follow the openembedded's Guidelines:
*[http://openembedded.org/wiki/Commit_Patch_Message_Guidelines Commit Patch Message Guidelines]
*[https://www.kernel.org/doc/Documentation/SecurityBugs kernel security bugs policy]

Note that security patches should have CVE: tag and reference to the CVE identifier both in the patch file/s and the commit message.

'''Ex upstream patch:'''

Please change the upstream patch "wscanf-allocates-too-little-memory.patch" to "CVE-2015-1472.patch" (or CVE-2015-1472-wscanf-allocates-too-little-memory.patch). Keep the original commit message and add reference to the CVE and upstream patch.

<Keep the original commit message>

Upstream-Status: Accepted <or Backport>
CVE: CVE-2015-8370

Reference to upstream patch:
https://sourceware.org/git/?p=glibc.git;a=patch;h=5bd80bfe9ca0d955bfbbc002781bc7b01b6bcb06

Signed-off-by: Joe Developer <joe.developer@example.com>

'''Ex meta patch:'''

Please make sure to add the package name in the subject and the reference to the CVE. Example for the commit message:

bash: CVE-2014-6278 <if there are multiple CVEs list all>

<short description>

<[YOCTO #xxx] if there is any>

References
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6278
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-6278
xxxx

Signed-off-by: <your email address>

== Workflow of Yocto Project's bugzilla ==
* To Open a Security defect go to [https://bugzilla.yoctoproject.org/enter_bug.cgi?product=Security%20-%20Recipe%20Upgrade Security ‑ Recipe Upgrade]
** Access to this issue can only be viewed by the submitter and a small group of Bug triage folks:
*** Armin Kuster
*** Randy MacLeod
*** Richard Purdie
*** Ross Burton
*** Tim Orling
*** Stephen Jolley
** The normal bug triage process will be applied.

* If the issue is already public please send the patch when available to the appropriate mailing list
* If the issue is private, attach a patch if available to the defect is preferred.

== Some security related links/useful tools ==

* [https://autobuilder.yocto.io/pub/non-release/patchmetrics/ Current CVE status for OE-Core/Poky] (generated by the Autobuilder)
* [https://wiki.yoctoproject.org/wiki/images/5/58/Yocto_Summit_Lyon_Day1_2019.pdf#page=36 Yocto Project and CVEs, presentation by David Reyna in 2019 Yocto Developer day]
* [https://github.com/nluedtke/linux_kernel_cves/ Linux kernel fixed and reported CVEs in all branches and point releases]
** Note that cherry-picking CVE fixes for kernel is not recommended and users should merge full stable releases instead, see [http://www.kroah.com/log/blog/2018/08/24/what-stable-kernel-should-i-use/ What Stable Kernel Should I Use? by stable kernel maintainer Greg Kroah-Hartman]
* [http://www.cvedetails.com CVE details]
* [http://layers.openembedded.org/layerindex/branch/master/layer/meta-security/ Meta-security-layer]
* [https://docs.yoctoproject.org/dev-manual/securing-images.html Making Images More Secure] (Development Tasks Manual)
* [https://github.com/sjvermeu/cvechecker/ Cvechecker]

== Security Issues Addressed in Yocto Releases ==

== Current work in progress ==
* [https://wiki.yoctoproject.org/wiki/Synchronization_CVEs Synchronization on the CVE work]
* [https://wiki.yoctoproject.org/wiki/Security_private_reporting Security team and private reporting]
* [https://wiki.yoctoproject.org/wiki/SECURITY_file SECURITY.md file]
* [https://wiki.yoctoproject.org/wiki/File:Yocto_Project_Security_-_26_09_2023.pdf Related slides]

Recipe Versions

2024-01-26T20:38:41Z

RossBurton:

This page lists the expected versions of major packages that will be in the Yocto Project 5.0 "Scarthgap" release (at the time of writing).

For further details, please contact the relevant maintainer.

{| class="wikitable" style="margin:auto; width:100%"
|-
! Recipe !! Version !! Maintainer !! Notes
|-
| binutils || 2.42 || Khem Raj <raj.khem@gmail.com> ||
|-
| gcc || 13.2 || Khem Raj <raj.khem@gmail.com> || GCC 14 scheduled after YP
|-
| glibc || 2.39 || Khem Raj <raj.khem@gmail.com> || Due 2024-02-01
|-
| linux-yocto || 6.6.x || Bruce Ashfield <bruce.ashfield@gmail.com> || LTS until December 2026
|-
| python3 || 3.12 || Trevor Gamblin <tgamblin@baylibre.com> || 3.13 scheduled 2024-10-01
|}

Bug Triage

2023-12-01T14:33:41Z

RossBurton: /* Agenda */ add time/date

= Goal =
The output of the bug triage meeting should be that all bugs have an owner, a target milestone, and a priority.

