Code and Compliance Community Day 2025
2025-10-22..2025-10-23
Brussels, Belgium
as the organisers put it
The open source community is collaborating to establish common specifications for secure software development based on open source best practices.
| title | author | length |
|---|---|---|
| The SECURE Project: Funding Opportunity for SMEs | Marie Gheysen | 11m |
EU-funded SECURE offers SMEs €30,000 cascade grants as 50% co-funding (projects up to €60,000), a one-stop online platform launching in November, and an open… | ||
| Understanding the Stewardship Role in CRA Compliance | Dirk-Willem van Gulik | 15m |
Regulatory guidance sharpens responsibilities: open source stewardship is product‑specific, not foundation‑wide, and most stewards already meet the basic… | ||
| Attestation Framework & Objectives | Ciarán O'Riordan | 17m |
Argues that policy is the new licensing and shows concrete wins: specific clauses landed in the Cyber Resilience Act forcing standards bodies to consult free… | ||
| Introduction to CRA Attestations and Workshop Read-outs | Æva Black | 01h 09m |
The EU Cyber Resilience Act makes manufacturers legally responsible for the open source in their products and Article 25 expects stewards to publish basic… | ||
| From Manufacturer to Steward Red Hat’s Approach to CRA Readiness | Roman Zhukov | 28m |
Red Hat describes an internal CRA program that breaks work into eight work streams covering awareness, upstream engagement, vulnerability management… | ||
| Our journey to CRA | Petri Maanonen | 21m |
Company establishes a programed effort to meet the CRA, keeps ISO 27001 certification, and converts vulnerability intake by becoming a CVE number authority in… | ||
| Compliance in Practice Nokia's Perspective on the CRA | Timo Perala | 31m |
Nokia describes a compliance program that already runs across product groups, founded on an open source program office, industry standards work and the Open… | ||
| Turn CRA Awareness into Action | Martin von Willebrand, Andreea Gălbău, Iulisa Zbranca, Sébastien Heurtematte, Philippe Ombredanne, Marcel Mertens | 46m |
Octet stitches OSS Review Toolkit and OR server into a federated data layer that stores package facts as text in many git repos and an operational Postgres… | ||
| Opportunities to Participate in Standardization | Jordan Maris, Daniel Thompson-Yvetot, Aki Rose Braun, Aistė Merfeldaitė | 46m |
The panel lays out concrete status and entry points for Cyber Resilience Act standardization: the EUSR request dates from February 2025, CRA is in force since… | ||
| Event Summary and Wrap up | Timo Perala | 06m |
Thanks to Eclipse and Red Hat and to contributors for a full day that clarifies next steps: a secure project workshop kickstarts stewarding work, three… | ||
| Highlights from Brussels | 03m | |
Argues that open source due diligence must be performed collectively across organizations rather than duplicated inside each company and cites Huawei as an… | ||
| Concerned about the CRA and how it impacts open source? | 01m | |
Examines how CRA implementation changes open source compliance, with regulators, maintainers and users mapping policy interpretation onto everyday workflows… | ||
| nothing matches | ||