Yocman repairs failed bitbake tasks with a patch you approve, then checks the image you ship for unpatched CVEs, embedded secrets, weak accounts, licenses and SBOM gaps. It all runs in your terminal; only masked excerpts reach the AI.
$ bitbake core-image-base
NOTE: Executing Tasks
NOTE: Running task 1984 of 3127 (busybox_1.36.1.bb:do_patch)
ERROR: busybox-1.36.1-r0 do_patch: Applying patch '0001-ash-increase-history-size.patch'
Hunk #1 FAILED at 9871. 1 out of 1 hunk FAILED
$ yocman fix
… collecting context: log.do_patch, 4 layers, local.conf (masked)
… reading meta-custom/recipes-core/busybox/busybox_%.bbappend
Diagnosis the patch from meta-custom no longer applies to BusyBox 1.36.1
--- a/recipes-core/busybox/busybox_%.bbappend
+++ b/recipes-core/busybox/busybox_%.bbappend
@@ -1,6 +1,5 @@
SRC_URI += " \
- file://0001-ash-increase-history-size.patch \
file://ash-tweaks.cfg \
Apply this patch? [y/N] y
✓ patch applied in meta-custom
… re-running bitbake -c patch -f busybox
✓ do_patch succeeded
$ yocman audit --fail-on high
Overall score 18/100 over 10 categories
critical CVE-2099-0101 (CVSS 9.8) in openssl 3.2.1
critical OpenSSH private key in /etc/ssh
exit 1: findings at or above highyocman audit reads what the build produced, not a questionnaire: the rootfs, the cve-check report, the SPDX SBOM, the kernel .config and your layers. Every finding has a rule id, the file it comes from and a fix, with a score per category.
Products with digital elements sold in the EU must handle vulnerabilities, ship security updates and document their software, SBOM included. yocman cra report assembles the build-side evidence — CVEs, secrets, SBOM, hardening — into one report.
The Cyber Resilience Act, explained for embedded Linux →11 Sep 2026
Reporting of actively exploited vulnerabilities and severe incidents
11 Dec 2027
All essential requirements apply
bitbake stops on do_patch, do_compile or a QA check. Run yocman fix in the same shell, nothing to set up.
The CLI collects the failing task log, your layers and configuration. The agent investigates with read-only tools and finds the cause.
You get the diagnosis and a unified diff against your own layer. Nothing changes until you say yes, then the task re-runs.
The agent never gets a shell on your workstation. It asks the CLI for specific files, and you see every request.
fixexplainaskcontextlogin
Diagnose a failed task and get a patch for your layer, or ask about your project. Failures already solved for you are answered from your own history.
doctorrulesconflayers checkdepswhyprovidesunusedorphansduplicatessizebuildtimesstateboot
Understand your image: why a package is in it, what takes the space, where the build and boot time go, what sstate rebuilds.
auditcvesecretsuserspermsserviceskernel-auditlicensessbomcra report
Security and compliance checks on the image you actually ship: CVEs, secrets, accounts, services, kernel, licenses, SBOM, with a score per category.
initaddremovebuildshellenvflash
Create a kas project for a verified board or describe it in your words, add features, build with live progress on the host or in a container, flash the card.
Free plan included, no credit card. Install the CLI, then run yocman fix on a failed build or yocman audit on a finished one.
$ pipx install yocman