OSS + ELC EU 2026

Containers ship everywhere, yet their software supply chain remains murky. Today's SBOM tools work backwards, scanning a finished image to guess what's inside — an approach prone to omissions and inaccuracies that the EU Cyber Resilience Act will make increasingly untenable.

The Yocto Project uses a fundamentally different path. Because we build everything from source, we generate an accurate, complete SPDX 3.0 SBOM during the build, not after it — with full license and provenance information. In this presentation, we discuss a new approach that lets us build minimal, multi-layer OCI container images using standard Yocto tooling, with no special privileges required, to produce repeatable and auditable results.

We will demonstrate end-to-end automation on the Yocto Project AutoBuilder: building reference container images, attaching SBOM and license attestations, signing them, and pushing to public registries. Attendees will leave understanding how reproducible builds, from source, close the container manifest gap — and how to consume these images today.