Source-linked AI summary
An Empirical Study of the TianoCore Community
Nazanin Siavash, Connor Glosner, Ayushi Sharma, Bianca Trinkenreich, Terrance E. Boult, Aravind Machiry, Armin Moin
TL;DR
The paper addresses limited evidence about security engineering and maintenance practices in the TianoCore ecosystem, which maintains the open-source core of widely used UEFI firmware. Through a survey and follow-up interviews, it finds strong security awareness alongside manual, inconsistently standardized workflows and identifies opportunities for greater automation, verification, DevSecOps, and memory-safe development.
Problem
The study addresses limited evidence about security engineering and maintenance practices in the TianoCore ecosystem, which maintains the open-source core of widely used UEFI firmware.
Method
The researchers conduct a survey-based empirical study complemented by follow-up interviews to examine bug management, patch management, verification, and validation.
Results
The findings show strong security awareness but highly manual, heterogeneous, and inconsistently standardized workflows, with limited AI-assisted triage and memory-safe technology adoption.
Takeaways & Limitations
The study identifies opportunities to improve automation, verification and validation, vulnerability management, DevSecOps incorporation, and support for memory-safe development.
Abstract
from arXiv · showhide
We investigate the software security and maintenance practices adopted by stakeholders in the TianoCore community and identify opportunities to improve firmware development workflows. We conduct a survey and a limited interview study with participants representing independent firmware vendors, original equipment manufacturers, security experts, firmware developers, and academic researchers. This open-source development community maintains a reference implementation for the core of the UEFI firmware. We highlight important gaps in the current state of firmware development within the TianoCore ecosystem and identify key areas in which improved security practices, greater adoption of memory-safe technologies, and increased automation of manual processes could strengthen the maintenance and security of the UEFI firmware.
1 Introduction
The study examines security engineering and maintenance workflows in the TianoCore ecosystem, which maintains the open-source core of widely used UEFI firmware. It uses an online survey complemented by follow-up interviews to investigate bug management, patch management, and verification and validation.
- TianoCore maintains the open-source core of UEFI firmware, a critical technology widely used across devices worldwide.
- The study investigates security engineering practices and software maintenance workflows within the TianoCore ecosystem.
- The researchers use a survey-based methodology complemented by follow-up interviews.
- The research questions address bug reporting, issue tracking, bug triage, and adoption of automated or AI-assisted approaches.
2 Related Work
Prior empirical studies examined security engineering, vulnerability management, and security and trust practices across open-source software projects. They reported persistent challenges and heavy reliance on manual maintenance despite available automation.
- Earlier studies used surveys and interviews to examine maintainers’ experiences and security engineering challenges in open-source projects.
- Prior work found that many open-source maintainers relied heavily on manual maintenance processes despite available automated tools and features.
- Other empirical investigations studied vulnerability management practices through interviews with security professionals.
- Related research also examined security and trust practices among contributors, maintainers, team leaders, and project owners.
3 Survey Results
Survey responses indicate strong security awareness but heterogeneous, largely manual workflows across the TianoCore ecosystem. Issue tracking is moderately structured, while security vulnerabilities receive the highest triage priority and AI-assisted triage remains limited.
- 13 participants completed the anonymous online survey, and 2 volunteered for follow-up interviews.
- Security was treated as a high-priority concern, but security and maintenance workflows remained highly manual and inconsistently standardized across organizations.
- Bug reporting and issue tracking were moderately structured but heterogeneous; GitHub Issues was most common, without a single ecosystem-wide tracker.
- Security vulnerabilities received the highest bug-priority ranking, while bug triage remained predominantly manual with very limited AI-assisted adoption.
- Interest in memory-safe firmware, particularly Rust-based alternatives for EDK II, exceeded practical adoption because of toolchain, legacy-code integration, and expertise concerns.
- Supply-chain verification practices remained predominantly manual, relying primarily on code inspection and vulnerability-feed monitoring.
4 Conclusion & Future Work
The study finds strong security awareness in TianoCore but identifies opportunities to improve automation, verification and validation, vulnerability management, DevSecOps, and memory-safe development. It notes that the study’s relatively small sample is a limitation.
- The findings identify opportunities to improve automation, verification and validation infrastructure, vulnerability management, DevSecOps incorporation, and memory-safe development support.
- The study’s relatively small sample is identified as one of its limitations.
- Future studies may examine additional ecosystem aspects and how TianoCore might address the identified issues.