OSS + ELC EU 2026

Automotive Linux products must assess supply chain security at every release.
Yocto-based SBOMs can serve as the foundation, but many teams have yet to answer how much CVE triage to automate and where humans should make the call.
An OSS toolchain also enables the same foundation to be shared with suppliers, with no license barriers.

Yocto-generated VEX and rule-based filtering handle many CVEs, but ambiguity remains — provenance of third-party components, applied patches, unintended dependencies.
AI agents can handle that ambiguity, but opaque and non-deterministic outputs make it impossible to explain a missed CVE or a false positive that blocked a release.

This talk presents a design for that, with a Yocto-based CVE triage pipeline as the example.

The workflow begins with frozen inputs, passes through layered triage, and ends with human approval: inputs locked at CI trigger time (Input Freezing); rule-based and lightweight LLM filtering of straightforward cases (Layered Triage); a high-performance LLM presenting suggestions, with humans making the final call (Suggestion-and-Approval Loop).
These patterns apply to embedded supply chain management beyond automotive Linux.