Prior to the meeting, each Product Owner should review their Weekly New and High Bugs and be ready with any opens. An example open would be a bug that may need to change Products.

= Roles =
* Call facilitator: Stephen Jolley (sjolley.yp.pm@gmail.com)
** Ensure we keep to the agenda, don't rathole on bug resolution, and stay within our time block.
* Team Leads should pre-triage bugs for their areas of responsibility. Some guidelines on what they should/shouldn't do are:
** a) Pre-triage should happen in the presence of the appropriate team lead,
** b) The bugs being pre-triaged should be the responsibility of the team in question.
** c) The pre-triage team should be confident when dis-positioning the bugs, taking into account the individual's workload.
** d) If the bug raises any doubt or needs information prior, defer it to the main bug triage team.
** e) To insure a bug is triaged by the main bug triage team; set its priority to Undecided.

= Agenda =
* Thursdays at 07:30 Pacific Time (15:30 GMT)
* [https://zoom.us/j/454367603?pwd=ZGxoa2ZXL3FkM3Y0bFd5aVpHVVZ6dz09 Zoom Call Link]
* Review [https://bugzilla.yoctoproject.org/buglist.cgi?list_id=604307&resolution=---&query_format=advanced&bug_status=UNCONFIRMED&bug_status=NEW&bug_status=ACCEPTED&bug_status=IN%20PROGRESS%20DESIGN&bug_status=IN%20PROGRESS%20DESIGN%20COMPLETE&bug_status=IN%20PROGRESS%20IMPLEMENTATION&bug_status=IN%20PROGRESS%20REVIEW&bug_status=REOPENED&bug_status=NEEDINFO&product=Security&product=Security%20-%20Recipe%20Upgrade security issues]

* Review Queries
** State number, title, and owner
** Owner makes any modifications
** Assign owner, target milestone, and priority.
* Opens
** Collect opens
** Discuss opens

Note: for Minnowboard or MinnowBoard-MAX bugs go to: [[Minnow Bug Triage]]

= Bug Triage Order =
*[https://bugzilla.yoctoproject.org/buglist.cgi?list_id=604307&resolution=---&query_format=advanced&bug_status=UNCONFIRMED&bug_status=NEW&bug_status=ACCEPTED&bug_status=IN%20PROGRESS%20DESIGN&bug_status=IN%20PROGRESS%20DESIGN%20COMPLETE&bug_status=IN%20PROGRESS%20IMPLEMENTATION&bug_status=IN%20PROGRESS%20REVIEW&bug_status=REOPENED&bug_status=NEEDINFO&product=Security&product=Security%20-%20Recipe%20Upgrade Security Issues]
*[https://wiki.yoctoproject.org/wiki/Bug_Triage#Non-Prioritized_Bugs Non-Prioritized Bugs and Non Targeted Bugs]
*[https://bugzilla.yoctoproject.org/buglist.cgi?list_id=652616&query_format=advanced&resolution=---&status_whiteboard=AB-INT&status_whiteboard_type=allwordssubstr Autobuilder issues]
*[https://wiki.yoctoproject.org/wiki/Bug_Triage#High_Enhancements.2FBugs High Enhancements/Bugs]
*[https://wiki.yoctoproject.org/wiki/Bug_Triage#Medium.2B_4.3_Unassigned_Enhancements.2FBugs Medium+ 4.3 Unassigned Enhancement/Bugs]
*[https://wiki.yoctoproject.org/wiki/Bug_Triage#Medium.2B_4.99_Unassigned_Enhancements.2FBugs Medium+ 4.99 Unassigned Enhancement/Bugs]
*[https://wiki.yoctoproject.org/wiki/Bug_Triage#NEEDINFO NEEDINFO]
*[https://wiki.yoctoproject.org/wiki/Bug_Triage#Re-Opened Reopened]
*[https://wiki.yoctoproject.org/wiki/Bug_Triage#Old_Milestone Old Milestone]
*[https://wiki.yoctoproject.org/wiki/Bug_Triage#Future_.26_5.99_Milestones Future & 5.99 Milestones]

* Note/Suggestion for the Weekly Triage Meeting: Open the first link in a new browser window and then each additional link in a new tab in that new window. Close the new window when the triage meeting is done.

