Start with a few questions that tell you whether your fielded Yocto, Buildroot, or OpenWrt product has a maintenance story, or a liability:

• Can you reproduce your shipped image today, on a machine that isn't one person's laptop?
• Do you have a current SBOM for what's actually in the field?
• Are you tracking kernel and userspace CVEs against the shipped version?

The full PDF expands these into a complete self-audit: every checkpoint across reproducibility, CVE tracking, SBOM, documentation, and CRA obligations, scored so you can see where you stand, with a short note on what each gap actually means and how to close it. Enter your email and we'll send it over. Any item you can't check off with a confident "yes" is exactly what a maintenance retainer fixes.