Introduction to CRA Attestations and Workshop Read-outs
summary
The EU Cyber Resilience Act makes manufacturers legally responsible for the open source in their products and Article 25 expects stewards to publish basic security policies and cooperate with authorities. The community distinguishes process-based attestations (lightweight, checklistable) from outcome/CE-level attestations; Erlang Foundation secures manufacturer funding, hires a CISO, starts a CNA, implements OpenChain and plans transparency logs. Key problems tackled: machine‑readable attestations with timestamps and signatures, aggregated attestations for transitive dependencies, and economic models via manufacturers, procurement or insurance.
AI-written summary · about
chapters (13)
- 0:00CRA attestations introduction
- 1:45CRA impact on open source
- 9:20Erlang Foundation’s CRA journey
- 16:05Workshop structure and challenges
- 27:27Group discussions and findings
- 29:58Economic models for open source
- 35:16Attestation transmission verification
- 38:27Minimum attestation requirements
- 44:09Attestations for transitive deps
- 50:30Process-based attestations
- 56:32Outcome-based attestations
- 1:01:56Third-party trust models
- 1:08:40Next steps and collaboration
related talks
53mHow To Stay Compliant With and Take Benefits From the EU CRA (Cyber Resilience Act)
42mMaking EU CRA (Cyber Resilience Act) simplified and non-scary for OSS contributors
42mMaking EU CRA (Cyber Resilience Act) Simplified and Non-scary for OSS Contributors
32mThe EU Cybersecurity Resilience Act (CRA) - Boring, Scary or Exciting?
33mImplementing the EU Cyber Resilience Act (CRA)
14mThe CRA: an Open Source Sustainability law?
27mEU Cyber Resilience Act: What Every Manufacturer Needs to Know
44mThey're coming to regulate you!