2026-09-25 –, GPN-T Main Room
Verified boot is a solved-on-paper problem: a hardware root of trust measures and authorizes each stage up to the application. But on edge devices that fetch and execute dynamic workloads — OTA firmware modules, plugins, updatable logic — the trust chain typically terminates at the application image. Everything the application loads afterward runs unverified. For a fleet of internet-facing microcontrollers, that is the entire attack surface that matters, and it sits outside the boot-security envelope.
Secure and measured boot prove the firmware image at power-on — then go silent the moment a device starts pulling and running dynamic OTA workloads. WANTED is an open-source WebAssembly runtime designed for microcontrollers (but not only) that continues the chain past boot: hardware-rooted device identity, Ed25519-signed desired state, SHA-256/cosign-verified OCI supply chain, and capability-confined execution. A pragmatic look at boot-time trust as a runtime problem.
The talk walks the full chain on a Raspberry Pi RP2350 — a part whose switchable dual Cortex-M33 / dual Hazard3 RISC-V cores let the same signed Wasm workload run on the same silicon booted as either ARM or RISC-V, making the architecture-independent trust argument concrete rather than rhetorical.
Hello. I’m Kamil Wcisło, a Systems Engineer specializing in Cloud-Native Embedded Systems and my project, MekOps stands for Microservices, Embedded, and Kernels Operations.
In the modern tech landscape, there is a significant divide. Cloud engineers treat infrastructure as infinite and disposable. Embedded engineers treat hardware as static and specific. I would like to introduce an engineering philosophy that applies the scalability, observability, and orchestration of the Cloud to the rigid, constrained and multi-architectural reality of bare metal.
I build tools that allow physical hardware to be managed with the same agility as a Kubernetes cluster, without sacrificing the performance of C and Rust. To build the next generation of edge computing, you cannot just be an embedded engineer, and you cannot just be a cloud architect. You must own the stack from the Kernel (NuttX/Linux/Rust/C) to the Microservice (Go/Wasm) and finally Operations (Kubernetes).