= Bug Criteria =
* Priority-Severity
** High: Two Week - shouldn't slip to next milestone without review by Triage team.
** Medium+: Milestone Target Required
** Medium: Nice to have for milestone, should have for release
** Low: Nice to have, but no urgency

* Future bugs and enhancements are a good idea to do, but not able in the near term to get fixed or done.
** If you want to work on them, please talk first to the existing owner or change the ownership to yourself if unassigned or newcomer.
*** Note: we have a special owner - newcomer@yoctoproject.org - which we think would be great opportunities for a newcomer to open source to start learning on.

* Special Case: Medium+ and Future Enhancement or Bug - These are a good idea and important to do, but not currently scheduled at this time.
** If you want to work on them, please talk first to the existing owner or change the ownership to yourself if unassigned or newcomer.
*** Note: we have a special owner - newcomer@yoctoproject.org - which we think would be great opportunities for a newcomer to open source to start learning on.

* For more details see the wiki [[Bugzilla Configuration and Bug Tracking]]

= Bug Status Dashboards =

Weekly - https://wiki.yoctoproject.org/charts/combo.html

Daily - https://wiki.yoctoproject.org/charts/daily/combo.html

= Bug Product Searches =

* [[Bug Product Triage]]

= Yocto Bug Triage Searches =
== Newcomer Bugs ==
{{#bugzilla:
|status=!(RESOLVED,VERIFIED,CLOSED)
|to=newcomer@yoctoproject.org, unassigned@yoctoproject.org
|whiteboard=NEWCOMER
|product=!opkg
|severity=!janitors
|priority=!(Undecided)
|columns=id,summary,to,status,milestone,severity,priority,whiteboard
|sort=id
|noresultsmessage="No matching bugs found. Check for unassigned bugs."
|total=summary
}}

== Non-Prioritized Bugs ==
{{#bugzilla:
|status=!(RESOLVED,VERIFIED,CLOSED)
|priority=Undecided
|product=!(opkg, IoT Reference OS Kit, Toaster, Security Response Tool)
|severity=!janitors
|component=!(meta-cgl, meta-security, bsps-meta-ti)
|columns=id,summary,severity,priority,milestone,to,status,whiteboard,estimated
|sort=id
|noresultsmessage="No matching bugs found."
|total=summary
}}

== Non-Targeted Bugs ==
{{#bugzilla:
|status=!(RESOLVED,VERIFIED,CLOSED)
|severity=!janitors
|product=!(opkg, IoT Reference OS Kit, Toaster, Security Response Tool)
|milestone=0.0.0
|component=!(meta-cgl, meta-security, infrastructure-general, bsps-meta-ti)
|columns=id,summary,severity,priority,milestone,to,status,whiteboard,estimated
|sort=id
|noresultsmessage="No matching bugs found."
|total=summary
}}

== New This Week ==
{{#bugzilla:
|created=-1w
|columns=id,summary,severity,priority,milestone,to,status,whiteboard,estimated
|sort=status,id
|noresultsmessage="No matching bugs found."
|total=summary,estimated
}}
== Closed This week ==
{{#bugzilla:
|status=(RESOLVED,VERIFIED,CLOSED)
|modified=-1w
|product=!opkg
|severity=!janitors
|columns=id,modified,summary,severity,priority,milestone,to,status,resolution
|sort=id
|noresultsmessage="No matching bugs found."
|total=summary
}}

== High Enhancements/Bugs ==
{{#bugzilla:
|status=!(RESOLVED,VERIFIED,CLOSED)
|priority=high
|product=!opkg
|columns=id,summary,severity,priority,milestone,to,status,whiteboard,estimated
|sort=milestone,id
|noresultsmessage="No matching bugs found."
|total=summary
}}

== Medium+ 5.0 Unassigned Enhancements/Bugs ==
{{#bugzilla:
|status=!(RESOLVED,VERIFIED,CLOSED)
|priority=!(Undecided,Medium,Low,High)
|milestone=!(4.3, 4.3 M1, 4.3 M2, 4.3 M3, 4.3 M4, 5.1, 5.99, Q1, Q2, Q3, Q4, future)
|to=unassigned@yoctoproject.org
|product=!opkg
|columns=id,summary,severity,priority,milestone,to,status,whiteboard,estimated
|sort=milestone,id
|noresultsmessage="No matching bugs found."
|total=summary
}}

