Problem
YOCTO is the build system for embedded Linux across automotive, IoT, networking, and consumer electronics. Billions of devices run YOCTO-built images, but OSV-SCALIBR has no extractor for BitBake recipes. This creates a complete blind spot for firmware scanning and embedded systems vulnerability tracking.
Current Gap
supported_inventory_types.md covers Spack, Nix, and various package managers but has no entry for YOCTO or BitBake. Organizations building firmware, automotive systems, and embedded devices get zero CVE coverage for their build dependencies.
Data Source
.bb files (BitBake recipe format) with DEPENDS, RDEPENDS, BDEPENDS, PV, PN.bbappend files (recipe overrides)- Located in
meta-*/recipes-*/ directory structure
Implementation
- Parser: Go's
regexp and text/scanner for BitBake syntax
- Path:
extractor/filesystem/language/bitbake/
- PURL:
pkg:bitbake/recipe-name@version
- Fallback: map upstream packages (OpenSSL, Curl, etc.) to existing PURL ecosystems
- Test fixtures: real YOCTO layers (
meta-openembedded, meta-security)
- Edge cases: circular deps, inherited classes, BROKEN recipes, conditional deps
Real-World Impact
Automotive OEMs shipping vehicles discover pinned OpenSSL 1.0.2 (EOL, multiple CVEs). IoT manufacturers find vulnerable library versions deployed to millions of devices. Supply chain tracking for YOCTO-based deployments becomes possible.
Problem
YOCTO is the build system for embedded Linux across automotive, IoT, networking, and consumer electronics. Billions of devices run YOCTO-built images, but OSV-SCALIBR has no extractor for BitBake recipes. This creates a complete blind spot for firmware scanning and embedded systems vulnerability tracking.
Current Gap
supported_inventory_types.mdcovers Spack, Nix, and various package managers but has no entry for YOCTO or BitBake. Organizations building firmware, automotive systems, and embedded devices get zero CVE coverage for their build dependencies.Data Source
.bbfiles (BitBake recipe format) with DEPENDS, RDEPENDS, BDEPENDS, PV, PN.bbappendfiles (recipe overrides)meta-*/recipes-*/directory structureImplementation
regexpandtext/scannerfor BitBake syntaxextractor/filesystem/language/bitbake/pkg:bitbake/recipe-name@versionmeta-openembedded,meta-security)Real-World Impact
Automotive OEMs shipping vehicles discover pinned OpenSSL 1.0.2 (EOL, multiple CVEs). IoT manufacturers find vulnerable library versions deployed to millions of devices. Supply chain tracking for YOCTO-based deployments becomes possible.