Open Source in Every Car with Automotive Grade Linux
Investigates open Source in Every Car with Automotive Grade Linux and evaluates key implications for security practitioners.
Summary
### Overview In this presentation, Walt Miner, representing the Linux Foundation, provides a comprehensive overview of Automotive Grade Linux (AGL), an open-source collaborative project aiming to build an open operating system and framework for the automotive industry. AGL's primary objective is to develop roughly 80% of an in-vehicle infotainment (IVI) and connected-car starting point, enabling OEMs and Tier 1 suppliers to cut traditional multi-year development timelines by half or more. The project emphasizes a "code-first" philosophy rather than relying strictly on standalone specification documents, drawing together major car manufacturers (including Toyota, Mazda, Subaru, Honda, Mitsubishi, Ford, and Jaguar Land Rover) alongside Tier 1 and Tier 2 suppliers.
### Key Topics - **Unified Code Base (UCB):** AGL shifted away from its original Tizen IVI foundation to build the Unified Code Base, integrating components from Tizen, GENIVI, and broader open-source projects. UCB releases follow a six-month cadence named alphabetically after fish (Agile Albacore, Brilliant Blowfish, Charming Chinook, Daring Dab). - **Collaboration and Membership:** Over 80 member companies collaborate directly in shared repositories, integrating software across device drivers, middleware, and applications. - **Yocto-Based Architecture:** The distribution is organized cleanly into modular Yocto layers: `meta-agl` (core), `meta-agl-extra` (optional, tested features and device profiles), `meta-agl-devel` (experimental development features), and `meta-agl-demo` (demonstrator applications). - **Expert Groups:** Four core working groups drive community work: App Framework and Security, UI and Graphics, Connectivity, and Continuous Integration and Automated Testing.
### Technical Details - **Build & CI Infrastructure:** AGL relies on Yocto Project/Poky (moving from Yocto 2.0 in Brilliant Blowfish to 2.1 in Charming Chinook). Source control is managed via Git and Gerrit, with automated Jenkins pipelines building submissions across all reference hardware boards before merging. Daily snapshot builds and binary images are produced continuously. - **Automated Testing:** Integration testing utilizes the Fuego test framework, actively maintained by the CI and Automated Test expert group. - **Hardware Support:** Boards are divided into fully supported Reference BSPs (maintained by silicon vendors with quick-start guides and CI integration) and Community BSPs (maintained by community best effort, including hobbyist boards like the Raspberry Pi). - **Application Framework & Security:** The architecture features an application framework, SDK tooling aimed at reducing "Hello World" app setup from days to under an hour, and work on an AGL security blueprint document covering out-of-the-box security capabilities, diagnostics, and secure boot. - **Middleware & Services:** Includes ConnMan for IP network management, IVI Audio Manager, IVI Layer Manager, SmartDeviceLink (Ford's open-source connectivity framework), and exploration of open-source compositors and APIs for navigation and speech.
### Takeaways AGL offers an open, standardized plumbing layer to prevent fragmentation across automotive platforms while allowing OEMs and suppliers to differentiate at the application and services layer. While low-level vehicle messaging (like specific CAN bus message catalogs) remains proprietary to manufacturers, AGL supplies the underlying stack, developer tooling, and automated test frameworks needed to rapidly build and deploy automotive software. The project encourages open participation across weekly developer calls, mailing lists, and expert groups.
Related talks
The Linux Foundation·49 min
Demonstrates open Source in Every Car with Automotive Grade Linux by Walt Miner, The Linux Foundation and evaluates key implications for security practitioners.
The Linux Foundation·35 min
Junhyeok Yoo · Four Pillars
Outlines how x402 Brings Open Source Governance to Payments and evaluates key implications for security practitioners.
The Linux Foundation·29 min
Analyzes fusing AOSP and Linux! To Open a New Chapter… - Yong Gong, Phytium: OpenFDE open-source community and evaluates key implications for security practitioners.