== Medium+ 5.99 Unassigned Enhancements/Bugs ==
{{#bugzilla:
|status=!(RESOLVED,VERIFIED,CLOSED)
|priority=!(Undecided,Medium,Low,High)
|milestone=5.99
|to=unassigned@yoctoproject.org
|product=!opkg
|columns=id,summary,severity,priority,milestone,to,status,whiteboard,estimated
|sort=milestone,id
|noresultsmessage="No matching bugs found."
|total=summary
}}

== Medium+ Future Unassigned Enhancements/Bugs ==
{{#bugzilla:
|status=!(RESOLVED,VERIFIED,CLOSED)
|priority=!(Undecided,Medium,Low,High)
|milestone=Future
|to=unassigned@yoctoproject.org
|product=!opkg
|columns=id,summary,severity,priority,milestone,to,status,whiteboard,estimated
|sort=milestone,id
|noresultsmessage="No matching bugs found."
|total=summary
}}

== NEEDINFO ==
{{#bugzilla:
|status=NEEDINFO
|columns=id,summary,to,status,severity,priority,milestone,modified,whiteboard
|sort=id
|noresultsmessage="No matching bugs found."
|total=summary
|modifiedformat=date
}}

== Re-Opened ==
{{#bugzilla:
|status=REOPENED
|columns=id,summary,to,status,severity,priority,milestone,whiteboard
|sort=milestone,priority,id
|product=!(opkg, IoT Reference OS Kit)
|severity=!janitors
|component=!(meta-cgl, meta-security)
|noresultsmessage="No matching bugs found."
|total=summary
}}

== Old Milestone ==
{{#bugzilla:
|status=!(RESOLVED,VERIFIED,CLOSED)
|milestone= !(3.1.29, 3.1.30, 3.1.32, 3.1.33, 3.1.34, 4.0.14, 4.0.15, 4.0.16, 4.0.17, 4.0.18, 4.0.19, 4.0.20, 4.2.3, 4.3.1, 5.0, 5.0 M1, 5.0 M2, 5.0 M3, 5.0 M4, 4.99, 5.1, 5.99, Q1, Q2, Q3, Q4, future)
|product=!(opkg, IoT Reference OS Kit)
|severity=!janitors
|component=!(meta-cgl, meta-security)
|priority= !Undecided
|columns=id,summary,to,status,severity,priority,milestone,whiteboard
|sort=milestone,priority,id
|noresultsmessage="No matching bugs found."
|total=summary
}}

== Future Dot Releases==
{{#bugzilla:
|status=!(RESOLVED,VERIFIED,CLOSED)
|product=!opkg
|milestone= 3.1.27, 3.1.28, 3.1.29, 4.0.12, 4.0.13, 4.0.14, 4.2.3
|severity=!janitors
|priority= !Undecided
|columns=id,summary,to,status,severity,priority,milestone,whiteboard
|sort=milestone
|noresultsmessage="No matching bugs found."
|total=summary
}}

== YP Toaster Bugs==
Please refer to the [[Bug_Triage_Toaster]] Page

== YP Archived Queries==
Please refer to the [[Bug_Triage_Archive]] Page

== YP BSP Team Triage==
Please refer to the [[BSP Team Bug Triage]] Page

== YP Validation and Infrastructure Team Triage==
Please refer to the [[Validation and Infrastructure Team Bug Triage]] Page

== Future & 5.99 Milestones ==
{{#bugzilla:
|status=!(RESOLVED,VERIFIED,CLOSED)
|product=!opkg
|milestone=Future, 4.99, 5.99
|severity=!janitors
|priority= !(Undecided)
|columns=id,modified,summary,to,status,milestone,severity,priority
|sort=modified,id
|noresultsmessage="No matching bugs found."
|total=summary
}}

== Future & 3.99 Milestones Check ==
{{#bugzilla:
|status=!(RESOLVED,VERIFIED,CLOSED)
|product=!opkg
|milestone=Future, 4.99
|whiteboard=REVIEW, QA, QA REVIEW, OB, OB REVIEW
|severity=!janitors
|priority= !(Undecided)
|columns=id,modified,summary,to,status,milestone,severity,priority,whiteboard
|sort=whiteboard,modified,id
|noresultsmessage="No matching bugs found."
|total=summary
}}

