Zephyr: Evolving To CRA Readiness
summary
Zephyr already auto-generates SBOMs since 2022, acts as a CNA for CVEs, runs a vulnerability alert registry and extends LTS support to 5 years, targeting fixes into mainline within 30 days and giving vendors an extra 60 days in embargo. Manufacturers face 24h/72h/14d notification timelines and heavy fines for noncompliance, so Zephyr focuses on traceable releases, secure build tooling and signed registries. Remaining gaps include EU SBOM format alignment, potential dual CVE databases, module/SDK policy ambiguity and reaching ~7,000 forks.
AI-written summary · about
chapters (5)
- 0:00Zephyr and CRA readiness
- 6:46Zephyr as CRA steward
- 15:11Zephyr security and LTS
- 23:00Manufacturer penalties under CRA
- 29:46Q&A on liability
related talks
40mZephyr: Evolving To CRA Readiness
29mLessons Learned on Following Security Best Practices in Zephyr
40mZephyr Project Security Status
43mZephyr Project: Results from Applying Open Source and Security Best Practices
40mThe Zephyr Project Security Overview, Progress, and Status
38mZephyr: Learnings From Working on Safety Certification in the Open
10mExtending Security to Resource Constrained Devices
32mDeveloping Open Source for Safety and Security