Open Source Summit Europe 2022

There are many things to do when designing a new embedded product. All of them will have an impact on the final security of the product, including: hardware features, the choice of the operating system to use, update system and policies and more. In this talk, Marta is going to give practical advice on choosing software packages for your next product. She will also list common errors. The discussion will be rich in examples from the Eclipse Oniro project and the Yocto Project ecosystem in general, and will include a number of tools available from OpenSSF and other sources. Some of the questions she will answer are: - Should I use a general-purpose distribution, build my own, or a specialized one? - How to choose between software modules doing the same thing? - How to find out if a software package is supported? Maintained? And what's the difference? - Why do I need an update system? - Should I enable secure boot?

CIP (Civil Infrastructure Platform) members are constantly engaged to uncover the potential of Open Source based components for building Industrial Software which have a long life span, this endeavour is further strongly supported by CIP community. The primary focus of this talk would be to discuss how CIP Security work group along with other CIP work groups is working to respond the threats posed by ever growing security concerns. As part of the effort CIP Security WG is working with accredited IEC Certification body to meet international Cybersecurity standards by re-using numerous Debian based components in CIP. CIP is not just reusing Debian based components instead working with several open source communities to strengthen the security of their components. In addition, there will be updates from CIP (Civil Infrastructure Platform) project how CIP is progressing to meet IEC-62443 security requirements by identifying required Debian packages and creating IEC security layer in CIP. It would help developers to get insight into CIP Security work group efforts as well as opportunity to learn more about overall CIP OSBL.

With the deployment of larger fleets of Linux-based devices, centralized management becomes critical: - devices need to be on-boarded - communication with the back-end needs to be secured and authenticated - issues need to be detected before they cause failures - software updates need to be scheduled and monitored - device settings needs to be configured - interactive login may be needed as well Instead of relying on the closed source as-a-service offerings of the large cloud providers, many of us would prefer to avoid the vendor lock-in and use (or build) a fully FOSS fleet and management stack. With this BoF, we want to connect those interested in this topic and exchange experiences with the existing (open and closed) options, identify functionality gaps and collect shared requirements. If there is interest, we'll create a mailing list and/or IRC channel to continue the collaboration after the BoF. We'll be using a shared document to gather topics before and during the BoF and collect notes during the discussions: https://docs.google.com/document/d/1wUghUSas7syUzjeJ971mvpaPQ4VlI1kxDDzPVEdQJ68/edit?usp=sharing

This BoF is a friendly space for people to gather and discuss the open RISC-V instruction set architecture and other open hardware efforts including open source cores and open source FPGA toolchains. Bring your questions and stories to this informal talk and learn more about the state of open hardware. RISC-V Ambassadors as well individuals from RISC-V International should be able to attend to both spark discussion and answer questions.