== Quarterly Milestones==
{{#bugzilla:
|status=!(RESOLVED,VERIFIED,CLOSED)
|milestone=Q1,Q2,Q3,Q4
|severity=!janitors
|priority= !Undecided
|columns=id,modified,summary,to,status,severity,priority,milestone,whiteboard
|sort=milestone
|noresultsmessage="No matching bugs found."
|total=summary
}}

Project Users

2023-11-30T19:43:25Z

RossBurton: /* Others */ Add vecima networks

It's hard to know which companies or projects use the Yocto Project since there is no requirement to tell us. This list is here to informally collate the companies, projects and products that use the Yocto Project in some way. This helps the project since it means we can show at least some cross section of which companies are using it and how/where. There is more information about this here: https://lists.yoctoproject.org/g/yocto/topic/82722441

= Companies using the Yocto Project =

== Semiconductor Vendors ==
* AMD (Silver Member)
* ARM (Platinum Member)
* Intel (Platinum Member)
* Microchip
* NXP (Silver Member)
* Qualcomm(Platinum Member)
* Renesas (Gold Member)
* STMicroelectronics (Silver Member)
* Texas Instruments (Gold Member)
* Xilinx (Platinum Member)

== Operating System Vendors ==
* ENEA (Silver Member)
* Linaro (Silver Member)
* Lineo (Silver Member)
* Mentor Graphics (Gold Member)
* Microsoft (Platinum Member)
* Montavista (Silver Member)
* Wind River (Gold Member)

== Others ==
* [https://3mdeb.com/ 3mdeb]
* [https://alladin.at/ alladin-IT GmbH]
* [https://www.ambu.com/ Ambu] (Endoscope video devices)
* [https://www.arthrex.co.uk/ Arthrex] (Surgical video products)
* Atlas Copco
* AWS (Platinum Member)
* [https://www.axis.com/ Axis Communications] (Silver Member)
* [https://www.balena.io/ Balena]
* [https://www.brose.com/ Brose]
* BMW
* BMW Car IT(Platinum Member)
* [https://www.brightsign.biz/ BrightSign]
* [https://www.bruker.com/ Bruker BioSpin GmbH]
* [https://bootlin.com/ Bootlin]
* Cisco (Platinum Member)
* CNH Industrial
* Comcast (Platinum Member)
* [https://www.cytera.bio/ Cytera] (via Belena)
* Dell (Silver Member)
* [https://www.denx.de/ DENX Software Engineering]
* Dynamic Devices
* [https://www.ericsson.com Ericsson]
* Facebook (Platinum Member)
* [https://formlabs.com/ Formlabs]
* Fujitsu
* [https://www.gardena.com/ GARDENA] (Husqvarna Group)
* [https://www.garmin.com/ Garmin]
* General Electric
* [https://genielifesciences.com/ Genie Life Sciences]
* Gigaset Communications GmbH
* [https://hillrom.com Hillrom]
* [https://www.hanoverdisplays.com/ Hanover]
* Juniper
* [https://koansoftware.com/ KOAN sas]
* Kodak
* [https://www.korg.com/ Korg]
* [https://lawo.com/ LAWO]
* Lexmark
* LG (Platinum Member)
* [https://lightyear.one/ Lightyear]
* National Instruments
* [https://www.ovo.auto/ OVO Automotive]
* [https://www.pengutronix.de/ Pengutronix]
* reMarkable
* [https://www.rethinkrobotics.com/ Rethink Robotics GmbH]
* [https://www.siemens.com/ Siemens] (Gold Member)
* [https://www.smile.eu/en/offers/embedded-iot Smile ECS]
* Sonos
* StreamUnlimited Engineering GmbH
* [https://www.taitradio.com Tait Communications]
* [https://www.witekio.com/values-expertise/ Witekio]
* [https://vecima.com Vecima Networks]
* [https://www.veobot.com/ Veo Robotics]

