Zephyr Project: Results from Applying Open Source and Security Best Practices
summary
Zephyr reports 1,777 commits on GitHub as of Dec 1 (about 2.45 commits/hour), ranks fifth among Linux Foundation projects, and has over 5.4k forks, 550 boards and 170 sensors in-tree. The project runs a PSIRT and acts as a CVE Numbering Authority (CNA), generates three SBOMs automatically via West/CMake builds, holds a gold CII badge since 2019, targets two‑year LTS releases with six‑month overlap, commits to ~30‑day fix turnarounds and 60‑day vendor embargoes, and is pursuing IEC 61508 safety certification.
AI-written summary · about
chapters (9)
- 0:00Introduction to Zephyr
- 1:38Project growth and metrics
- 4:58Adopting open source lessons
- 9:08Governance and development
- 13:06Technical architecture
- 17:04Security best practices
- 25:50Safety and certification
- 29:41Ecosystem and applications
- 36:44Q&A session
related talks
40mZephyr Project Security Status
43mZephyr at 10 Years: Survey Feedback
40mThe Zephyr Project Security Overview, Progress, and Status
29mLessons Learned on Following Security Best Practices in Zephyr
40mZephyr: Evolving To CRA Readiness
40m9 Years in the Making, the Story of Zephyr, Starting with Commit Nr. 1
38mZephyr: Learnings From Working on Safety Certification in the Open
16mHow Zephyr is eating the (embedded) software world