Making EU CRA (Cyber Resilience Act) simplified and non-scary for OSS contributors
summary
Clear claim: most individual contributors and unpaid maintainers remain out of scope unless the project is monetized, but manufacturers must meet CRA deadlines — vulnerability reporting enforces in September 2026 and full application in December 2027. Concrete tools and outputs include SBOMs as mandatory, mappings from the OpenSSF Product Security Baseline to CRA, automation via GUAC and Trustify plus Scorecard and Minder YAML policies, a vendor-response template and a GitHub "CRA compatible" repo that show how to produce machine-readable evidence and voluntary attestations.
AI-written summary · about
chapters (17)
- 0:00EU CRA introduction
- 3:38Products in CRA scope
- 7:54OSS roles under CRA
- 10:23CRA timeline enforcement
- 11:46Manufacturer compliance needs
- 13:34Affected as OSS contributor
- 17:12Regulatory compliance working group
- 18:37OpenSSF cyber policy efforts
- 20:48Security practices for projects
- 25:47Voluntary attestations
- 27:33Maintainer compliance responses
- 30:22Improving OSS security
- 32:27Security Insights documentation
- 34:12Automating security checks
- 37:02Red Hat's CRA role
- 38:49CRA positive change
- 40:57Key takeaways next steps
related talks
42mMaking EU CRA (Cyber Resilience Act) Simplified and Non-scary for OSS Contributors
53mHow To Stay Compliant With and Take Benefits From the EU CRA (Cyber Resilience Act)
32mHow to stay compliant with and take benefits from the EU CRA (Cyber Resilience Act)
53mThe EU CRA Readiness for Contributors and Maintainers : A Survival Toolkit
44mPanel Discussion: Prepare for the CRA: Open Source Governance in the Age of Cyber Resilience
33mImplementing the EU Cyber Resilience Act (CRA)
14mThe CRA: an Open Source Sustainability law?
30mThe EU's Cybersecurity Resilience Act (CRA) has Begun – How Can Manufacturers Confidently Addres ...