From Manufacturer to Steward Red Hat’s Approach to CRA Readiness
summary
Red Hat describes an internal CRA program that breaks work into eight work streams covering awareness, upstream engagement, vulnerability management, conformity and legal, and product changes, and uses a stewardship framework classifying projects as basic or champion. Preliminary assessments show 70% meet basic stewardship criteria (security policy, vulnerability triage, incident response, SDLC and infrastructure hygiene). Champion projects add things like OpenSSF baseline level 1 SLSA guidance and SBOM support. Major hurdles are ambiguous standards, tight timelines and dozens of implementing documents.
AI-written summary · about
chapters (16)
- 0:00CRA readiness approach
- 1:06Why CRA matters for open source
- 3:18Vendor compliance urgency
- 4:21PDS scope and Red Hat’s role
- 5:50Red Hat’s manufacturer and steward role
- 7:20Internal CRA program and work streams
- 9:07Manufacturer requirements and practices
- 12:16Stewardship for open source projects
- 13:24Project eligibility for stewardship
- 16:35Stewardship requirements and alignment
- 18:43Champion stewardship and security
- 20:07Preliminary Red Hat project assessment
- 21:32CRA readiness challenges and lessons
- 24:00CRA timeline and enforcement gaps
- 25:06Multistakeholder alignment and coordination
- 26:13Call to action for improvement
related talks
44mPanel Discussion: Prepare for the CRA: Open Source Governance in the Age of Cyber Resilience
53mHow To Stay Compliant With and Take Benefits From the EU CRA (Cyber Resilience Act)
54mThe CRA, Where Are We Six Months After Its Approval
42mMaking EU CRA (Cyber Resilience Act) simplified and non-scary for OSS contributors
42mMaking EU CRA (Cyber Resilience Act) Simplified and Non-scary for OSS Contributors
20mNavigating Compliance: What Developers Can Learn From Driving
14mThe CRA: an Open Source Sustainability law?
27mBeyond Open Source Risks With the CRA and NIS2