Pre-Packaging CRA and NIS2 Compliance: The SEAPATH Approach
summary
SEAPATH produces release artifacts and an SBOM alongside each CI-built image, integrates VulnScout into GitHub Actions so vulnerability checks run weekly and the CI job fails on new relevant CVEs, and automates triage to filter roughly 75% of noisy findings. Regulatory timings are encoded (25 hours initial notice, full fix or risk report within ~40 days), kernel CVE counts rise about 4x in recent releases, and the project publishes weekly release images to give downstream vendors pre-packaged compliance evidence.
AI-written summary · about
chapters (9)
- 0:00Introduction to CRA and NIS2
- 1:07What is SEAPATH and its purpose
- 3:16Cybersecurity and vulnerability management
- 6:03European regulatory context
- 9:01SEAPATH’s vulnerability scanning setup
- 13:47Reporting and handling vulnerabilities
- 15:16Challenges in filtering CVEs
- 19:15Patch management and LTS limitations
- 21:46Future plans and Q&A
related talks
37mSBOM & Vulnerabilities in SEAPATH
32mImplementing and Validating Linux Cyber Security Requirements: SEAPATH, a Case Study
22mEnsuring Requirements on the SEAPATH Project: Testing Process and Continuous Integration
32mA Security State Of Mind: Compliance and ...
36mSEAPATH: A LF Energy Project for Critical Infrastructure with an Emphasis on Software Supply Chain Security
48mCRA, NIS2, DORA: What Senior Java Engineers Must Deliver Before 2027
39mFrom CVD to Secure Releases: Automating Security from Source to Releases- 36mSEAPATH: A LF Energy Project for Critical Infrastructure with an...