OPEN SOURCE
AT THE CORE
We build, upgrade and maintain embedded Linux systems — and we keep them supportable long after they ship.
EU Cyber Resilience Act
Your product ships with a 2016 kernel.
In 2027 that becomes a legal problem.
Regulation (EU) 2024/2847 applies to any product with digital elements placed on the EU market. Most of the embedded devices we see run a Dunfell-or-older Yocto rootfs on a vendor kernel that stopped receiving fixes years ago. Getting compliant is not a paperwork exercise — it is a build-system and kernel upgrade, followed by a process that keeps proving the device is still patched.
What the CRA asks of the device
- No known exploitable vulnerabilities at the time of placing on the market
- Secure-by-default configuration
- Machine-readable SBOM covering top-level dependencies
- Security updates delivered during the support period
- Documented vulnerability handling and coordinated disclosure policy
What we actually do about it
- Assess the current BSP: what is patchable in place, what needs a rebase
- Upgrade the rootfs to a maintained Yocto/PTXdist/Buildroot/OpenWrt release
- Move the kernel to a supported LTS, port the vendor and board patches
- Generate SBOMs from the build (SPDX 3.0) and wire sbom-cve-check into CI
- Track CVEs against your exact manifest and tell you which ones matter
We do the technical work: the upgrade, the SBOM, the patch pipeline, the CVE triage. We are engineers, not a notified body — we do not issue certificates or sign your declaration of conformity, and we will say so plainly rather than sell you a stamp.
Pricing
Fixed prices, published
Upgrade work is quoted as a fixed price per product, so the budget is known before we start. Prices are in EUR, excluding VAT.
| Upgrade | Scope | Price |
|---|---|---|
| Yocto — Dunfell or older → Scarthgap / Wrynose | User space / rootfs | €20,000 |
| Yocto — Scarthgap rootfs + kernel | Both, done together | €27,000 |
| PTXdist — user space upgrade | User space / rootfs | €12,000 |
| PTXdist — user space + kernel | Both, done together | €18,000 |
| Buildroot — user space upgrade | User space / rootfs | €12,000 |
| Buildroot — user space + kernel | Both, done together | €18,000 |
| OpenWrt — user space upgrade | User space / rootfs | €12,000 |
| OpenWrt — user space + kernel | Both, done together | €18,000 |
| Kernel upgrade | On its own, any of the above build systems | €10,000 |
| Bootloader upgrade | U-Boot, barebox or other | €14,000 |
| Vulnerability tracking | Continuous CVE monitoring and triage against your manifest | €2,000 / year |
| Unplanned interventions | Debugging, incidents, out-of-scope requests | €45 / hour |
- One price covers one BSP on one board family. A second board on the same BSP is quoted separately and costs less.
- Fixed prices assume we get the current sources, the board, and access to someone who knows it. Closed-source vendor blobs with no maintained equivalent are the usual reason a scope changes — we flag that during the assessment, before you commit.
- Heavy process costs more. Daily stand-ups, status meetings and multi-layer sign-off are hours not spent on your board. We will happily work inside your process and quote it — but the fixed price assumes we can get on with the work and report when there is something to report.
- Rewriting proprietary application code to work on the new user space is not included unless we agree on it up front.
- Not sure which line applies to you? Send us your build manifest and we will tell you.
Services
Embedded Linux, end to end
Build systems
Yocto, PTXdist, Buildroot and OpenWrt: layer and BSP structure, reproducible builds, CI integration, and version upgrades that survive contact with a real product.
Kernel, BSP and drivers
Board bring-up, device tree work, V4L2 and media pipelines, hardware codecs, and porting vendor patch stacks onto a maintained LTS kernel.
System software
Init and service design, secure boot and update mechanisms, device control layers, and the applications that sit on top of them.
Security maintenance
SBOM generation (SPDX 3.0), CVE tracking against your exact manifest, patch backports, and a release cadence you can point to in an audit.
Performance work
Boot time, throughput, latency and memory footprint — measured on the device, not on a datasheet, with numbers before and after.
Rescue jobs
The board that boots slowly, the driver nobody can explain, the vendor BSP that never got a second release. This is most of what we do.
How we work
No surprises, no lock-in
Assessment first
Before any fixed-price commitment we look at your sources and your board and write down what we found, what it costs, and what could still go wrong. If the honest answer is that you do not need us, that is the answer you get.
Your build, not ours
Work lands in your repositories, in upstream-shaped layers and patches. Nothing depends on us being there next year. Where a fix belongs upstream, we send it upstream.
Small and direct
You talk to the engineers doing the work. No account layer, no ticket queue, no hand-off to a team you have never met.
We say when we do not know
Embedded work is full of undocumented silicon and half-working blobs. We will tell you what is uncertain and what we will do to find out, instead of quoting confidence we do not have.
Get in touch
Do you want to speak with us?
Send your build manifest, kernel version and board, and you will get a straight answer about what an upgrade involves.
contact@taladin.ro