= Products that use the Yocto Project =

* Amazon Eero
* Amazon Echo Show 5
* Ambu aview2 and abox2
* BMW cars
* [https://www.cambridgeaudio.com/ Cambridge Audio] network streamers
* Comcast set top boxes
* [https://dasharo.com/ Dasharo]
* [https://www.gardena.com/int/products/smart/ GARDENA smart garden] (The smart garden gateway runs Yocto/OpenEmbedded. Open source parts can be found [https://github.com/husqvarnagroup/smart-garden-gateway-public on GitHub.])
* Some Garmin [https://www.garmin.com/marine/ Marine] Products
* Gigaset DSPG-SOCs based products (e.g N870, N870 Integrator, Marine 2/3/4)
* Go Pro (https://gopro.com/content/dam/help/open-source/2020-09-28%20-%20HERO9%20Black%20-GoPro%20Open%20Source%20Software%20Notice.pdf)
* Ikea Smart Hub
* [https://www.korg.com/uk/products/synthesizers/wavestate/ Korg Wavestate Synthesizer]
* LAWO [https://lawo.com/products/a__uhd-core/ A__UHD Core] [https://lawo.com/products/a__line/ A__ Line]
* Lexmark Printers
* LG webOS TVs
* Lightyear 0 solar EV (Telematics Control Unit)
* Mellanox Bluefield SmartNIC
* [https://new.siemens.com/global/en/products/buildings.html Siemens Smart Infrastructure]: Products for sustainable, efficient and safe buildings
* Sky Glass (clear from sources tarball [http://oss.sky.com/SkyHD/SkyGlass/skyglass_spk.tar.bz2])
* [https://www.streamunlimited.com/hardware-modules/ StreamUnlimited hardware modules for voice assistants and connected speakers]
* Vernier LabQuest
* Teledyne FLIR thermal cameras (https://github.com/flir-cx/flir-yocto-documentation)

= Projects that use the Yocto Project =

* [https://asteroidos.org/ AsteroidOS]
* [https://www.automotivelinux.org/ Automotive Grade Linux (AGL)]
* [https://www.balena.io/ Balena]
* Comcast RDK
* [https://easyos.org/ EasyOS]
* [https://github.com/oe-alliance Various Enigma2 based set-top boxes]
* [https://www.webos-ports.org LuneOS]
* Nvidia vibrante SDK [https://docs.nvidia.com/drive/archive/4.1.8.0L/nvoss_docs/index.html]
* OpenBMC
* [https://oryx-linux.org/ Oryx Linux]
* [https://github.com/riscv/meta-riscv RISC-V]
* [https://www.streamunlimited.com/stream-sdk/ StreamSDK for voice assistants and connected speakers]
* Windows Subsystem Linux (v1+v2)
* webOS
* [https://www.webosose.org/ webOS OSE (Open Source Edition)]
* [http://yoedistro.org The Yoe Distribution]

Project Users

2023-11-24T10:46:25Z

RossBurton: /* Products that use the Yocto Project */

It's hard to know which companies or projects use the Yocto Project since there is no requirement to tell us. This list is here to informally collate the companies, projects and products that use the Yocto Project in some way. This helps the project since it means we can show at least some cross section of which companies are using it and how/where. There is more information about this here: https://lists.yoctoproject.org/g/yocto/topic/82722441

= Companies using the Yocto Project =

== Semiconductor Vendors ==
* AMD (Silver Member)
* ARM (Platinum Member)
* Intel (Platinum Member)
* Microchip
* NXP (Silver Member)
* Qualcomm(Platinum Member)
* Renesas (Gold Member)
* STMicroelectronics (Silver Member)
* Texas Instruments (Gold Member)
* Xilinx (Platinum Member)

== Operating System Vendors ==
* ENEA (Silver Member)
* Linaro (Silver Member)
* Lineo (Silver Member)
* Mentor Graphics (Gold Member)
* Microsoft (Platinum Member)
* Montavista (Silver Member)
* Wind River (Gold Member)

