Sponsored Session - BoF: Yocto Project - What's Next?

## Overview

This Yocto Project Birds of a Feather (BoF) session provided updates on recent developments and engaged the community in interactive discussion about the project's direction. The MC, who has worked on Yocto since its inception and serves on the OpenEmbedded board, led discussions about funding, tooling, and future priorities.

## Key Developments

The project announced successful completion of work funded by Germany's Sovereign Tech Fund, which approached Yocto to address maintainer gaps. Highlights include a VS Code plugin for developers, automatic patch testing infrastructure, a binary drro system for rapid prototyping, and improvements to the Toaster UI tool. The project website was also revamped after period of stagnation.

### Scarthgap LTS Release

The next long-term support release, Scarthgap, will replace Dunfell (ending support in approximately one week) and will receive four years of maintenance. Tim presented the roadmap for this release. Discussion revealed most users are migrating to LTS releases, which is positive for project stability.

## Technical Topics

**Cyber Resilience Act (CRA):** A community member raised concerns about preparing for EU regulations applying in 2027. The project acknowledged the need for actionable steps beyond current efforts (SBOM generation, SPDX 3 representation, CVE format updates). The discussion emphasized that security improvements benefit all users regardless of regulatory requirements.

**Safety-Critical Workflows:** Chuck, working in aerospace, described strict requirements for locked-step version management where developers cannot freely pull individual layers or mirrors. He proposed an RFC for tooling to update mirrors and layer configuration hashes in a controlled manner, noting this differs from general development workflows but is essential for reproducibility over decades-long support periods.

**Patch Submission Workflow:** Multiple attendees raised difficulties with the email-based mailing list submission process, particularly for new developers from Windows backgrounds and drive-by contributors. While the project has no plans to switch to pull request workflows, discussion noted potential enhancements including patch testing notifications and improved web interfaces (mentioning B4/lore tools). Emphasis was placed on enhancing parallel infrastructure rather than replacing existing workflows. The project noted it's working on new user experience improvements but wants to avoid disrupting current workflows.

**Layer Management:** Significant discussion arose around layer setup tooling, with competing approaches (git submodules, repo, kas, kas-docker). The community emphasized that any solution must integrate with existing workflows rather than forcing new ones, and that automotive use cases (based on repo with exact hash specifications) represent significant requirements to address.

## Community Engagement

OpenEmbedded, the technical partner, is recruiting members to gain voting representation on two Yocto Project TSC seats. A workshop held Monday after FOSDEM drew 35 people at capacity; videos are available on OpenEmbedded's YouTube channel. Plans for additional workshops depend on collocated event opportunities. The project seeks community input on workshop locations that could draw 30-40 attendees with local speakers (Brussels workshops cost €7.50-€10).

## Future Planning

The project is preparing a new five-year plan to present to potential funders following success with the Sovereign Tech Fund. Key areas of focus include supply chain security (referenced Joshua Lock's SALSA talk), build system security, and broadening beyond embedded Linux to custom distributions for diverse applications (containers, tractors, spacecraft, vehicles).

Kernel LTS support was discussed: the Linux kernel project dropped LTS to two years, but Scarthgap will receive a kernel update midway through its four-year cycle, with potential for annual updates if commercial sponsors provide funding.