Using AI To Bridge the Gap Between Safety Standards and Open Source Development
summary
AI extracts requirements and traceability from changing OS code, links them to tests and build SBOM metadata stored in SPDX 3.0+, and uses that graph to decide which tests to rerun after a security fix. Experiments track surprising scale—Linux at 10.5 commits per hour, Zephyr ~4.5—and produce machine-readable artifacts: upstream kernel SBOM support (run make SPDX), a browser-based SPDX visualizer, and an automated pipeline that grows to 590 requirements with 421 marked satisfied, enabling assessors to validate safety claims.
AI-written summary · about
chapters (12)
- 0:00AI and safety standards
- 1:07Safety standards with open source
- 4:20Linux Zephyr change rates AI impact
- 7:50Systemic risk and safety analysis
- 10:23Automating safety engineering SPDX 3.1
- 16:21Reverse engineering requirements AI
- 18:46Zephyr safety assessment progress
- 21:11Requirements traceability AI status
- 23:59Developer reception of AI tools
- 28:14Visualizing safety data SPDX
- 31:25Demo SPDX 3.1 safety visualization
- 38:23Q&A AI Rust safety certification
related talks
13mSecuring the Software Commons: Standards, Automation, and AI for a Resilie...
24mLicense compliance with AI assisted coding
38mOpen Source Licensing in the Era of AI-Assisted Coding
21mNavigating the Intersection: AI’s Role in Shaping the Secure Open Source Software Ecos...
25mYour Software Supply Chain is Only as Secure as its Weakest Link
43mBoF: Open Source & AI: Where OSPOs Make It Work
18mAI Profile
16mAdvanced SAST: How to Secure AI-Generated Code