== Others ==
* [https://3mdeb.com/ 3mdeb]
* [https://alladin.at/ alladin-IT GmbH]
* [https://www.ambu.com/ Ambu] (Endoscope video devices)
* [https://www.arthrex.co.uk/ Arthrex] (Surgical video products)
* Atlas Copco
* AWS (Platinum Member)
* [https://www.axis.com/ Axis Communications] (Silver Member)
* [https://www.balena.io/ Balena]
* [https://www.brose.com/ Brose]
* BMW
* BMW Car IT(Platinum Member)
* [https://www.brightsign.biz/ BrightSign]
* [https://www.bruker.com/ Bruker BioSpin GmbH]
* [https://bootlin.com/ Bootlin]
* Cisco (Platinum Member)
* CNH Industrial
* Comcast (Platinum Member)
* [https://www.cytera.bio/ Cytera] (via Belena)
* Dell (Silver Member)
* [https://www.denx.de/ DENX Software Engineering]
* Dynamic Devices
* [https://www.ericsson.com Ericsson]
* Facebook (Platinum Member)
* [https://formlabs.com/ Formlabs]
* Fujitsu
* [https://www.gardena.com/ GARDENA] (Husqvarna Group)
* [https://www.garmin.com/ Garmin]
* General Electric
* [https://genielifesciences.com/ Genie Life Sciences]
* Gigaset Communications GmbH
* [https://hillrom.com Hillrom]
* [https://www.hanoverdisplays.com/ Hanover]
* Juniper
* [https://koansoftware.com/ KOAN sas]
* Kodak
* [https://www.korg.com/ Korg]
* [https://lawo.com/ LAWO]
* Lexmark
* LG (Platinum Member)
* [https://lightyear.one/ Lightyear]
* National Instruments
* [https://www.ovo.auto/ OVO Automotive]
* [https://www.pengutronix.de/ Pengutronix]
* reMarkable
* [https://www.rethinkrobotics.com/ Rethink Robotics GmbH]
* [https://www.siemens.com/ Siemens] (Gold Member)
* [https://www.smile.eu/en/offers/embedded-iot Smile ECS]
* Sonos
* StreamUnlimited Engineering GmbH
* [https://www.taitradio.com Tait Communications]
* [https://www.witekio.com/values-expertise/ Witekio]
* [https://www.veobot.com/ Veo Robotics]

= Products that use the Yocto Project =

* Amazon Eero
* Amazon Echo Show 5
* Ambu aview2 and abox2
* BMW cars
* [https://www.cambridgeaudio.com/ Cambridge Audio] network streamers
* Comcast set top boxes
* [https://dasharo.com/ Dasharo]
* [https://www.gardena.com/int/products/smart/ GARDENA smart garden] (The smart garden gateway runs Yocto/OpenEmbedded. Open source parts can be found [https://github.com/husqvarnagroup/smart-garden-gateway-public on GitHub.])
* Some Garmin [https://www.garmin.com/marine/ Marine] Products
* Gigaset DSPG-SOCs based products (e.g N870, N870 Integrator, Marine 2/3/4)
* Go Pro (https://gopro.com/content/dam/help/open-source/2020-09-28%20-%20HERO9%20Black%20-GoPro%20Open%20Source%20Software%20Notice.pdf)
* Ikea Smart Hub
* [https://www.korg.com/uk/products/synthesizers/wavestate/ Korg Wavestate Synthesizer]
* LAWO [https://lawo.com/products/a__uhd-core/ A__UHD Core] [https://lawo.com/products/a__line/ A__ Line]
* Lexmark Printers
* LG webOS TVs
* Lightyear 0 solar EV (Telematics Control Unit)
* Mellanox Bluefield SmartNIC
* [https://new.siemens.com/global/en/products/buildings.html Siemens Smart Infrastructure]: Products for sustainable, efficient and safe buildings
* Sky Glass (clear from sources tarball [http://oss.sky.com/SkyHD/SkyGlass/skyglass_spk.tar.bz2])
* [https://www.streamunlimited.com/hardware-modules/ StreamUnlimited hardware modules for voice assistants and connected speakers]
* Vernier LabQuest
* Teledyne FLIR thermal cameras (https://github.com/flir-cx/flir-yocto-documentation)

= Projects that use the Yocto Project =

* [https://asteroidos.org/ AsteroidOS]
* [https://www.automotivelinux.org/ Automotive Grade Linux (AGL)]
* [https://www.balena.io/ Balena]
* Comcast RDK
* [https://easyos.org/ EasyOS]
* [https://github.com/oe-alliance Various Enigma2 based set-top boxes]
* [https://www.webos-ports.org LuneOS]
* Nvidia vibrante SDK [https://docs.nvidia.com/drive/archive/4.1.8.0L/nvoss_docs/index.html]
* OpenBMC
* [https://oryx-linux.org/ Oryx Linux]
* [https://github.com/riscv/meta-riscv RISC-V]
* [https://www.streamunlimited.com/stream-sdk/ StreamSDK for voice assistants and connected speakers]
* Windows Subsystem Linux (v1+v2)
* webOS
* [https://www.webosose.org/ webOS OSE (Open Source Edition)]
* [http://yoedistro.org The Yoe Distribution]