daniel:// stenberg:// @bagder@mastodon.social
Public

Cybersecurity Risk Assessment Request

daniel.haxx.se/blog/2025/07/11

Cybersecurity Risk Assessment Request

With the new EU legislation Cyber Resiliency Act (CRA), there are new responsibilities and requirements put on manufacturers of digital products and services in Europe. Going forward these manufacturers must be able to know and report the exact contents of their software, called a Software Bill of Material (SBOM) and they have requirements to check … Continue reading Cybersecurity Risk Assessment Request →

daniel.haxx.se · daniel.haxx.se

Bradley M. Kuhn @bkuhn@copyleft.org
Public

@bagderdaniel:// stenberg:// Thanks for your post & your counter 😆

I'm curious: you characterize the EU as requiring 's *specifically*. I know the License Compliance Industrial Complex wants it to be true, but I researched this issue for my 2025 talk…
fosdem.org/2025/schedule/event
… & IIUC CRA *doesn't* specify SBOMs specifically.
IMO, if the vendor gives the customer complete, Corresponding Source & a 100% @reproducible_builds they've complied with CRA. No one has shown me anything that disproves that.

FOSDEM 2025 - Is There Really an SBOM Mandate?

fosdem.org

0
0
0

If you have a fediverse account, you can quote this note from your own instance. Search https://fedi.copyleft.org/users/bkuhn/statuses/114836503599175854 on your instance and quote it. (Note that quoting is not supported in Mastodon.)